SQL Injection Finding Vulnerable Websites.. « Null Byte :: WonderHowTo

Welcome Back !! TheGeeks.SQL Injection (SQLI) Part-1I hope you all enjoyed my previous article on Email spoofing, if not you'll can go to my profile and check it.My this article totally different from previous one. In this article i'll be teaching how to find vulnerable websites for SQL injection.SQL injection is a code injection technique, used to attack data-driven applications. The SQL Injection attack allows external users to read details from the database, so attackers can dump whole website database and find admin username/password details.Note: Unfortunately we CANNOT SQLi attack on all websites. The websites need a SQLi vulnerability in order to do this technique.Website URL need a parameter like php?id=4 / php?id=any number to inject.For example:http://www.example.com/products.php?id=5www.example.com/products.php?id=5<= This type of website is needed in order to do this trickTo Find these type of website, Use Google Dorks- dork will advance search on googleSome Pakistan google Dorks list:gallery.php?id= site:.pkproducts.php?id= "+92"cat.php?id= "+92"default.php?catID="+92"There is no limit in dork list, you can make your own google dork with keywords. Or you search on google for "New Google Dorks List" you will get many results.Here you can findhttp://pastebin.com/Tdvi8vgK7000 google dork listsNote: These dorks will search out other countries websites Too, if you like to do this to Pakistan based websites ADD site:.pk at the end of the dork for example: about.php?cartID= site:.pkOnce you find a website, then you can check for SQLi vulnerability.Put an ' (Apostrophe) at the end of the URL Parameter.I found a websitehttp://www.piil.com.pk/new.php?id=25Let's, Check for SQLi Vulnerability, so i put an Apostrophe at the end of the URL Parameter.http://www.piil.com.pk/new.php?id=25' (if you are using google chrome... Apostrophe will change to %27, it doesn't matter)Now I found an error on this website!!!"Warning: mysqlfetcharray() expects parameter 1 to be resource, boolean given in /home/piilcom/publichtml/new.php on line 111"Sometimes, we can see different SQLi error. Sometimes we cannot see this error at all, but it you will show some changes in website.For examplehttp://www.psn.com.pk/index.php?page=gallery.php&id=519When i put an Apostrophe, The contents in that website got vanishedhttp://www.psn.com.pk/index.php?page=gallery.php&id=519'thank you,--ANAMIKA (TG)Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedBecome an Elite Hacker Part 4:Hacking a Website. [Part 1]SQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:Use SQL Injection to Run OS Commands & Get a ShellSQL Injection 101:Advanced Techniques for Maximum ExploitationHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How To:SQL Injection! -- Detailed Introduction.SQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowHow To:Hack websites with SQL injectionHow To:Hack Hackademic.RTB1 Machine Part 1SQL Injection 101:How to Avoid Detection & Bypass DefensesSQL Injection 101:Common Defense Methods Hackers Should Be Aware OfGoogle Dorking:AmIDoinItRite?How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:Hack websites with SQL injection and WebGoatHow To:Protect Your PHP Website from SQL Injection HacksHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow Null Byte Injections Work:A History of Our Namesake