+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Detailed Basic and Full SQL Injection Tutorial (/showthread.php?tid=50356)
* - potaie_4u - Nov 14, 2009
bro nice tutorial ...yeah
Hello,
I have questions for all.Please help me.
How i find for vulnerability from a site ? Because i try to make this and it's not working :
"inurl:index.php?catid="
"inurl:news.php?catid="
"inurl:index.php?id="
"inurl:news.php?id="
I have a friend that he find to broke a website.Also i wanna to make the same job,but it's not work.
Please help me.
Who help me...for more we speak on yahoo messenger...PM for id.
* - Videogamer555 - Nov 16, 2009
Ok in order to find how the URL an HQforums forum looks, I made my own free account and of course am the admin. The URL you type to get to such an HQforums forums is just:
blablablabla.hqforums.com
In my case it's bensgaming.hqforums.com
Also bensgaming.hqforums.com/index.php will work
Once there the URL in the browser bar is:
Code
http://bensgaming.hqforums.com/The login page is at:
Code
http://bensgaming.hqforums.com/login.phpOnce logged in it looks like:
Code
http://bensgaming.hqforums.com/index.php?sid=f8cadd125a66f211764c19d3bbac24a1Then when I click the button to go to the admin panel it asks me to log in again. This time though, the URL for the login page is :
Code
http://bensgaming.hqforums.com/login.php?redirect=admin/index.php&admin=1&sid=f8cadd125a66f211764c19d3bbac24a1When logged in to the admin panel, the URL is:
Code
http://bensgaming.hqforums.com/admin/index.php?admin=1&sid=f8cadd125a66f211764c19d3bbac24a1With this info I should be able to apply one of these SQL injection hacks to hack my own account for testing. However I don't quite see any URLs in the tutorials around here that look even REMOTELY similar to the ones at my forums site. Can someone provide a tutorial on how to hack an HQforums forum with SQL injection (or any technique for that matter that can be performed with simple software from a computer running Windows XP Home Edition with SP3)? Thanks in advance.
Now I did the vulnerability check with:
Code
http://bensgaming.hqforums.com/index.php?catid=1'and it returns this error:
Code
Forbidden
You don't have permission to access /index.php on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.So I assume it to be vulnerable since it DID return an error. However I don't know how many colums it has in the database, and the technique shown above
Code
http://www.xxxx.com/index.php?catid=1 order by 1-- "no error"
http://www.xxxx.com/index.php?catid=1 order by 2-- "no error"
http://www.xxxx.com/index.php?catid=1 order by 3-- "no error"
http://www.xxxx.com/index.php?catid=1 order by 4-- "no error"
http://www.xxxx.com/index.php?catid=1 order by 5-- "error"Reveals nothing to me in ANY way. No error occurs at order by 1, 2, 3, 4, or 5. Please help.
* - Videogamer555 - Nov 16, 2009
Are there any SQL hacks or injection attacks that are NOT "union" based?
* - OKaide - Nov 18, 2009
Everytime, on every SQL-vulnerable website I attempt to exploit, I always get stumped at the UNION SELECT ALL step, because of this error:
The used SELECT statements have a different number of columns
What does this mean? At the moment I am trying to practice on this site that was listed here on these forums for this very purpose. The site is : http://www.shaadiwaadi.com/index.php?id=26
I did the column number check step, and it apparently has only 1 column because it returns an error for ORDER BY 2 so that means it has only one column, right?
But when I do UNION SELECT ALL 1 -- all I get is that error... and this always happens on every website. What is the step after that...? Thanks!
* - iceblitz - Nov 20, 2009
When i union select this message comes up The used SELECT statements have a different number of columns
* - VeXer - Nov 21, 2009
Thanks For Your Help !
Is There a Difference Between MYSQL And SQL ?
* - SaviorForFreedom - Nov 22, 2009
THANK YOU FUCKING MUCCCH!!!
* - YeAt - Nov 29, 2009
Amazing FUCKING tutorial.
Great job broskee.
* - WhyIOwne - Nov 29, 2009
I always have problems with the union select thing, i never get a number back?! plz help...
* - Shahz - Nov 30, 2009
Thanks gonna try this one and the other one...
Tried before didn't worked for me, lets see if re-reading helps.
* - Diante - Dec 7, 2009
(Nov 29, 2009 02:03 PM)WhyIOwne Wrote: I always have problems with the union select thing, i never get a number back?! plz help...
Yup, i'm having the same issue.
Apparently, iFail.
😏 😏
Some help would be appreciated.
* - Sine - Dec 8, 2009
thx nice tut bro
to short
* - wataah - Dec 9, 2009
its funny/sad how he doesnt have any rep for making this tut
* - LOl1ds - Dec 10, 2009
sometimes dork can't use...???why...
but thx 4 this tutorial.
* - aju16 - Dec 19, 2009
Thanks for TUT🤝