Hack your Own Web Project ? SQL Injection
Wall Script
Follow Me:
Monday, December 15, 2008

Hack your Own Web Project ? SQL Injection

Are you looking for some useful tips to improve your web projects security? In this post I suggest you some interesting points about this topic.

Hacking is very interesting topic you can improve programming skill.

SQL Injection

SQL Injection like this

Login Java Code

String userid = request.getParameter("userid");
String password = request.getParameter("password");
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
connection = DriverManager.getConnection("jdbc:odbc:projectDB");

query = "SELECT * FROM Users WHERE user_id ='" + userid + "' AND password ='" + password +"'";

PreparedStatement ps = connection.prepareStatement(query);
ResultSet users = ps.executeQuery();

if(users.next()){

//some thing here
}
else{

}
Injection Works like this
query = "SELECT * FROM Users WHERE user_id ='' OR 1=1; /* AND password ='*/--'";

Login PHP Code;
Username = ' OR 1=1;//
Password = ....
$myusername=$_POST['usr'];
$mypassword=$_POST['pwd'];

$sql="SELECT * FROM users WHERE user='$myusername' and password='$mypassword'";

$result=mysql_query($sql);
$count=mysql_num_rows($result);

if($count==1){

//some code
}
else {

}
Injection Works like this
$sql="SELECT * FROM users WHERE user=''OR 1 = 1;//' and password='....'";

How to avoid these mistakes Use addSlashes() function adding slashes(/) to the string in java and php

//Java Code
addSlashes(String userid);

// PHP Code
$myusername=addslashes($_POST['usr'];);
Hacker is intelligent than programmer. So always hide the file extension (eg: *.jsp,*.php,*.asp).

http://xyz.com/login.php to http://xyz.com/login
http://xyz.com/login to http://xyz.com/signin.do
In Java redirect this URL links using Web.xml file and inn php write .htaccess file in root directory.

My Best Hacking Training Site Hackthissite.org

Hacker's Game full control with Unix based commands. Play and learn many more hacking things
Was this article helpful?
Thanks! Your feedback helps us to improve 9lessons.info


9 comments:

  1. Nice Informative Article

    I have a couple of questions too ...

    You might find something interesting at:
    http://in.geocities.com/siddharth_bhatta
    http://armageddonsaviour.blogspot.com

    My Yahoo Questions
    http://in.answers.yahoo.com/my/qa/index;_ylt=Alv.xyiI1hgdYcm11_adlwiQHQx.;_ylv=3?link=question&more=y

    My Yahoo Answers
    http://in.answers.yahoo.com/my/qa/index;_ylt=AuXQriu_hTRCNuoPCOcCjVGQHQx.;_ylv=3?link=answer&more=y

    Other Questions
    http://in.answers.yahoo.com/my/my;_ylt=AsX16KVZ5jK1zeXmaVN3w6IAAAAA;_ylv=3?link=starred&more=y

    ReplyDelete
  2. Hey can u guide me how to prevent hizacking sessions in php.

    ReplyDelete
  3. HI I WANT TEST STRENGTH AND SECURITY OF LOGIN PAGE BUT IT ACCEPTS 5 CHAR IN USER NAME .
    HOW CAN I CHECK ? I NEED TO KNOW ABOUT BOT ATTACKS
    PLEASE REPLY ME IN PREMS4U@GMAIL.COM

    ReplyDelete
  4. Your Suggestions and Opinions needed here ...

    http://armageddonsaviour.blogspot.com/2008/12/has-anybody-cared-to-inform-dte.html

    http://armageddonsaviour.blogspot.com/2008/12/correct-this-image-problem-on-welcome.html

    ReplyDelete
  5. doesnt work in Java/MySQL, however

    SELECT * FROM user where name='' OR 1=1 OR 1='' and password='*/--'


    this works :D

    ReplyDelete
  6. Or you could just use a PreparedStatement.

    ReplyDelete
  7. Hey how about including XSS Cross Site Scripting Vulnerability article on your blog?

    If you say, I can send you a ppt on it ... (related to hacking)

    One more topic I need your help since security interests you ...

    I would also appreciate, if you share your viewpoints on OpenID for future perspective

    http://armageddonsaviour.blogspot.com/2008/08/netizens-worldwide-want-openid-at-every.html

    http://armageddonsaviour.blogspot.com/2008/08/beware-powerscrapcom-is-not-safe-i-need.html

    ReplyDelete
  8. well frnd it very or trick and doesnot work any more...

    ReplyDelete
  9. exellent, thz


    ARIEL.MACINTOSH™

    ReplyDelete

Make in India