+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] How to find SQL vulns like a pro - Updated [TUT] (/showthread.php?tid=2313233)
Pages: Pages
1
2
[TUT] How to find SQL vulns like a pro - Updated [TUT] - Error667 - Mar 17, 2012
I do not pretend to do a complete tutorial, it's only to help the beginners who get into trouble with this.
I - Intro :
What you need to know is that 95% of the websites are vulnerable. That's why you need to improve your searching methods, to get better that the rest of the hackers. A scanner may help you, but it will
never remplace your brain and often, you're much better than it to find vulnerabilites fastly.
We gonna now speak about useful things to
A - The common google dorks
Search on the sub-domains : site:1.com
Search ONLY on the principal domain : site:www.1.com
Search in the URL : inurl: / allinurl:
Search for a specific file extension : filetype:
Search in the text : intext: / allintext:
Search in the title : intitle:
Search for a domain extension : site:* (fr/gov/mil/edu/org/..)
B - Web file extensions
Common web files extensions where fails are localized : PHP ; CFM ; HTM/HTML ; ASP ; ASPX .
All the other webfiles extensions where a fail may comes up (if you are lucky) : ASMX ; SWF ; DO ; PDF ; SEAM...
Note : Sometimes, you will have an URL like this : http://website.gov/?id=1
It may be vulnerable too but that's extremly rare.
C - Variables
Variables are necessary for SQL injections. Common ones are : id= ; pid= ; file= ; lang= ; pageid= ; path= ; rub= ; option= ; task=
D - What Search engine/Broswer should i use ?
Google, of course. Also, you must know that firefox is, for me, the more convenient to search SQL fails : fast and effective.
II - Become a pro :
First, it might sound stupid but you need to write very fastly. The hacker who don't will spent many time and then, abandons. In fact, a good thing to do is to open something like 5 tabs and use all what
you know about dorks and file extensions. I suggest you, when you are looking for SQL vulns, to search ONLY on ONE website : when you have a fail, that's good, but if you have a fail on your selected
website, that's better.
Here's is an example ;
Tab 1 - site:1.com inurl:cfm?id=
Tab 2 - site:www.1.com inurl:cfm?
Tab 3 - site:1.com inurl:php? inurl:id
Tab 4 - site:www.1.com inurl:asp
Tab 5 - site:1.com inrul:aspx?id
Note : instead of site:1.com , you can do site:*.1.com
Note 2 : You can do this with only 1 tab too, but you need to be really fast - e.g. If you don't have any results, go back immedialty to the previous page and change the dorks.
90% of the time while using this method, i find an SQL vulnerability on the website of my choice in few minutes.
III - A smart trick to use :
When you don't know which type of web file the vuln will infect, you can search by using only the variable.
Example :
inurl:id=1
inurl:lang=1
If you're good, you will get loads of good results with this dork.
IV - A special one
Okay, first it's not a common method, it don't works many times ; Sometimes, try to create a variable.
Example : http://site.gov/staff/graph.php
What yo do : http://site.gov/staff/graph.php?id=1
Why does it may work ? Because ID is a really used variable. So, when you have created it, you can try to inject.
I hope it has been useful for some of you.
Regards,
* - ROI - Mar 17, 2012
Where you put one and *, is that meant to be a website of your choice or you literally put those characters?
* - Error667 - Mar 17, 2012
* meant that i can be everything. It can be used in the variables as well as in the url of the website.
* - Crypto™ - Mar 17, 2012
Great tutorial! I just linked to you in my tut: https://hackforums.net/showthread.php?tid=2313304
* - omaronaldo - Mar 17, 2012
very good ....man
thank you very much
* - For - Mar 17, 2012
Good tutorial.
Quite informative.
* - The.Prince - Mar 18, 2012
thanks for the share , it looks nice .
* - Alphaseek - Mar 18, 2012
Nice tut , thanks for sharing it. Will read it in spare time.
* - Error667 - Mar 24, 2012
Thanks guys, Tutorial has been updated.
* - akhilkaushal99 - Mar 24, 2012
hii every body my site www.allhackingtools.tk have over 30 tools and tricks of hacking facebook real hacking tricks not tools for freeand blacktrack full tutorial send fake e-mail advanced operating system virus writting windows hacking admin hacking and lots more check it out Most important sql tutorial and download link
* - PatricksGamerTag - Mar 24, 2012
Felling like a pro. Thank you awesum.
* - sulfonate - Mar 24, 2012
i like to try out random scripts on this server that i bought recently so this definitely comes in handy. thanks
* - N7 Schago - Mar 24, 2012
Thanks for sharing. It helps a lot.
* - badboy3 - Mar 24, 2012
I tryed this and it did notwork....but it seams great TUT
* - Infinity. - Mar 24, 2012
This guy is pro in website hacking..Hats off mate..!