COMPLETE SQL INJECTION TOOLKIT AND TURORIALS

Hello everybody ,



since i started learning SQLi , i have collected lots of good tools and documents , m still collecting more and more day by day as my scope of knowledge is increasing .
So thought of sharing what i have collected till now with everyone here,
My tool pack includes the following things.








DOWNLOADS :

SQLI SCANNER PACK : http://adf.ly/6tth
MD5 tools pack : http://adf.ly/6tuV
ADMIN FINDR : http://adf.ly/6tuk
SQLI TUTORIAL PACK : http://adf.ly/6tuw
DORKS PACK : http://adf.ly/6tv7
SHELLS PACK : http://adf.ly/6tvD

DONT DOWNLOAD IF YOU DONT KNOW WHAT ARE FALSE POSITIVE VIRUS ALERT

1) sqli scanner/automating injection pack :
contains 5 softwares for scanning ,and automating the hacking process

(a) Exploit scanner - for finding websites with dorks , and testing them for vulnerabilities.very famous
(b) Turkish ARTA - same as exploit scanner but not as famous bcos its turkish . i find it better then exploit scanner. but that my personal opinion
© Havij 1.12 free version : i guess everyone knows about it. it automates the process of performing sqli attack on any site.
it is extremely famous and efficient. but still it a tool :) nothing compared to manual process
(d) SQLI helper 2.7 : same like havij , but little fast .
(e)sqlinj Version 2 - another nice sql injection tool . i will write a tut later how to use this tool

2) ADMIN Finder pack :
After getting the logins from the database . one needs to get the admin finder page. for some sites its very easy while for smoe site its hellova tough
here are some nice admin finder tools and lists tht u may use. but these tools are never enough .i will keep uploaing the amin finder lists as i get more

(a)reiiuke admin finder ( u can upadt the original admin finder lists with the list i am providing)
(b)5 perl and python admin finder tools/scripts. update them as per ur need
© misc softwre : admin pass locater , to brute force admi pass if u cant find it

YOU MIGHT ALSO LIKE THIS SITE
http://th3-0utl4ws.com/tools/admin-finder/

3) DORKS Pack : Contains many files contiaing more then 7000 dorks.

4) Shells : this pack contins many shells and source codes , like c99 ,c100 , jackel and hellova more
( many shells like c99 are identified as trojans by many antivirus. so u might find ur antivirus shouting about this pack. )
U might also wanna see this site :
http://www.kinginfet.net/shells/

5) MD5 cracking tools : although havij have md5 tool but for some reason it never worked for me . so this pack contains some tools .
ASLO THESE SITES WILL PROVE YOU GREAT HELP
http://www.md5decrypter.com/
http://www.md5decrypter.co.uk/
http://md5.rednoize.com/
http://md5decryption.com/
http://passcracking.com/
http://www.xmd5.org/
http://www.md5cracker.com/index.php
http://md5.noisette.ch/index.php
http://md5cracker.org

6) SQLI tutorials pack : This pack contain complete html pages of sqli tutorails that i found useful from various forums and websites like hackforum , elitesoft ,warex , outlaws etc etc. i bet every newbe will love this pack .
u just need a firefox browser to open these html files.
NOTE: this pack also contain 2 of my own created sqli help files which i created myself, serves me as a very useful docment wheneever i m on to hack some site.

i will kep updating these packs as i learn and collect more and more .

SQL Injection the complete Tutorial

Translated from Portugease :

SQL injection is a technique that explores a vulnerability of security that occur in the database of a layer of application. The vulnerability i present when user input i either incorrectly filtered will go string literal escape characters embedded in SQL statements or user input i not strongly typed and thereby unexpectedly executed. The vulnerability is present when user is or incorrectly screened for literal cord escape built-in characters in the instructions SQL or users strongly are not typed and, like this, unexpectedly performed. It i in fact an instance of it lives general class of vulnerabilities that can occur whenever one programming or scripting language i embedded inside another. It is in fact an example of a form more general class of vulnerabilities that can occur whenever a programming language or scripting is inserted inside another. __________________________________________________ ___________________ Or Be an a lot Way NooB of invade a big quantity of sites. ...........

For that vc is going to be necessary. .....

*Google *internet Connected *Strings *codicos of Sql injection *JAP (is not necessario is good use barely as
security)

Then vamu her. ...............como I am baunzinho I see passes them half from the trabaio. ...
__________________


' to admin shell root First
vc goes in the google and digitizes the following one (allinurl: "Some Of The Strings") Without "Parenteses"

ah vc chooses a site noob applies in the login by example:' or' = 1 sign to same thing:' or' = 1

Promptly now vcs can vary the codicos and itself will want polpar work use some scanner of vulnerability as by example the acunetrix __________________________________________________ ___________________
JAP 00.08.073

JAP — Anonymity & Privacy is a program that is going to guarantee to his privacy while sails for the internet. With that, you avoid that can monitor your accesses and guarantees the your anonymity by the net.

Code:

http://baixaki.ig.com.br/download/JAP.htm

__________________________________________________ __________________

Acunetix Web Vulnerability Scanner 5,0

Omprove itself his site is to the Test of hackers Acunetix Web Vulnerability Scanner is a powerful utility one that analyzes a site in search of possible vulnerabilities.

