+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Detailed Basic and Full SQL Injection Tutorial (/showthread.php?tid=50356)
* - ttt - Apr 5, 2011
manually how can i use it ?? it has need google dork..pls help me.. :(
* - wh1tesn0w - Apr 6, 2011
Nice job mate! Really helpful, helped me hack my very first website. Now I have left my signature "Yours Sincerely, wh1tesn0w" on some sites =).
* - Kotsouba - Apr 6, 2011
So i logged in a random site admin panel (i can see the admin panel atm ) but if i try to do anything(like checking the list of the admins or the member list) i am getting this:
--
ADODB.Field error '800a0bcd'
Either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current record.
/admin/07_Extranet_02_MemberList.asp, line 301
--
p.s soz for not using quotes i am posted this using quick reply
* - xfredishx - Apr 6, 2011
This was unbeleivably easy, i didnt even need to goto part 2 . pretty much all the stars were aligned and i gave it a whirl.
Heres the story:
Years ago my ex gf's mom hired me to build her restaurant a website.
I built it, spent hours of my time. Paid for hosting and domain name registration and all that, for like 3 months. Finally when she wasnt satisfied with my monthly fee of 10 dollars a month for maintaining it (me being nice). She just stopped paying me. without even paying me a penny for everything ive already done. We made a deal she would pay me 500 atleast for all my troubles and she never paid a dime.
Going to her website i noticed at the bottom it said copyrights "SBS inc" blah blah "log in or register"
I clicked login and poof, like that ima at www.xx.xx/login.aspx .. automatically i know its the webmasters admin panel, why its at the bottom of the restaurant page i dont know, probably becuz he used some dumb website editor for newbs like bright builder or something.
either way, i just typed user: Admin password: ' or '1'='1
And poof i was in..
Nice tutorial thanks! lol i got some pay back
PS: wondering why i dont show u the page i defaced. well, because im not too excited, i almost feel like it was too easy, being excited about such an easy vulnerability is just not even cool. lol.
on a side not anyone looking for an apprentice for sqli hit me up, im interested in learning its true potential.
GOOD WORK DANIEL!. THANKS!
* - 4me2 - Apr 7, 2011
very good tutorial bro , thanks
* - dingospo.TITO - Apr 7, 2011
I have a problem :$ got this
Error occurred
We are sorry, but an unexpected error occurred. Please contact the webmaster at this site [email protected] and report the problem, along with the error message printed below. Please include any other information which may be useful to the webmaster.
Invalid MySql query
The used SELECT statements have a different number of columns
I found 17 tables, but second step is problem :|
* - Scavok - Apr 8, 2011
Great TuT very very good :)
* - panama1 - Apr 8, 2011
what exactly happens when you inject a site you become the admin and you can change it or what? PM me
* - rplrays - Apr 9, 2011
thanks brooo:)
nice tutorial
* - humanistiske - Apr 12, 2011
@Mr.Boxxy Simply use firefox latest version and check "prevent this from dialogues" (or something like that) and press ok. It works then but then its just html page with multiple email ids and phone number so it didnt helped me
* - ACD - Apr 13, 2011
I can just log in with Admin and 'or'1'='1 as pass, but I wan't to edit the site's layout, how do I do that?
* - TINIHACKER - Apr 14, 2011
wtf i just done one of the sql injection on some fucking catholic school website lol and it worked
* - ACD - Apr 14, 2011
(Apr 14, 2011 09:44 AM)TINIHACKER Wrote: wtf i just done one of the sql injection on some fucking catholic school website lol and it worked
Lol I've done that one too. Pretty funny. But there's not much you can do as 'Admin' on such .asp site's.
* - HappyMan - Apr 15, 2011
I havnt been into sql so much but I think that Im going to change that ;)
* - noobkibblet - Apr 16, 2011
when they said confusing the fuck out of the database
actually you arent confusing the database you are simply asking it to return you results from not known areas of the database from the script www.sample.com/vuln.asp?id=9
the script vuln.asp has a parameter called id that is vulnerable to sql injection because the info taken from the get parameter was never sanitized and allowed to run arbitrary sql queries and most of the time be directly able to run the query without terminating the where clause i see this more in mssql
www.sample.com/vuln.asp?id=9 order by 5-- sp_passwd for column counting
im doing this straight from my head so if any of it is syntacticly incorrect i apologize
always try to append sp_password in mssql i do this
1.)i first check for the injection using `-` minus the grave accents or just something rediculous like having 1=0--sp_password //note you should utilize post to be a lil safer at least i read that never bothered with it as i use socks 5 and tor
2.)after verifying the existince of this hole and fully terminating the original query and executing my own thus now you have full sql injection
3.)now i take the steps necessary to arm myself with all my knowledge of the hole and how to use it this is key beacuse if not your throwing useless queries that are logged so make sure yyou verify the hole exists
4.)now you use any method you like group by ,having,... to enumerate the columns but my favorite is this
find the amount of columns, count them,than after that you move to actually using error messages
sample.com/vuln.asp?id=9 group by id--sp_password
it will give you the next column name in the query
sample.com/vuln.asp?id=9 group by id,column2,column3,column4,column5--sp_password
this should be correct remember im responding to a post not writing a tutorial and this is 100% out of my head
after this is done you should get a 200 ok after you enumerate them correctly
this is where i have fun beacuse now you know the column amounts names and its easy to guess data type by names but not always you could use null i do this
sample.com/vuln.asp?id=9 union select mssql commands,null,null,null,null--sp_password
anyone that knows this will understand i dont remember these off hand so imm not gonna google just remember i use especially the convert(int(@@version,0,0)) or however it is thrown together i use alot of tricks like this to get odbc error messages they will tell you alot check them out
allot of errors im sorry my mind works to quick to pay attention to spelling i just want to get my point across