blind sql load_file

Now, here's the deal. I've been trying to get a full path disclosure on this site to make my load_file sufficient. Unfortunately, i can't find one. Out of all the junk and holes this person has in his site, i can't manage to get a f*cking path without being malicious and destroying some stuff/adding a new user into mysql.user.

Anyways, i was wondering if it's possible to somehow grab a path from within the sql injection. I've already tried to execute phpinfo() into an outfile, but it has some problems with that.

And…i have no restrictions and it's MySQL

i would continue doing what your doing, sticking php info() into an out file.

what errors are you getting when you do it?

Just presents me with a blank page, same as 1=0.

Um…let's see. Let me show you what i'm doing: markuphttp://www.site.com/notreal/blah.php?fu=16999/**/UNION/**/ALL/**/SELECT/**/null,null,null,null,char(60,63,112,104,112,32,112,104,112,105,110,102,111,40,41,59,63,62),null,null,null,9,null,null,null,null,null,null,null,null/**/INTO/**/OUTFILE(char(47,98,108,97,104,47,121,101,115,46,112,104,112))/*

i got an error on a site i was trying something similar on, it might help some?

SELECT INTO must be the first query in an SQL statement containing a UNION operator.

Well, it seems that i can't use char() in outfile. Seeing as i can't use quotes, i'm shit out of luck on that method. Can anyone think of another way to get me a path?

What SQL server are they running?

nights_shadow wrote: Now, here's the deal. I've been trying to get a full path disclosure on this site to make my load_file sufficient. Unfortunately, i can't find one. Out of all the junk and holes this person has in his site, i can't manage to get a f*cking path without being malicious and destroying some stuff/adding a new user into mysql.user.

Path as in full server path?

Example: /var/www/site.com/public_html/

If you want something like that, try this:

?getVar[]=someVal

That should spit out an error as it tries to push an array to a string ;)

Nah, system, that, among other things, are what i tried for an information disclosure bug. Anyways, i got it all sorted out a while ago.

Thanks for the help anyways guys.