Mar 17, 2012 03:49 PM
(This post was last modified: Mar 17, 2012 04:01 PM by Crypto™.)
This is my short SQLi tutorial.
Please comment if you found it helpful!!!
Errata
Links
Notes:
Please comment if you found it helpful!!!
- Download Havij. (There's both a free and paid version, but unless you're bound and determined to hack every site you find, go with the free version. It'll get the job done)
- Find an injectible site. (Here's my method. Go to Google and type in inurl:".php?id=". This is what's known as a "dork". You can find/craft your own. :) )
- Test its injectability. (A lot of sites aren't injectible. Here's a quick trick for a preliminary check. Throw in a single quote. ' If it returns an error, it might be injectible.)
- Throw the link into Havij. There's a box at the top (v1.15) for the URL.
- Click analyze. (Simple enough)
- Wait to see what it throws back. If it says the site isn't injectible, move on. Or if you know how, go for tactics like Blind SQL injection. (Not my style, too much hassle)
- If it returns a DB name, click on the tab called "Tables".
- Next, you can either look for more DBs (Click on Get DBs), or you can go straight to the tables of the current DB (Click on Get Tables).
- Once you get down to tables for a specific DB, choose one and click on Get Columns.
- Once you get down to columns, select the ones you want, and click Get Data.
- You now have successfully SQLi'd a site (the n00b way, but it works)
Errata
- If you're retrieving passwords, they may be MD5'd. Luckily, Havij comes with a tool to try and crack them (It's a one way encryption standard with no known exploitable weaknesses). Copy down (Ctrl + C) the md5 of the password, then open the tab labeled "MD5". Paste it into the box and hit start. If it returns nothing, you have three options. One, give up. Two, Google it (recommended course of action). Three, spend hours/days/months/years obsessing over it attempting to find a way to crack it, including generating your own rainbow tables.
- The URL you are attacking must already have a variable specified in it. E.g. http://www.site.com/something.php?id=1 This red part is the variable specification.
- Not all variables make SQL requests, therefore, not all variables will work.
Links
- Havij
- Lots of dorks for you here, here, here, here, and here.
- A great tut on how to find your own dorks and vulnerabilities: here.
Notes:
- For the sake of legality, I'll say I don't support any hacking except for educational purposes on systems you own. Yada yada yada FBI yada blah yada hacking yada yada yada big white van.
- I'll add pictures to this eventually.
Get a signed message before dealing: Keybase
Still here sometimes.
