+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: My SQL injection complete tutorial :) (/Thread-My-SQL-injection-complete-tutorial)
RE: My SQL injection complete tutorial :) - necrojones - 08-15-2013
Nice tutorial. Going in the repertoire....
RE: My SQL injection complete tutorial :) - tolog411 - 09-09-2013
Please i need invitation for code for the site http://zyan.me/UVkJP
RE: My SQL injection complete tutorial :) - Facebook_mybb_import13531 - 09-15-2013
Thanks for the guide, I've read many others but this one was extremely well made!
RE: My SQL injection complete tutorial :) - Hardstylerz - 09-18-2013
Hello V1P3R,
I have a question about your tutorial.
I found a leak in my website cause i didn't completely checked the security.
(Trough the HackCommunity Vulnerability Scanner "might be vulnerable to SQL Injection")
When i insert ' on the ID of the request, i got:
?page=enter&id=17'
(PHP script SQL Request)
Quote:SELECT * FROM $Database WHERE ID='$id'"
Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /xxx/yyy/zzz/website.com/httpdocs/file.php on line 100
It's not fully protected, but if i try your tutorial, no way to get something from the Database.
It is replacing the spaces by %20 in the URL, and nothing appear from the DB.
And i didn't use htmlentities.
Is there another way to get the admin access ?
I think there is another way, 'cause it is not fully protected. But i'm not sure. If yes, an update would be great
Regards !
RE: My SQL injection complete tutorial :) - JoeKidd - 09-22-2013
nice explanation, it one of the coolest thread. Thanks
RE: My SQL injection complete tutorial :) - lph4 - 09-23-2013
Hi!
Thanks for the tutorial, very clear and helpful. You have done a great job.
Regards!
eleph
RE: My SQL injection complete tutorial :) - 4lph4 c0d3r - 09-23-2013
no doubt tut is nice v can see your effort straight away.
but instead of wasting our time by doing this manually v can use havij though sckiddies do that but still it save time!
RE: My SQL injection complete tutorial :) - pL0w2x - 10-22-2013
Pls give some tutorial for SQLi;
Like
Inband:
Out-of-Band:
Inferential:
And types of SQLi
Error-Based
Union-Based
Blind-SQLi
RE: My SQL injection complete tutorial :) - Codestation - 11-03-2013
i cant fin the admin link for this forum can you help me http://pspiso.com/forum.php
RE: My SQL injection complete tutorial :) - RogueCoder - 11-03-2013
(09-23-2013, 06:00 PM)4lph4 c0d3r Wrote: no doubt tut is nice v can see your effort straight away.
but instead of wasting our time by doing this manually v can use havij though sckiddies do that but still it save time!
Wasting your time? Are you fucking kidding!? If your time is so valuable why are you here wasting it? If you rely on tools only it makes you a skid. Nothing more and nothing less. Everyone who has knowledge on manual attacks will combine these and always study new techniques and methods to become even better at manual injections! I have lost track on how many times I've manually beaten the crap out of sqlmap, Havij in finding vulns. Tools are written by humans, meaning a tools cannot beat a human. The only reason your tool beats you is because it's written by people who are far more skilled than you are.
So the fact that you see this as a waste of time gives that impressions that you're nothing more than a skid who feels that a tutorial on manual injection is a waste of time because you need a tutorial on how to get Havij to work.