I have been asked lately to write a tutorial on how to use "SQL I Helper V.2.7" tool.
At the begening "SQLIHelperV.2.7" is a tool that will hack vulnerable
websites using SQL injection. You don't have to spend hours and hours
trying to find your way in a website and trying hundreds of combinations
and codes to hack a website.
This tool will do it all by itself. You only have to tell her what do and where to look.
Click here to
Download
Lets start.
first you need to find the potential website that you think it might be
possible to hack it. Remember that some websites are simply unhackable.
Use
Exploit Scanner to find the vulnerable websites.
Download
and use this
Dorks List to use it in the search
Download
And at the end once you find the admin username and his password use
Admin finder
to help you finding the admin login page but remember that this can't
find all login pages. It use the most common extensions. You have the
ability to add more extensions to the list to increase your search
range.
Download
After you find your website ( better to end with
"article.php?id=[number]" ) example:
"http://encycl.anthropology.ru/article.php?id=1"
I will explain my tut on how to hack this website.
Check if your website can be hacked by trying to go this address :
http://encycl.anthropology.ru/article.php?id='1 <-- notice the ' before the number 1.
you should get this message:
Code:
Query failedYou have an error in
your SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near '\'1 ORDER BY lastname' at
line 1 SELECT * FROM person_old WHERE id=\'1 ORDER BY lastname
This mean that this website can be hacked because you get an error.
Now open your SQL I Helper V.2.7
and write the link :
http://encycl.anthropology.ru/article.php?id=1 <---- without the '
here
and press the inject button.
Now you should wait until the tool finish searching for columns . Time
may vary depending on your connection speed , your pc speed , and the
number of columns in the website.
So now you should have this:
Make sure that the website support union otherwise the injection won't work.
then select "Get database" and you get this:
Now select any element from the "database name" box and press the "Get tables" button , I will select "anthropo_encycl":
then select any element from the "table name" box and press the "Get columns" button , I will select "user":
then select any elements you want from the "columns name" box and press "Dump Now" , i will select "usr_login" and "usr_pas
After clicking "Dump Now" , you should see this new window
Now copy the hash on a peace of paper and go to this website:
http://www.md5crack.com/
enter the hash and press the button "Crack that hash baby!" and you should get the source of the hash.
hash:21232f297a57a5a743894a0e4a801fc3
username: admin
hash:202cb962ac59075b964b07152d234b70
pass: 123
COMMENT YOUR REVIEW :)