Please ask questions ONLY in this topic.

[fashizzlepop]

He has already using both the main site and forum PM system.

Everyone should remember, the main site's PM system has no post count requirement.

[Dfury17]

Hi Everyone, first post for me, i've been playing around for two days on this website and i've learned so much, but now i'm really stuck with this think, i red every post, every tutorial posted (as my mind could sustain) for 2 hours and half but i'm still stuck in this... i think that i'm very close to get the email address, my injection contains all the commands listed in the replies, i'm getting really nervous and i woud apreciate if someone could control the syntax of my injection, i really don't know where i'm doing mistake, I also know the right number of column.


.php?category=1 S***** *, n***, n***, n*** F*** e**** U**** A** S***** F*** p*******

[conscience]

Hi Everyone, first post for me, i've been playing around for two days on this website and i've learned so much, but now i'm really stuck with this think, i red every post, every tutorial posted (as my mind could sustain) for 2 hours and half but i'm still stuck in this... i think that i'm very close to get the email address, my injection contains all the commands listed in the replies, i'm getting really nervous and i woud apreciate if someone could control the syntax of my injection, i really don't know where i'm doing mistake, I also know the right number of column.


.php?category=1 S***** *, n***, n***, n*** F*** e**** U**** A** S***** F*** p*******

I guess the problem lies in the fact that you seem to misunderstand the way the GET parameter is used.
An SQL query takes the form of SELECT field1,field2,etc FROM table WHERE column=value
As you might have guessed the GET parameter is concatenated somewhere into that string, most probably replacing the "value" in the WHERE clause. This means you have control over the end of the query string and you'll need to attach some additional stuff in a way that it forms a valid SQL query in conjunction with the original one. Note that the count of fields returned by the 'second query' must match the count of fields in the original one in order to keep the returned array consistent (the return value valid).

Everything else you might need is the MySQL UNION manual (edit if it's spoilish, please) which you can find at http://www.mysql.com

PS: Install a MySQL server if you can (preferably with webserver and php) and check mysql.help_topic table

[BalisongAddict]

I have looked through many SQL Injection tutorials and I can't seem to understand them. I understand that the table is called "emails" and that is where I have to get the information from, but I don't understand the SQL Injections very well at all.

Can someone link me to an SQL Injections tutorial that is easy to understand and has the information that I need?

[mShred]

Didn't take much time to read through anything, but i found this.
SQL injection really helps if you actually know what it is for and why it's used and everything. Don't be afraid to research MySQL or anything to get more of a broad yet firm, teehee, grasp of it.
More directed toward the mission, try looking up UNION ALL queries.

[krystah]

Hello there. I have read through nearly all the posts in this thread and the related SQL-query thread, at least 5-10 SQL Injection tutorials and several UNION ALL tutorials, and I have gathered enough information to know how to complete the challenge, but I won't. Why? Because I don't understand it yet, and it would defeat the purpose of all these hours spent researching, which brings me here:

1. We are performing a query using the U**** A** command, even though we're only after information from the e**** table. Is this only necessary because the query already contains a request from another table (i.e. the "category=2" part)?

2. We have to find out the number of columns from the unknown table in order to successfully produce a result-set using U**** A**. How am I supposed to find out information about the unknown table, in this case, the number of columns? This brings me to my next and last question:

3. I have heard people speaking of a "trick" of sorts, which involves using "ORDER BY" to find out the number of columns from a table. A person told us to "increment until it falls off". This was very unclear to me, as in my previous experiences with RDBMS, we have been taught that when you use ORDER BY it goes something like the following example.

SELECT name, age, height FROM persons ORDER BY age

ORDER BY takes a column-name and sorts the result-set according to it. Is it possible to tell ORDER BY to sort after a specific column-number? I.e

SELECT name, age, height FROM persons ORDER BY col2

If so, then yes, I could see how it is possible to increment the column-number until it no longer produces any result. But is this possible? I have never seen it, and it is not documented at W3Schools. If not, can someone please assist me in understanding this?

Sorry for the lengthy post and thanks in advance.
Krys

[tammai]

I can't send email list . The HTS Messages Center said: "Your response did not generate a victory condition for the challenge. Please try again!", PHPBB said: "You are not authorised to send private messages.". Anyone give me a hint?

[mShred]

I can't send email list . The HTS Messages Center said: "Your response did not generate a victory condition for the challenge. Please try again!", PHPBB said: "You are not authorised to send private messages.". Anyone give me a hint?

Don't use the forum PMing system. Use the main site. But you must not have submitted the correct message.?

[conscience]

1. We are performing a query using the U**** A** command, even though we're only after information from the e**** table. Is this only necessary because the query already contains a request from another table (i.e. the "category=2" part)?

Yes.

2. We have to find out the number of columns from the unknown table in order to successfully produce a result-set using U**** A**. How am I supposed to find out information about the unknown table, in this case, the number of columns? This brings me to my next and last question:

The query fails if column count (and types) don't match, executes otherwise (i.e. you SEE correct results). You are able to ask for an arbitrary number of cols in a query. Can't go any further into it without giving the solution (to this point) away.

3. I have heard people speaking of a "trick" of sorts, which involves using "ORDER BY" to find out the number of columns from a table. A person told us to "increment until it falls off". This was very unclear to me, as in my previous experiences with RDBMS, we have been taught that when you use ORDER BY it goes something like the following example.

SELECT name, age, height FROM persons ORDER BY age

ORDER BY takes a column-name and sorts the result-set according to it. Is it possible to tell ORDER BY to sort after a specific column-number? I.e

SELECT name, age, height FROM persons ORDER BY col2

If so, then yes, I could see how it is possible to increment the column-number until it no longer produces any result. But is this possible? I have never seen it, and it is not documented at W3Schools. If not, can someone please assist me in understanding this?

Uhm... not sure. The best way to find out is installing a MySQL server on your machine. it also makes sense to query the mysql.help_topic table on your server. It is also a good idea to refer to http://dev.mysql.com if your looking for something specific.

Sorry for the lengthy post and thanks in advance.
Krys

You belong to those who are able to descrive their needs. No shame...

[Mem-]

I have read through this forum and I have done a whole lot of research and I still didnt quite get it.
I will admit that I checked out the youtube solution to get this one. However I still dont quite understand the final statement to get the emails.

I can find out how many columns there are.
I understand the first part of the union statement, however I dont understand how I get the order of the things in the final part. I have seen the solution but I would like to gain a better understanding of what is actually happening.

Can someone give me a run down on what is actually happening?

I just dont understand how the email one works. Does it work like a table and the first column is just an integer that goes up by int+1. Where the second row is the email address is that correct?