How to hack a website with Sql Injection

[MrHotFire]

Credits Olympus&Me.

 

 

 

 

 

This is an simple guide of how to hack an website with SQL.

 

First of all we need to find an website.

To do this us a google dork.

Enter inurl:id=5 in the searchbox and press enter.

 

If you found the site that you want let's see if it's vulnerable.

Just add the ( ' ) to the end of the url.

 

An window is gonna 'bump' and is gonna say 'Error Executing Database Query.'

"You have an error in your SQL...etc...."  (if something like this or a black is gonna show you an black the page is vulnerable).

 

 

The way to check how many columns there are is this one:

Just order by 1/* to the end of the url and keep increasing it until you get an error.(p.x www.test.com order by 1/*,www.test.com order by 2/*...etc...)

When you will get an error p.x at the 100 it means that they are 99 columns.

 

Now that we found how many columns there are we use the union command.

Just make the id negative and add union all select (columns)/* to the end of the url.

 

So in my 'case:

union all select 1,2,3....99/*  (because of the 99 columns).;)

 

 

If 'your' site is version 5 then you can see all the tables+columns.

wHEN THE VERSION IS LOWER THAT 5 THEN YOU HAVE TO GUESS THE TABLES AND COLUMNS (COMMON ARE:USERS,USER,USR,USRS,ADMIN,ADMINS,memmber,members.....etc...)

Common columns are:user_name,username,user,passowrd....

 

Now at the version 5 to view the tables you will have to replace the digit shown on your screen(I have 99) with table_nameand at the end of the url of the url you will add from information_schema.tables/*

Now to check your version it might show you 2 or other digits.Let's say that my version is 78.

So in my case I am gonna replace 78 with versions() or @@version(when is gonna show you 2 at your screen you will have to replace 2 with the version() or the @@version.).

p.x www.test.com union all select 1,2,3,version@@,5,6,7,...etc..99/*    This is gonna show you the system like Microsoft,Debian..etc....

 

 

Now it shows you all the tables.After that use ctrl+F to search for something that you like.(p.x:users)

Note:if is gonna show you only one table then we should use limit.( add limit 0,1/* to the end of the url and keep increasing the 0 until you are gonna find something that you like.).

 

 

 

 

I said that an interesting thing was the users.

If you want to find passwords&usernames then replace the table_name with:

column_name and replace from informations_schema.tables with from informations_schema.columns.

Now you should search something like username&password.

 

 

 

Now if you have found everything let's display it on our screen.

To do this I am gonna replace 99 with concat.(username,test,passowrd)and at the end of the url I am will add from users/*    .  (they may have an different and not users.Search it.).

*conact will put the username and password in this form:"username:password" without the quotes of course.).

So when you will find the table with the users..etc...the usernames are stored in the column user and the password are stored in the column user and passwords are stored in the column pwd you use concat.(user,test,pwd) and at the end of the url you will add users/*  .

 

That's it.I hope to have fun with this little and simple guide.

[Analyser_]

Simple guide of how to hack and site with SQL.

 

First change the tittle to : How to hack a website with Sql Injection.

 

Second  Sql is not a hacking tool is just a type of database so "This is an simple guide of how to hack an website with SQL." this don't make sense.

 

We live in 2012 you need something better. :) Give me a pm if you want I can help you a bit .

 

 

[MrHotFire]

Simple guide of how to hack and site with SQL.

 

First change the tittle to : How to hack a website with Sql Injection.

 

Second  Sql is not a hacking tool is just a type of database so "This is an simple guide of how to hack an website with SQL." this don't make sense.

 

We live in 2012 you need something better. :) Give me a pm if you want I can help you a bit .

 

 

Not for the time being+thanks.

p.s what grade you have?(white,red...etc....)

As you see I am an amateur 'hacker'.

I am learning.;)

[Analyser_]

 

Not for the time being+thanks.

p.s what grade you have?(white,red...etc....)

As you see I am an amateur 'hacker'.

I am learning.;)

You can give me a pm for more info :)

[MrHotFire]

You can give me a pm for more info :)

 

 

PMed.