[NobleSausage]

ok so if u do get lucky and dump a database, 9/10 websites encrypt the passwords which is a pain in the ass even if its the simple md5. then most of them dont work on the other websites with the same password, and then if they do work, u will need verification.. which is usually phone number and ur screwed. its just a waste of time?

[•^v^–[ bLacKn3x ]–^v^•]

This made my day :)) website hacking is not so simple like you think. :))

Its better to upload a webshell. Sell the userlists+ mails
There are many ways to make it senseful

[DataDumper]

Mix techniques, and sqli can be a powerful weapon ...

[Pillows]

Sometimes you can use the information for doxing purposes. You get a name, address, phone number. You're good to go.

[Frosteh]

Considering you can go from SQLi to rooting an entire box which may be used for shared hosting and have 100's of databases and websites, no it's not lame, it's exceedingly powerful. The data in most big databases is extremely valuable most of the time, credit card info and all sorts. A huge percentage of average user passwords can be cracked with a decent rig, some good password lists and/or rainbow tables.

[FearNot]

As Frosteh said, in a perfect storm you can get to shell and you're laughing. From here you're only limited by your imagination. Don't just think of sql injection as getting data. You could snoop on users of the website you hacked with injecting js or however you want.

[Çh┘?melÉon]

ok so if u do get lucky and dump a database, 9/10 websites encrypt the passwords which is a pain in the ass even if its the simple md5. then most of them dont work on the other websites with the same password, and then if they do work, u will need verification.. which is usually phone number and ur screwed. its just a waste of time?

You are a waste of time. All of this and your thread just shows that you've failed. That you've failed injecting you queries and you instead choose to come to HF and find somebody to whine with. Seriously, if you really want to accomplish SQLi you will. It's not a waste of time. It brings a hell lot of income if you ask me >:)

[NobleSausage]

You are a waste of time. All of this and your thread just shows that you've failed. That you've failed injecting you queries and you instead choose to come to HF and find somebody to whine with. Seriously, if you really want to accomplish SQLi you will. It's not a waste of time. It brings a hell lot of income if you ask me >:)

i didnt fail nothing. im just annoyed that most of the websites that are vulnerable are looked at by other people and data is not useful .. im not here to "dox" people. also to the people saying u can upload a shell, its very rare that a website uses mysql 4 and gives u permission to file_priv .
sometimes i get admin password and the password doesnt even work in the admin panel, mysqli is not lame but its not that great either

[•^v^–[ bLacKn3x ]–^v^•]

Yes . thats correct, if you use rnd dorks "index.php?id=" , but you can also find POST injections for example. Thats filters the all havijskids etc.

Or you build your own private dorks .
There are many ways to find usefull vuln sites.

And directly shell upload sqli are rare ,thats correct.

For the hashes:
If you haven't a good pc to crack hashes pay some money to crackers. They do it. Hashkillers are cool

[Forum Developer]

OP doesn't know the world of shells.