Follow us on Twitter!
Things are more like they are now than they have ever been before. - Dwight D. Eisenhower
Thursday, April 24, 2014
Navigation
Home
HellBoundHackers Main:
HellBoundHackers Find:
HellBoundHackers Information:
Learn
Communicate
Submit
Shop
Challenges
HellBoundHackers Exploit:
HellBoundHackers Programming:
HellBoundHackers Think:
HellBoundHackers Track:
HellBoundHackers Patch:
HellBoundHackers Other:
HellBoundHackers Need Help?
Other
Members Online
Total Online: 27
Guests Online: 26
Members Online: 1

Registered Members: 82904
Newest Member: jamessmith123
Latest Articles
View Thread

HellBound Hackers | Challenges | Basic

Author

basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 12-06-05 07:19
hey everybody I am having trouble with this one I cant find out where i have to use SQL only reason it has to be SQL is because of the null in the source but any way i know the files directory i tryed searching all of those and nothing can you guys help me out and point me to the right direction but even not i just need to know if im heading in the right direction with this one



Edited by on 17-06-05 05:18
Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 28-06-05 13:27
look in sorce and try to find where the files are stored, it should be a help Grin
Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 29-06-05 02:37
Well, I got to the SQL injection part myself, and I noticed that the page looked exactly like the one from basic 8. So I tried the same thing as I did for 8. It gave me the password just like it did for 8, took me to the enter password screen, but when I try the password, it gives me a 404.
It looks to me as though basic 8 was copied into basic 9 as a way of taking people off the right track. My question is: is doing the same thing as for basic 8 the right thing? Apparently not... but am I at least in the right place?
Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 11-08-05 00:16
yes, i found about that too. And i also searched for login.php and i gave me a login page. Am i on the right track?


Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 13-08-05 02:03
hackbot205 wrote:
yes, i found about that too. And i also searched for login.php and i gave me a login page. Am i on the right track?


Yes you are on the right track, I havent finished it, but I have figured that out, and now we have to do an SQL injection. Here is mine:
SELECT * FROM (Still trying to figure this variable out)

I just dont know the last part. I dont know how to figure it out Sad




Edited by on 13-08-05 02:06
Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 14-08-05 12:59
Raster wrote:
Yes you are on the right track, I havent finished it, but I have figured that out, and now we have to do an SQL injection. Here is mine:
SELECT * FROM (Still trying to figure this variable out)

I just dont know the last part. I dont know how to figure it out Sad


Try doing the same as in 8... I gives me exactly the same as in 8 but after that a 404 that a certain page cannot be found.
*spoiler
[color=silver]Logging in with the pass I got this way and the basic 8 username is a dead end.
[/color]
*end spoiler
Is this mission broke or something???


Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 14-08-05 23:55
Ok, I have foung that basic9/***/***.php is injectable. If you were using the same command as 8 you would get an error because you are in a diffrent folder and 41.php does not exist in basic 9.

SELECT%20*%20FROM%20(Basic 8 sql password file)
We need to find the Basic 9 password file...

[EDIT]

I have found this command that may help, but I havent had any luck with it:
SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

Basicly the INFORMATION_SCHEMA.TABLES-- give out all the tables from basic 8 to basic 9, from what I have read, I have tryed injecting it, but absolutly no luck.

[EDIT*2]

Does anyone know of any SQL injections that will creat an error to tell us what was wrong with the UNION SQL command?




Edited by on 15-08-05 00:29
Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 02-09-05 19:14
I found the folder with the files. And i found out that i can use SQL Inline Injection on it. I need to find out where in the DB the password and username is stored by using the SQL Vulnerable s*****.*h*? Any help? Something to read like some tutorials? I have reed many tutorials but still not shure how to find the string...


Author

RE: basic 9


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 03-09-05 02:02
Ok, I found some more info on this:
You dont use an SQL injection
It has something to do with NULL (meaning nothing; no variable set), and Im not going to continue, cuz of the spoilers