Breaking Sec

Keep in mind this tutorial has been modified, i originally taught it through msn, so it looks mildly retarded

so what they did, was they saw this:
http://www.3ethicalhackers.com/news.php?id=5 the .php?id=5 is the important part.
to test for vulnerability you add a ' to the end of the url. i assume they got an error like "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar.

now, after determining that it was vulnerable, we need to find the number of columns.

To find number of columns we use statement ORDER BY (tells database how to order the result)
we just implement that into our url until we get an error.

an example of this would be me doing:
http://www.3ethicalhackers.com.com/news.php?id=5 order by 1/* <-- no error
http://www.3ethicalhackers.com/news.php?id=5 order by 2/* <-- no error
http://www.3ethicalhackers.com/news.php?id=5 order by 3/* <-- no error
http://www.3ethicalhackers.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that, when we open the page)

that means it has 3 columns because we got an error on the fourth.

after we get our error we need to check for union function. With union we can select more data in one sql statement.
so we have:
(we already found that number of columns are 3)

if we see some numbers on screen, example 1 or 2 or 3 then the UNION works

after that we need to check for the MySQL version
let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.
it should look like this:
if you get an error we need to convert.

example:
or with hex() and unhex()

you'll get something like
and you will get MySQL version


now. getting the table and column names.
well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) we must guess table and column name in most cases.
common table names are: user/s, admin/s, member/s etc.
common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc.
Example:
(we see number 2 on the screen like before, and that's good)
because we know that table admin exists.

after we do that we'll check column names. (if you get an error, then try the other column name)
we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists,
(if you get an error, then try the other column name)
if it works, we see password on the screen in hash or plain-text, it depends of how the database is set up. e.g md5 hash, mysql hash, sha1...

now we must complete query to look nice
for that we can use concat() function (it joins strings)

Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)
(there is another way for that, char(58), ascii value for: )

now we get dislayed username: password on screen, i.e admin:admin or admin: somehash
when you have this, you can login like admin or some superuser
now remember, if can't guess the right table name, you can always try mysql.user (default) it has user password columns, so example would be

hi friend please help me I'm new member i ask a question about sql language
I Want to download good quality Video tutorials related to SQL Server 2010 Free.Plz if any one know than reply me.
urban spooning