Note, I was drunk when I wrote this. (So was Oni)

I will be teaching you how to use SQL Injections to infiltrate a website.
Before we begin, you should do some reading about SQL

and SQL Injections.

Quote:A SQL injection attack consists of insertion or

"injection" of a SQL query via the input data from the

client to the application. A successful SQL injection

exploit can read sensitive data from the database,

modify database data (Insert/Update/Delete), execute

administration operations on the database (such as

shutdown the DBMS), recover the content of a given file

present on the DBMS file system and in some cases issue

commands to the operating system. SQL injection attacks

are a type of injection attack, in which SQL commands

are injected into data-plane input in order to effect

the execution of predefined SQL commands.

Source.

Okay, so first we must already have a
target. We can use google dorks to find one

Once you have found a webpage that may be vulnerable you will need to test it.

You can do so by adding a
after the last number in the URL like so.


If you get a error similar to this, that means the site is vulnerable, and we can exploit it.

Quote:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

Now we need to find out the amount of columns the website has.
To do this we will use the ORDER BY statement.


That means there are four columns.

Union allows you to select more data in one SQL statement. (If I'm wrong shoot me.)

So now we will do this.


If there are numbers on the screen that means the Union works.

if /* doesn't work, try
.

So pretend the number three is on screen.
Now we will replace the number three with @@version


You should now have a version number, something similar too.

Quote:4.13.37

Getting table and column names

We will need to guess the table names now.
Some common table names are: admins,users,members,emails,user.
Common column names: users,user,password,pass, etc.

If you see the number three again, that means the table exists.

Now we need to get the column name, to do so we do this.

If usernames are displayed then it works, if a error occurs try another column.
If the names displayed you would then look for emails, passwords, etc.

Now we want to get the usernames and passwords at the same time, to do this we use concat. (Basically it joins the strings)

0x3a is the value for


Now you should get the username and password in a nice format.
Example:


Now you can login to the admin panel, have fun, good luck, don't die.