Timeline for Can you exploit an SQLi authentication bypass for anything else?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 5, 2022 at 11:16 | vote | accept | ishy987 | ||
| Aug 5, 2022 at 11:13 | comment | added | Steffen Ullrich | @ishy987: Like I said, it depends on "the exact vulnerability, the database design, the execution environment ..." . Nothing of this is known here. | |
| Aug 5, 2022 at 11:11 | comment | added | ishy987 | But the output was quite weird, looking something like: [INFO] retrieved: ~vNp|\r?^_m [INFO] retrieved: }Є~~p|X\x7f莡t\x10\x7f|\x7f~ݺ߿x\x02\n [INFO] retrieved: t%01J|N_\x03\r+\x0fM [INFO] retrieved: J9hd4 Do you have any clue on why the output seems to be so weird? Also the database is an MSQL and the injection command took the form "or 1=1" | |
| Aug 5, 2022 at 10:50 | comment | added | ishy987 | As I am experienced with using sqlmap, I tried enumerating info from the database, however, I was not successful. my command took the form "sqlmap -u <URL> --data="<data tags>" --dbs | |
| Aug 4, 2022 at 19:33 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |