Ethical Hacking

Blind SQL injectiontechnique is used when the web application is vulnerable but the output doesn’t display to the attacker. When hacker tries SQL injection, they will redirect to some other pages instead of error message. Blind SQL Injection is harder to implement when compared with the above Traditional SQL Injection Technique, it will take more time . There are some tools for Blind SQL Injection.

Statement=”select * from userinfo where id=` “+id+” ` “;

Select * from userinfo WHERE id=1 AND 1=1

• lower(str) is the function that converts the character to lower case
• ascii(c) is the function that converts the character to ASCII value.
• length(str) returns the length of the string .
• user() returns the current user(admin)
• database() returns the database name.
• version() retruns the version of database

• Sql InjectMe
• Blind Sql Injection Brute Forcer
• Havij 
• Sqlsus

Sqlsusis an open source MySQL injection and takeover tool, written in perl. It is used to test the vulnerability of web application. It uses stacked subqueries and an powerful blind injection algorithm to maximise the data gathered per web server hit.Using multithreading on top of that, sqlsus is an extremely fast database dumper, be it for inband or blind injection.

What is SQL Inject Me?
SQL Inject Me is Mozilla addon that is used to test the SQL Injection Vulnerability of Web Application.  It reduces the workload of Manual SQL Injection Test.  This is especially designed for Pen Testers and Web Masters not for hackers.

https://addons.mozilla.org/en-US/firefox/addon/sql-inject-me/

• In Java you can use PreparedStatement() with bind variables 
• In .NET you can use parameterized queries, such as SqlCommand() or OleDbCommand() with bind variables
• In PHP you can use PDO with strongly typed parameterized queries (using bindParam()).

$username = $_POST['username'];
$password = $_POST['password'];
if (!get_magic_quotes_gpc()) {
$username = addslashes($username);
$password = addslashes($password);
}

•  Not all data that are supplied by the user are intended for insertion into a database. They may be rendered directly to the screen, stored in a session, or previewed before saving. This can result in backslashes being added where they are not wanted and being shown to the end user. This bug often creeps into even widely used software.[7]
•  Not all data that are supplied by the user and used in a database query are obtained directly from sources protected by magic quotes. For instance, a user-supplied value might be inserted into a database — protected by magic quotes — and later retrieved from the database and used in a subsequent database operation. The latter use is not protected by magic quotes, and a naive programmer used to relying on them may be unaware of the need to protect it explicitly.
• Magic quotes also use the generic functionality provided by PHP's addslashes() function, which is not Unicode aware and still subject to SQL injection vulnerabilities in some multi-byte character encodings. Database-specific functions such as mysql_real_escape_string() or, where possible, prepared queries with bound parameters are preferred.[8][9]
• While many DBMS support escaping quotes with a backslash, the standard actually calls for using another quote. Magic quotes offer no protection for databases not set up to support escaping quotes with a backslash.
• Portability is an issue if an application is coded with the assumption that magic quotes are enabled and is then moved to a server where they are disabled, or the other way round.
• Adding magic quotes and subsequently removing them where appropriate incurs a small but unnecessary performance overhead.
•  Magic quotes do not protect against other common security vulnerabilities such as cross-site scripting attacks or SMTP header injection attacks.

WebApplication(Website) stores the information in database such as user info, admin info, and passwords. When the developer fails to handle escape characters and type, it results in vulnerable database. Hacking or accessing the database using this vulnerability is known as SQL injection.

• Bypassing Logins
• Accessing secret data
• Modifying contents of website
• Shutting down the database server

statement=”select * from `users` where `usrnam`= ' “+username+” ' ;”;

' OR '1'='1

Select * from users where username=' ' or '1'='1'

' or '1'='1' -- '
' or '1'='1' ({ '
' or '1'='1' /* '

hello'; insert into users value('us12', 'pas12'); select * from users where '1'='1';

Select * from users where username=' hello'; insert into users value('us12', 'pas12'); select * from users where '1'='1';

Statement=”Select * from `userid` where `id`=”+inputId+”;” ;

1; drop table `userid`;

Select * from `userid` where `id`=1; drop table `userid`;