Hack Websites Easily Using SQL Injection 2015 (Havij Tutorial)

According to a survey the most common technique of hacking a website is SQL Injection. SQL Injection is a technique in which hacker insert SQL codes into web Forum to get Sensitive Information like (User Name , Passwords) to access the site and Deface it. The traditional SQL injection method is quite difficult, but now a days there are many tools available online through which any script kiddie can use SQL Injection to deface a webite, because of these tools websites have became more vulnerable to these types of attacks.

One of the popular tools is Havij, Havij is an advanced SQL injection tool which makes SQL Injection very easy for you, Along with SQL injection it has a built in admin page finder which makes it very effective.

Warning – This article is only for education purposes, By reading this article you agree that Hack-Super-Sony is not responsible in any way for any kind of damage caused by the information provided in this article.

Firstly, if you haven’t downloaded havij full version, I strongly advice you download it before you continue. You can download it from the following link.

 >>Click Here To Download Havij 1.16 Full Version << 

Supported Databases With Havij:

MsSQL 2000/2005 with error.
MsSQL 2000/2005 no error union based
MySQL union based
MySQL Blind
MySQL error based
MySQL time based
Oracle union based
MsAccess union based
Sybase (ASE)
Demonstration

Now i will Show you step by step the process of SQL injection.

Step1: Find SQL injection Vulnerability by 
Typing  allinurl:"index.asp?id=" in google search.
Searching results will be like this- (http://www.target.com/index.asp?id=123)

Checking for sql vulnerability --->

Here i am taking http://www.target.com/index.asp?id=123 as an example. 

Now to check is this site vulnerable to sql, I will simply add ' after the site url

like this http://www.target.com/index.asp?id=123'

and i get this error on the site

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

It means that site is vulnerable to sql injection.. Copy That link in Havij as shown below.

Step2: Now click on the Analyse button as shown below.

Step3: Now if the your Server is Vulnerable the information about the target will appear and the columns will appear like shown in picture below:

Step4: Now click on the Tables button and then click Get Tables button from below column as shown below:

Step5: Now select the Tables with sensitive information and click Get Columns button.

  

Step6: Now after clicking Get Columns havij will get all the columns available in users table.

Step7: In my case i found different columns like id, login, pass an many more.

Step8: Now select the columns and click on Get Data like in pic given below.

Step9: Now havij will look after the data available in columns login and password i.e admin username and password like i get 

username --> adminpassword--> 21232f297a57a5a743894a0e4a801fc3 (in encrypted form)

Like in image below

Step10: Now after i get username and password there is a problem that password i s encrypted in mdm language , so we have to crack it .

Step11: To crack encrypted password just copy password click on MD5 tab in havij and paste the encrypted password in MD5 hash field and hit start.Now havij will try to crack the password. Like i cracked in image given below.

Step12:  Now i get Password cracked as admin.

Step13:  Now we will check for admin panel where we gonna login with username and passoword.

Step14:. To find admin panel click Find Admin tab in Havij and click start. Now havij  will check the admin panel of website.

In my case i found http://target.com.co/admin/ as admin panel, now open it in a web browser and login with username and password and now you are in admin panel.

Thats It!!! and its cool. You have hacked a website..

Download Havij v1.16 Pro Full Version(Cracked)