[Scrat]

SQL Injection Tutorial [Uploading Shell]


This is my next tutorial on SQL Injection and it is about uploading a shell after you have successfully Injected the site and extracted the data and you have the admin page login.
If you don't know how to do these things you can read my tutorial about Basic SQL Injection.

By reading this tutorial you agree that:

The author is not responsible in anyway for you actions done by the use of this tutorial.
The tutorial is for educational purposes only and for no site harm.
If posting this tutorial somewhere else give credits to the author Ma3x-.

For this tutorial you will need.

• Shell
  
• Injected Website
  
• Admin Panel
  
• Defaced Page
  

Step №1
Finding an upload in the admin panel

So the first thing you will need is to find a place in the admin panel, where you can upload pictures.
The place could be anything like "News, Essays, Pictures" or anything of this sort.
Once you have found a place like that you need to upload your shell in there.
If it doesn't work by uploading it as "shell.php" then add "shell.php.jpg" at the end of it.

==

Step №2
Finding your shell

Now that is quite an easy thing to do, all you actually have to do is go to the place where you uploaded your shell.
Like if you uploaded it in the news section of the website it will be there with a failed photo picture maybe.
You will have to right click on it and click "Copy Address" or something like that.
Then you put it in the URL textbox of your browser and hit "Enter".

==

Step №3
Finding a the index

Now since we are in our shell we have to go to "File Manager" and see in which location we are.
So we will need to find the location called "publichtml" that is where the site index page is uploaded on most of the sites.
If it's not there you will have to go through the other folders until you find index.php.

==

Step №4
Defacing

Now when you have found index.php, you will have to delete it.
After that you will have to upload your own index.php.
That has to be your defacement page and that is all.

==

Step №5
Defacement Page

Alright, alright I will explain to you how to make a simple defacement page.
You can either code your own page if you know php or you can edit an already made page.
The second option is if you have no idea what php is.
Well since I won't be teaching you PHP I will just hand you over a ready defaced page and just explain some bits of the code.
I will give you a kobez's deface page which he gave away to everybody so they can learn.
This is how it looks like.
Spoiler (Click to View)[img]http://img696.imageshack.us/img696/2540/capturenfh.jpg[/img]

Here is the code.

Code

<html>
<head>
<title>TEAM INTRA!</title>
<style type="text/css">
body {
    background-image: url(http://i1004.photobucket.com/albums/af163/imnu11/openbg.gif);
    padding: 0;
    font-color: white;
  }
pre {
    font-color: #FFF;
    display: block;
  }
right {
    top: 50% !important;
    left: 50% !important;
  }
</style>

</head>

<body>
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<div id="right" align="center">
<pre><font color="white">
888    888  d8888  .d8888b.  888    d8P  88 88b.  
888    888  d88 d88P  Y88b 888   d8P   888  888  "Y88b
888    888  d88P888 888    888 888  d8P    888  888    888
88  d88P 888 888  888d88K  88    888    888
888    888    d88P  888 888  88b    888  888    888
888    888   d88P   888 888    888 888  Y88b   888  888    888
888    888  d88 Y88b  d88P 888   Y88b  888  888  .d88P
  888    888 d88P  888  "Y8888P"  888    Y88b 88 88P"   <b>BY TEAM INTRA!</b>
</font></pre>
<pre>
<font size="3" color="white">
*Take this as a warning, please improve your security, otherwise your website <b>will</b> be malisciously cyber-raped!

</font>
</pre>
</div>
</body>

</html>

At

Code

body {
    background-image: url(http://i1004.photobucket.com/albums/af163/imnu11/openbg.gif);

Change the link with your own and that will change the background of the page.

At

Code

<pre>
<font size="3" color="white">
*Take this as a warning, please improve your security, otherwise your website <b>will</b> be malisciously cyber-raped!

Change the text in this to whatever you want. And to add some music to it add this code on top of the code but below </html>.

Code

<embed src="http://www.youtube.com/v/IUGzY-ihqWc&autoplay=1" type="application/x-shockwave-flash" wmode="transparent"

The only catch here is that you have to edit your youtube video link a little bit.
Normal link:
http://www.youtube.com/watch?v=wLBpLz5ELPI

Edited link:
http://www.youtube.com/v/wLBpLz5ELPI

Simply remove the "watch?v=" and put "/v/" on its place. Oh and put &autoplay=1 to it its end.
Just refer to the code above you should do alright if you have a little common sense.

I hope you guys liked the tutorial and it helped you in one way or another.
Please say a little thanks for it..

[fir3wall]

clean and short tutorial ... but I give 5 star :D
thanks Mate

[amex]

This shell... is for what purpose? :D

Sorry If made noob question :D

[๖ۣۜ¢уρяισт-мєякѕ]

Nice tutorial & yeah, it's clean and short and it looks really easy to do for new people who don't know how to do this.

[Chillae]

Great, to the point tutorial. :) Loved that binary.gif background!

I have a semi off topic question though about the deface page: What is the text effect called where the text appears to be typed as you view it?

Thanks for the tutorial!

[๖ۣۜ¢уρяισт-мєякѕ]

Yes, that' background is linked to my defaced page as well. Check it out on my threads.

---

The link is under merked.net/bg.gif I think.

[Gruv3r14]

How do I find the file manager page?

[Saturnus]

Great & good Tutorial :) Think you.