B
B
BotaniQ_Q2017-05-30 22:38:38
MySQL
BotaniQ_Q, 2017-05-30 22:38:38

I don't understand myself how I achieved this sql injection?

I’m studying SQL injection, here’s a problem book and my solution is in it right away 725d0b5ab0ee4133b07651c6a6ea66de.PNG
and no matter how stupid it sounds, I didn’t understand what I did :)
I put it by accident, okay, I understand that when we enter a quote, it is understood that the request body is over, then we put a comment (and without a space), everything after it is not taken into account, then again a quote, which seems to be not taken into account, because we put a comment sign, but if you write like this '== or like this ==' or like this 'SELECT pass FROM users where id=9, then all this is wrong, what the hell is this and how does it work? And here is the next task. 637ee54a468e4cb8b2602400a27b8361.PNGwhich asks to find the difference with the previous one, okay, there is a LIMIT limiter here, which allows you to request only 1 line, it turns out if we enter the previous answer, it will give out only the first line, if there was no limit, it would give out everything, how to bypass this herabora, I don’t know , googling didn’t help, I seem to know about sql injections at the level, that I can google sites and break them with handles without SQLmap, but I don’t understand what’s going on here and what to do with it, but I really want to figure it out

Answer the question

In order to leave comments, you need to log in

2 answer(s)
E
Egor Kazantsev, 2017-05-30
@saintbyte

Do you know the SQL language at all?

N
neol, 2017-05-31
@neol

I set it by accident, okay, I understand that when we enter a quote, it is understood that the request body is over, then we put a comment (and without a space), everything after it is not taken into account, then again the quote, which seems to be not taken into account, because we put a comment sign, but if you write like this '== or like this ==' or like this 'SELECT pass FROM users where id=9, then all this is wrong, what the hell is this and how does it work?

No space -- is recognized as an arithmetic operation, not a comment (this is described in the documentation).
to evaluate your
login ''--'' expression
, an implicit type conversion comes into play, which converts '' to 0. The result is 0--0.
To compare all login values ​​in the table with this 0, type conversion again comes into play and each value is converted to a number (accordingly, if the login does not start with a number greater than 0, then it will be equal to 0). Well, as a result, the query returns all logins that do not start with a number greater than 0.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question