[Scrat]

SQL Injection Tutorial [Uploading Shell]


This is my next tutorial on SQL Injection and it is about uploading a shell after you have successfully Injected the site and extracted the data and you have the admin page login.
If you don't know how to do these things you can read my tutorial about Basic SQL Injection.

By reading this tutorial you agree that:

The author is not responsible in anyway for you actions done by the use of this tutorial.
The tutorial is for educational purposes only and for no site harm.
If posting this tutorial somewhere else give credits to the author Ma3x-.

For this tutorial you will need.

• Shell
  
• Injected Website
  
• Admin Panel
  
• Defaced Page
  

Step №1
Finding an upload in the admin panel

So the first thing you will need is to find a place in the admin panel, where you can upload pictures.
The place could be anything like "News, Essays, Pictures" or anything of this sort.
Once you have found a place like that you need to upload your shell in there.
If it doesn't work by uploading it as "shell.php" then add "shell.php.jpg" at the end of it.

==

Step №2
Finding your shell

Now that is quite an easy thing to do, all you actually have to do is go to the place where you uploaded your shell.
Like if you uploaded it in the news section of the website it will be there with a failed photo picture maybe.
You will have to right click on it and click "Copy Address" or something like that.
Then you put it in the URL textbox of your browser and hit "Enter".

==

Step №3
Finding a the index

Now since we are in our shell we have to go to "File Manager" and see in which location we are.
So we will need to find the location called "publichtml" that is where the site index page is uploaded on most of the sites.
If it's not there you will have to go through the other folders until you find index.php.

==

Step №4
Defacing

Now when you have found index.php, you will have to delete it.
After that you will have to upload your own index.php.
That has to be your defacement page and that is all.

==

Step №5
Defacement Page

Alright, alright I will explain to you how to make a simple defacement page.
You can either code your own page if you know php or you can edit an already made page.
The second option is if you have no idea what php is.
Well since I won't be teaching you PHP I will just hand you over a ready defaced page and just explain some bits of the code.
I will give you a kobez's deface page which he gave away to everybody so they can learn.
This is how it looks like.
Spoiler (Click to View)[img]http://img696.imageshack.us/img696/2540/capturenfh.jpg[/img]

Here is the code.

Code

<html>
<head>
<title>TEAM INTRA!</title>
<style type="text/css">
body {
    background-image: url(http://i1004.photobucket.com/albums/af163/imnu11/openbg.gif);
    padding: 0;
    font-color: white;
  }
pre {
    font-color: #FFF;
    display: block;
  }
right {
    top: 50% !important;
    left: 50% !important;
  }
</style>

</head>

<body>
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<div id="right" align="center">
<pre><font color="white">
888    888  d8888  .d8888b.  888    d8P  88 88b.  
888    888  d88 d88P  Y88b 888   d8P   888  888  "Y88b
888    888  d88P888 888    888 888  d8P    888  888    888
88  d88P 888 888  888d88K  88    888    888
888    888    d88P  888 888  88b    888  888    888
888    888   d88P   888 888    888 888  Y88b   888  888    888
888    888  d88 Y88b  d88P 888   Y88b  888  888  .d88P
  888    888 d88P  888  "Y8888P"  888    Y88b 88 88P"   <b>BY TEAM INTRA!</b>
</font></pre>
<pre>
<font size="3" color="white">
*Take this as a warning, please improve your security, otherwise your website <b>will</b> be malisciously cyber-raped!

</font>
</pre>
</div>
</body>

</html>

At

Code

body {
    background-image: url(http://i1004.photobucket.com/albums/af163/imnu11/openbg.gif);

Change the link with your own and that will change the background of the page.

At

Code

<pre>
<font size="3" color="white">
*Take this as a warning, please improve your security, otherwise your website <b>will</b> be malisciously cyber-raped!

Change the text in this to whatever you want. And to add some music to it add this code on top of the code but below </html>.

Code

<embed src="http://www.youtube.com/v/IUGzY-ihqWc&autoplay=1" type="application/x-shockwave-flash" wmode="transparent"

The only catch here is that you have to edit your youtube video link a little bit.
Normal link:
http://www.youtube.com/watch?v=wLBpLz5ELPI

Edited link:
http://www.youtube.com/v/wLBpLz5ELPI

Simply remove the "watch?v=" and put "/v/" on its place. Oh and put &autoplay=1 to it its end.
Just refer to the code above you should do alright if you have a little common sense.

I hope you guys liked the tutorial and it helped you in one way or another.
Please say a little thanks for it..
Other tutorials by Ma3x-.
[Video] SQL Injection [Injecting Website, Basic Injection]
SQL Injection [Injecting Website, Basic Injection]
SQL Injection [String Based Injection]
SQL Injection [Vulnerable Sites List]
Free VPN Tutorial

[MaXoNe]

No, stick it up your ass! hahahahhahahha nice one , good job writing it , btw bear grylls , fuck yeah...

[Scrat]

Come on only one reply I really did my best to write this tutorial...

[syng]

Nice tutorial mate,this should help alot of people.
I myself got some problems uploading a shell tho.
I uploaded my c99 shell as .php and the site took it,I went to the homepage and saw my "failed image".
I did the copy URL like u said and pasted it in another tab but nothing happens,the site stays the same.

[napster.sy]

thank u very much man
i hope see for u a new posts
:(

[Ubaste]

I tried to upload my shell via " Add picture " function at the admin panel, its say it succed added the picture. But I could not fint id, and pictures should be located at /documents/Blabla.jpg .. So I tryed to do " Http://site.com//documents/Blabla.php " But just said the located file did not exist. Thanks anyway. The shell uploading is pretty simple. But I bookmarked your thread for the deface part. Gotta look at that later. Thanks

[No‌‌‌‌‌‌]

Looks nice enough and well written, but I think it could certainly do with a bit more information on bypassing FUR such as nullbytes.

[Prominent]

Well to make it more friendly to new comers, explain what is a shell and why it is used for. Other than that, the tutorial is simple and nice.

[Scrat]

Come on guys only two posts?
I did so much hard work on that...

[Diabolis]

lol, for what its worth, i read it, and i only had very little knowledge of shells and what exactly to do after i crack the admins password. (even though ive got about 10 sites admin info...just sitting there....)
Just to clarify, you get to your admin panel (i know how to do that), you upload your shell via the hidden uploader into any part of the website, but something thats easy to find. Go there on the website, and find your "failed photo" (...lol) and copy the address, paste that into the url. Now your in your shell, go to file manager, find index.php (will probably be in publichtml), delete the index.php and upload your own file.

Ive got it all up to this point, but heres a question.
What you have shown in the code page isnt php, its html....Do you just create any old html page, save it as .php, and upload it?
I'd imagine thats all you do....since deface pages dont really do anything but ridicule the original website owner....and im already fluent in html, that would make things a lot easier 🤭

[jazdevi]

Yea, I needed this too, I wasn't sure how the shell thing worked.
And nobody uses PHP in their deface page (not from what I've seen anyway), so I don't know why you wrote that. All you really need is basic HTML knowledge.

Thanks though :D

[StealinCpt]

This was a good tutorial, but I dont recomment defacing it if you want your shell to stay alive

[Viking]

This is a great tutorial! I hope this helps a lot of people out.

[B4CK-7R4CK3R]

thank u man good tutorial simple and nice

[Drivers]

Nice tutorial! ✌
Thanks for sharing!🤝