Code:

http://www.download3000.com/download_11974.html

SQL Injection1

SQL Injection...

Since the most popular web hacking technique is the sql injection I think you should learn about it. You should know a web scripting language(php is the most popular) and an sql database(MYsql is the most popular) to understand the sql injection. I thought in this topic we can share our knowledge and resources.

This is one of the documents I liked. It's written by cypherxero;




With the growing popularity of websites using the standard php/sql interfaces, a new and dangerous
type of attack is becoming more popular for hackers, and that is sql injection. sql, or Standard Query
Language, is a type of database specification for reading and writing information to a database. This is
used to create dynamic webpages with structured content, and other data types.

The problem is not actually a problem with the sql database itself, but rather how it is accessed
and used via the scripting language on the website. The standard scripting language on the web for
interacting with sql databases is php. The real issue lies with the php programmers not writing the sql
statements correctly, which can allow an attacker to inject their own commands directly to the sql
database. Here's a sample of php code that dynamically builds a sql command to be processed:

$sql = "select * from users where username='".$_GET['username']."' and password = '".md5($_GET['password'])."'";

The sql command would look like this to the database:

select * from users where username='cypherxero' and password = '5f4dcc3b5aa765d61d8327deb882cf99';

This would lookup my username (cypherxero), and then compare the password hash with the one in the
database. If they're the same, then I'm authenticated, and logged in. The problem with this statement is
that there is no sanitation on the user input, so if you entered your own sql command, say for this login
box, then you can bypass authentication!

Consider this sql Statement:

' OR 1=1--

Inserting this into the sql command that already exists, we get this:

select * from users where username='' OR 1=1--' and password = '5f4dcc3b5aa765d61d8327deb882cf99';

This statement would return true (since 1 does equal 1), and the rest of the sql statement after the
double-dashes will be commented out, and the system will return the first username in the database, and
log you into the system as the first user (most likely admin) without the need for a password!

Other ways of using sql injections is with http get statements that pass variables onto the database.
Let's take a look at a real sql injection I found a few weeks ago, in a component on the Joomla CMS. I
first discovered this flaw while doing some random web app sec testing on one of my friend's company's
website. Let's take this url from her site:

http://www.klochko.com/index.php?option=com_philaform&&Itemid=34&form_id=5

As you can tell, we're passing the variables option, Itemid, and form_id to index.php, and the php script
is passing those variables onto the sql database. Let's see what happens when I insert a single tick mark
at the end of the last variable:

You have an error in your sql syntax; check the manual that corresponds to your Mysql server version for
the right syntax to use near \'\\' order by ordering ASC\' at line 1 sql=select * from
jos_philaform_detail where form_id=5\\' order by ordering ascno elements defined

Since we passed a variable that the database didn't know what to do with, it freaked out and returned an
error message. Now, any sane person that's not a hardcore geek would just think something wrong happened,
and try another website. Not me. I knew right then from seeing that message that I had a sql injection,
and that I wanted to see what I could do. I searched google, milw0rm, packetstorm, and securityfocus, and
couldn't find a sql injection for Phil-a-Form, which upon further research, was a piece of software for
Joomla to add extra functionality. So, I figured either it was impossible to get an injection and had been
done before without any luck, or that no one had found it yet. It turns out no one had found it yet, and
now it was a race against the clock to find a proof-of-concept injection and submit it before someone else
found it.

There's a nice little sql command called union that combines data from more than one table into one
output, and that's what I was going to need. My goal was to get the administator password (in MD5 hash
format) from the database. The sql statement from the error messaged helped me understand what was going
on with the query, and helped me write my injection. I knew that it was pulling data from the sql database
for the forms that were on the page. I needed to combine that form table and data from another table onto
one page. I did some research on Joomla, and found the list of the default sql tables, and the format that
they were in. I knew I needed to pull the password from the jos_users table, and that the password field
was called password.

Since union commands need to keep the columns the same for both tables, there were a lot more tables in
the jos_philaform table than in the users table, so to keep the tables the same for the union command, I
had to fill the injection string with enough nulls to make them the same. Since Phil-a-Form is
pay-software, I didn't feel like putting my money down on software that I don't need, so it was just a
matter of trial and error until I had the correct column size. The final sql injection string looked
looked like this:

union select null,null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,
null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
from jos_users --

This statement, put on the end of the "form_id=5", pulled the password has from the database, and returned
it to me on the page. The final result was the form on the page, but at the very bottom, a nice little
error message, with, lo and behold, the MD5 hash of the first user in the table, the administrator.

Fatal error: Cannot instantiate non-existent class: philaform_5f4dcc3b5aa765d61d8327deb882cf99 in
/home/klochko/public_hhtml/components/com_philaform/philaform.class.php on line 437

There it was, what I was looking for, the password in MD5. All that was left was to crack it using rainbow
tables, and then if I was malicous, to log into admin and deface the website, or do whatever I wanted at
that point. My friend's website has since been upgraded to the newer version of Phil-a-Form, and no, that
is not the real admin hash, I don't think they would make their password "password".