how to exploit SQL INJECTION?

From: Pablo Escobar (slackware77@gmail.com)
Date: Tue Jun 21 2005 - 17:06:05 EDT

• Next message: boxerb: "RE: Core Impact"
• Previous message: Chris Raymond: "Re: Core Impact"
• Next in thread: David Eduardo Acosta Rodríguez: "Re: how to exploit SQL INJECTION?"
• Reply: David Eduardo Acosta Rodríguez: "Re: how to exploit SQL INJECTION?"
• Reply: Victor Chapela: "RE: how to exploit SQL INJECTION?"
• Reply: Steve Friedl: "Re: how to exploit SQL INJECTION?"
• Maybe reply: kashmira.phalak@gmail.com: "Re: how to exploit SQL INJECTION?"
• Reply: Pablo Fernández: "Re: how to exploit SQL INJECTION?"
• Reply: Leandro Reox: "RE: how to exploit SQL INJECTION?"
• Reply: Christian Martorella: "Re: how to exploit SQL INJECTION?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hello people, I made in my network website server with SQL with
vulnerabilities to learn how to exploit it, I searched in google and i
tried but dont work, the report of the nessus is:

The following URLs seem to be vulnerable to various SQL injection
techniques :

/resources/expand_subject.asp?id='UNION'
/resources/expand_subject.asp?id='UNION'
/resources/expand_subject.asp?id='UNION'
/resources/expand_subject.asp?id='
/resources/expand_subject.asp?id='
/resources/expand_subject.asp?id='
/resources/expand_subject.asp?id='%22
/resources/expand_subject.asp?id='%22
/resources/expand_subject.asp?id='%22
/resources/expand_subject.asp?id=9%2c+9%2c+9
/resources/expand_subject.asp?id=9%2c+9%2c+9
/resources/expand_subject.asp?id=9%2c+9%2c+9
/resources/expand_subject.asp?id='bad_bad_value
/resources/expand_subject.asp?id='bad_bad_value
/resources/expand_subject.asp?id='bad_bad_value
/resources/expand_subject.asp?id=bad_bad_value'
/resources/expand_subject.asp?id=bad_bad_value'
/resources/expand_subject.asp?id=bad_bad_value'
/resources/expand_subject.asp?id='+OR+'
/resources/expand_subject.asp?id='+OR+'
/resources/expand_subject.asp?id='+OR+'
/resources/expand_subject.asp?id='WHERE
/resources/expand_subject.asp?id='WHERE
/resources/expand_subject.asp?id='WHERE
/resources/expand_subject.asp?id=%3B
/resources/expand_subject.asp?id=%3B
/resources/expand_subject.asp?id=%3B
/resources/expand_subject.asp?id='OR
/resources/expand_subject.asp?id='OR
/resources/expand_subject.asp?id='OR
/resources/expand_subject.asp?id=' or 1=1--
/resources/expand_subject.asp?id=' or 1=1--
/resources/expand_subject.asp?id=' or 1=1--
/resources/expand_subject.asp?id= or 1=1--
/resources/expand_subject.asp?id= or 1=1--
/resources/expand_subject.asp?id= or 1=1--
/resources/expand_subject.asp?id=' or 'a'='a
/resources/expand_subject.asp?id=' or 'a'='a
/resources/expand_subject.asp?id=' or 'a'='a
/resources/expand_subject.asp?id=') or ('a'='a
/resources/expand_subject.asp?id=') or ('a'='a
/resources/expand_subject.asp?id=') or ('a'='a

now,how can I exploit it?,somebody can guide me plz?,thank u very
much,good luck.

• Next message: boxerb: "RE: Core Impact"
• Previous message: Chris Raymond: "Re: Core Impact"
• Next in thread: David Eduardo Acosta Rodríguez: "Re: how to exploit SQL INJECTION?"
• Reply: David Eduardo Acosta Rodríguez: "Re: how to exploit SQL INJECTION?"
• Reply: Victor Chapela: "RE: how to exploit SQL INJECTION?"
• Reply: Steve Friedl: "Re: how to exploit SQL INJECTION?"
• Maybe reply: kashmira.phalak@gmail.com: "Re: how to exploit SQL INJECTION?"
• Reply: Pablo Fernández: "Re: how to exploit SQL INJECTION?"
• Reply: Leandro Reox: "RE: how to exploit SQL INJECTION?"
• Reply: Christian Martorella: "Re: how to exploit SQL INJECTION?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:26 EDT