+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: I got manual sqli problem...help please. (/Thread-I-got-manual-sqli-problem-help-please)
I got manual sqli problem...help please. - poWerZone - 03-22-2012
I called it manual cuz i type them commands by myself in the address bar (and most of these people use programs like havij)..well,i prefer typing it by myself...
Well i got two "problems"...
1. Sometimes, when i find a site that is vulnerable to sqli and i start with commands,and the biggest problem i have is finding the column number. (its like i type "....order by 9999999--" and freaking site is still loading normaly..)so what am i supposted to do?
2. And the other problem is finding admin.login.... i tried with havij and mostly failed..(but tho sometimes i do find admin panel and break into site and get access of everything,but like i said there are many sites i couldnt find admin panel). I know, i should try to login as an user with admin name and pass, but funny thing is some of these sites dont have .login place,u can just explore site,no members at all..
Any ideas about these two issues?
Thanks...
RE: I got manual sqli problem...help please. - -SubZer0- - 03-22-2012
okay..first of all instead of type in the adress bar use this ad on.
https://addons.mozilla.org/en-US/firefox/addon/hackbar/
1 - if you don't get any error even on order by 100--
you have to use string based sql injection method
you have to add apostrophe (') near php?id='1 / php?id=1' and (+) at the end of the code...like
http://www.site.com/news.php?id=13' order by 100--+
or
http://www.benlongfineart.com/news.php?id=13' order by 100--+--
2- there're many ways to find an admin panel..and yeah some sites don't have an admin panel.they may use ftp to make changes of the site.and remember admin panel and cpanel are not the same..
even you can use a google dork to find Admin page
site
ite.com admin/login etc..
RE: I got manual sqli problem...help please. - poWerZone - 03-23-2012
(03-22-2012, 07:49 PM)-SubZer0- Wrote: okay..first of all instead of type in the adress bar use this ad on.
https://addons.mozilla.org/en-US/firefox/addon/hackbar/
1 - if you don't get any error even on order by 100--
you have to use string based sql injection method
you have to add apostrophe (') near php?id='1 / php?id=1' and (+) at the end of the code...like
http://www.site.com/news.php?id=13' order by 100--+
or
http://www.benlongfineart.com/news.php?id=13' order by 100--+--
2- there're many ways to find an admin panel..and yeah some sites don't have an admin panel.they may use ftp to make changes of the site.and remember admin panel and cpanel are not the same..
even you can use a google dork to find Admin page
site
Oooh thanks a lot, never thought about that..
(yea i know admin panel and cpanel aint same
,but thank you again,appreciate your help)