SQL injection Tutorial

SQL injection Tutorial

Note: This is for learning purposes only and should only be used to test your own websites I aint responsible for anything you do with this tutorial use it at your own risk.

What is SQL Injection?

"An attack technique used to exploit web sites by altering backend SQL statements through manipulating application input."

- Web Application Security Consortium Glossary
SQL Injection happens when a developer accepts user input that is directly placed into a SQL Statement and doesn't properly filter out dangerous characters. This can allow an attacker to not only steal data from your database, but also modify and delete it. Certain SQL Servers such as Microsoft SQL Server contain Stored and Extended Procedures (database server functions). If an attacker can obtain access to these Procedures it may be possible to compromise the entire machine. Attackers commonly insert single qoutes into a URL's query string, or into a forms input field to test for SQL Injection. If an attacker receives an error message like the one below there is a good chance that the application is vulnerable to SQL Injection.

What Hackers Can Do With SQL Injection:

* ByPassing Logins
* Accessing secret data
* Modifying contents of website
* Shutting down the My SQL server



SQL injection Tutorial: http://thehackerscrib.org/showthread.php?tid=24

Enjoy THC