+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Website hack method. looks interesting! will it work? (/showthread.php?tid=5091110)
Website hack method. looks interesting! will it work? - brndonw - Dec 12, 2015
If you are trying to disclose database information without having access to the database itself, then you will need to use SQL Injection (unless miraculously, you hit a domain that does not operate with SQL), if the web application flaw exists. Otherwise, you can try to ask the admins nicely for db access so you can run SQL queries #sarcasm. Here is a tip for you: not all databases are hosted on the same site where the Apache server lies. MySQL is very resource consuming and good admins will have 2 servers. One for Apache, serving the website, and the second for the MySQL database. Good luck having remote access to a database, thats almost never the case.
using Languard to separate the databases and linux SQLI to get them.
will it work?
* - Mr.0_0 - Dec 12, 2015
Hey there!
Please note that PHP is used to interact with the database and pull records from the SQL db. Blackbox testing, you will never know the underlying layout. If the SQL db is hosting on another server, it may be difficult for you to get an SQL prompt to the database since remote access is seldom given. This is much easier if the db is local. You can check the source of the PHP script for database connection information, which you can attempt against the database for remote auth.
I am sorry, but i am not fully understanding your question 😧