+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: MySql Injection (/Thread-MySql-Injection)
MySql Injection - Pupix - 06-28-2013
So i have a question ...lets suppose that the site we are on doesnt have that error u usually exploit (that ' at the end of the URL doesnt work)but u really need to get that site database ...what are u using? can u still use Mysql injection ?
If yes then how?
If no then how can u hack it?
Thx alot
RE: MySql Injection - RogueCoder - 06-28-2013
You can use delay to see if it's triggered
Code:
?id=-0 waitfor delay '0:0:15' --Edit: As posted in the reply in PM. Read the section about Time-based sql inject here https://www.owasp.org/index.php/Blind_SQL_Injection
RE: MySql Injection - Pupix - 06-28-2013
Ok but u still need a site with http://www.site.com/vulnerable.php?id=1 this type of URL....
Lets suppose u cant find that part with index.php in a site what u do then?
RE: MySql Injection - RogueCoder - 06-28-2013
Cookies, headers, forms, etc .. Read about [google=Advanced sql injection]advanced sql injection[/google]
RE: MySql Injection - Pupix - 06-28-2013
http://www.slideshare.net/amiable_indian/advanced-sql-injection can u take a look to this to see if its good?
Thx
Maybe it will help others if we post a link with the exact info about this topic
RE: MySql Injection - RogueCoder - 06-28-2013
Yes that is a good read.. I read that last night actually.. Anyone looking into web application hacking should check out OWASP... It contains really great resources on everything related to this subject
RE: MySql Injection - Pupix - 06-28-2013
I dont understand something lets "suppose" u want to hack this site *snip*
How would u do it ....?
RE: MySql Injection - RogueCoder - 06-28-2013
That I would not tell you
That is activity which is not prohibited in this community
RE: MySql Injection - Pupix - 06-28-2013
I dont want to hack it i just want to know how....thats its my schools site and i will try to make my informatics teacher(the person who take care of it) to let me help him taking care of it
RE: MySql Injection - Linuxephus™ - 06-28-2013
(06-28-2013, 02:04 PM)Pupix Wrote: I dont want to hack it i just want to know how....thats its my schools site and i will try to make my informatics teacher(the person who take care of it) to let me help him taking care of it
BlackHat activity is still BlackHat activity regardless of how you label it and/or word it.
Thread Closed on that merit.
For future reference, research your own questions before posting threads with the expectations of others doing the work for you.
Should you find yourself not capable of learning such material first hand, then you're in the wrong line of business accordingly.
And nobody Socially Engineers my peers on my watch.
There's a difference between learning and Socially Engineering others into doing the "learning" for you.