+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [TUT] How to use Havij for SQL injection (/showthread.php?tid=826017)
[TUT] How to use Havij for SQL injection - Shannon R. - Nov 16, 2010
Introduction
Hello, I am going to show you how you can use Havij, to do a SQL injection attack.
Firstly you will require 2 things:
- Havij - Download Here
- A vulnerable site - Vuln site here
Steps
1. Firstly what you need to do is get your vulnerable site ready with the ID on the end, in this case "nwid=1658". You then need to enter the whole link into the Havij "target" bar.
Spoiler (Click to View)
2. Once you've entered the link into the "target" box you need to press the analyze button. Let it go through until it has completed finding everything it needs to about the database.
3. Once it's done the Get DB button should appear clickable, click that. Inside there you will see the databases you need to find the one which contains user information in this case it's "rajsoft_mprealtynews", check the box next to it and press "get tables". After that another drop down will appear with a list of things. You need to find something that is associated with usernames and passwords, in this case "users". After you check users you need to press "get columns", that will then return the columns inside that table.
4. will create another drop down, and from there you need to find username and password, these are easily located. Tick both "username" and "password" then press "Get Data". Once you've pressed it, it will display every username and password on that DB selected, usually find the one with the username, "admin".
Extra steps
Once you have finished collecting all the data you can export it into a .html file, which will organise it and format it nicely into a table, for easy reading.
.Shannon
* - i love bald girls - Nov 16, 2010
Nice fucking tut man, I feel so cool even though I didn't do shit haha. I'm logged in as admin now, how would I upload my own like HTML code and shit to the index though and such?
* - Shannon R. - Nov 16, 2010
You could possibly do a re-direct, I'm pretty sure that site cannot be edited. Well it has been, but I'm not sure. Thanks for the rep also.
* - i love bald girls - Nov 16, 2010
(Nov 16, 2010 11:09 PM).Shannon Wrote: You could possibly do a re-direct, I'm pretty sure that site cannot be edited. Well it has been, but I'm not sure. Thanks for the rep also.np you deserved it for the tut. Mind PM'ing me your MSN? I'm interested on how to do a redirect
* - Shannon R. - Nov 16, 2010
Yeah I'll PM you now, shame nobody else obviously needs this.
* - [email protected] - Nov 16, 2010
I tried to download Havij 1.3 But When I tried to Export it to Desktop It got me 2 Errors and I could Not : /
Btw Nice Tut .
* - Shannon R. - Nov 16, 2010
What problem are you having? You should download from the link I provided and extract it with WinRar, that way, you should get no errors.
* - bimalpun4 - Nov 16, 2010
Nice tut hahaha thats indian website i like it
* - Shannon R. - Nov 16, 2010
I didn't deface it. I am just saying, it's vulnerable.
* - scampers - Nov 16, 2010
Great TUT man ive been using Havij for a while but ididnt kjnow the .html export thing
* - Shannon R. - Nov 16, 2010
Thanks. Yeah, it is useful for being able to copy MD5 encrypted passwords. It can't be done within Havij.
* - scampers - Nov 17, 2010
ok i have the admin panel ill keep you posted on mai hackzking
* - ado11 - Nov 17, 2010
very nice tutorial man but i still prefer good old manual way and i think(i dont think on you) most of havij users are n00bs
Again thanks for tutorial could be useful for newcomers on HF
* - kai132 - Nov 17, 2010
Powerful tool man ,thank you !
* - Shannon R. - Nov 17, 2010
This tutorial is designed for newcomers, that just want to "hack" sites.