Hey guys, I thought I would contribute a little to the community, so here is my guide on how to test for SQLi vulnerable sites and then doing the actual injecting. This method is extremely fast, and requires about 2-3 things of copy and pasting, so here we go.
Programs Needed:
SQLi Helper v2.7
SQLi Scanner
Admin Page Finder
Download HERE
Credits to [color]Zarabyte.com[/color], Internet Security Research Team.
All programs are clean.
STEP 1
First, open up your Vulnerability Scanner, and type in a dork such as "inurl:index.php?articleid=". There are THOUSANDS more, but this is the one I am using. Just do a search on here for "Google Dorks", and you'll find 'em ;). Type in your Dork into the area designated for it, and make sure the box for "SQLi Based Error" is the only one checked, then click "Scan Sites". Your screen should look more or less like the picture, depending on the Dork you use.
Spoiler (Click to View)
STEP 2
After you do that, a list of sites should appear on the left side of the screen. These are the sites that were found using the Google Dork. Now what you need to do is click the button NEXT to the "Scan Sites" button, marked "Test Sites". Once you click this, a smaller list of sites should appear on the right side. These are the Vulnerable sites picked out of the sites found by the Dork. Again, your picture should look more or less like mine.
Spoiler (Click to View)
STEP 3
Now, open up your SQLi Helper v2.7.
In the target area of the SQLi Helper, you will put the links you have found on the Vulnerable Sites part of the Scanner. Please note that you can only test one site at a time.
Alright, now the site I will be testing is one I found earlier, Taleempk.com.
Put the Vulnerable site link into the Target area, and click "Inject".
Yet again, your screen should look similar to mine.
Spoiler (Click to View)
STEP 4
Now on to the next step. If the SQL version is below 5.0, then it's better to go on to the next site.
Ok, now click "Get Database". A couple of things should show up, sometimes more. Just a little side note, don't use information_schema. It's useless. For this one, I'll click on "taleempk_data" and then click "Get Tables". Once you do that, the Tables should show up, and if you're lucky, the Admin or Users tables will show. Luckily this one did. Click on the word Admin and press "Get Columns" and the words Username and Password show up, yay! Now, click on "Username" then hold CTRL and click on "Password", then click "Dump Now". It might not always work if you try to do both of them at the same time, so if it doesn't, then just do one at a time. Now when you do this, the Username and Password will show up. (PLEASE NOTE THAT EVERYTHING YOU SEE WILL BE DIFFERENT FOR EACH SITE, JUST USE YOUR COMMON SENSE)
Spoiler (Click to View)
STEP 5
Now that you have the Admins Username and Password, you'll need to find out where to enter it in at.
Open up your Admin Page Finder, and type in the name of the website you are Injecting, and click Scan, and the admin page links should show up in the Directory part, just double click on them to be automatically linked to it.
Now just type in the Username and Password, and there you go! Instant Admin Access from only a few button clicks!
Here are some notes to clarify a few things.
This won't work on all sites.
If the version is 4.0 and not 5, move along to the next one.
Even if it's vulnerable, the Admin columns still might not show up.
Even if the Admin Columns do show up, the password might be crypted.
Identify the type of hash it is, then find the a decrypter that works on that type of hash.
Even if you find a decrypter it still might not be crackable.
The End.
I worked on this tutorial for about an hour, if you liked it, please leave feedback! Thanks for reading!
Nobody wants to write a review? Damn.
Programs Needed:
SQLi Helper v2.7
SQLi Scanner
Admin Page Finder
Download HERE
Credits to [color]Zarabyte.com[/color], Internet Security Research Team.
All programs are clean.
STEP 1
First, open up your Vulnerability Scanner, and type in a dork such as "inurl:index.php?articleid=". There are THOUSANDS more, but this is the one I am using. Just do a search on here for "Google Dorks", and you'll find 'em ;). Type in your Dork into the area designated for it, and make sure the box for "SQLi Based Error" is the only one checked, then click "Scan Sites". Your screen should look more or less like the picture, depending on the Dork you use.
Spoiler (Click to View)
STEP 2
After you do that, a list of sites should appear on the left side of the screen. These are the sites that were found using the Google Dork. Now what you need to do is click the button NEXT to the "Scan Sites" button, marked "Test Sites". Once you click this, a smaller list of sites should appear on the right side. These are the Vulnerable sites picked out of the sites found by the Dork. Again, your picture should look more or less like mine.
Spoiler (Click to View)
STEP 3
Now, open up your SQLi Helper v2.7.
In the target area of the SQLi Helper, you will put the links you have found on the Vulnerable Sites part of the Scanner. Please note that you can only test one site at a time.
Alright, now the site I will be testing is one I found earlier, Taleempk.com.
Put the Vulnerable site link into the Target area, and click "Inject".
Yet again, your screen should look similar to mine.
Spoiler (Click to View)
STEP 4
Now on to the next step. If the SQL version is below 5.0, then it's better to go on to the next site.
Ok, now click "Get Database". A couple of things should show up, sometimes more. Just a little side note, don't use information_schema. It's useless. For this one, I'll click on "taleempk_data" and then click "Get Tables". Once you do that, the Tables should show up, and if you're lucky, the Admin or Users tables will show. Luckily this one did. Click on the word Admin and press "Get Columns" and the words Username and Password show up, yay! Now, click on "Username" then hold CTRL and click on "Password", then click "Dump Now". It might not always work if you try to do both of them at the same time, so if it doesn't, then just do one at a time. Now when you do this, the Username and Password will show up. (PLEASE NOTE THAT EVERYTHING YOU SEE WILL BE DIFFERENT FOR EACH SITE, JUST USE YOUR COMMON SENSE)
Spoiler (Click to View)
STEP 5
Now that you have the Admins Username and Password, you'll need to find out where to enter it in at.
Open up your Admin Page Finder, and type in the name of the website you are Injecting, and click Scan, and the admin page links should show up in the Directory part, just double click on them to be automatically linked to it.
Now just type in the Username and Password, and there you go! Instant Admin Access from only a few button clicks!
Here are some notes to clarify a few things.
This won't work on all sites.
If the version is 4.0 and not 5, move along to the next one.
Even if it's vulnerable, the Admin columns still might not show up.
Even if the Admin Columns do show up, the password might be crypted.
Identify the type of hash it is, then find the a decrypter that works on that type of hash.
Even if you find a decrypter it still might not be crackable.
The End.
I worked on this tutorial for about an hour, if you liked it, please leave feedback! Thanks for reading!
Nobody wants to write a review? Damn.