SQL Injection Is Most Widely Used Common Method In Web Hacking. Most Websites Are Being
Hacked Using SQL Injection These Days. In This Post We Are Going To Learn About A Tool Called
Havij. Havij Is An Automated SQL Injection Tool. It Helps Pen-Testers To Find And Exploit Vulnerabilities On A Web Page. You Can Perform Back-End Database Finger Printing, Retrieve DBMS Login Names And Password In The Shape Of Hashes. You Can Also Dump Tables And Columns, Can Fetch Data From The Database, Can Execute SQL Statements Against The Server And Much More. As We Know, That There Are Many Tools Available On Internet, By Using Which Anyone Can Hack Vulnerable Websites. Because Of The Availability Of Hacking Tools. Hacking Websites Is Becomming Easy And The Number Of Hacking Websites Is Also Increasing. Everyone Can Use Havij For Hacking Websites And For Testing Vulnerabilities. Because Of GUI(Graphical User Interface) And Automated Configuration. In This Post I Am Going To Share Tutorial Of Havij. How To Use It And How Can A Person Hack SQLI Vulnerable Website By Using This Tool.
I Have Already Share A Tutorial On SQL Injection By Using SQL Map Tool. Visit Following Link To Read That Post.
How To Hack Website Using Havij?
Things We Need:
- Havij Tool - (Search oN Google For Cracked Version)
- SQLI Vulnerable Website. - Use Google Dorks To Search Vulnerable Website.
Start Tutorial.
- Open Havij.
- Type Vulnerable Website Inside It And Hit Analyze Button.
- Now Click On Tables Tab And Then Hit Get DBs Button.
- Now You Have Got All Databases In Result. Tick Databases And Hit Get Tables Button.
- You Have Got Tables From The Databases You Ticked In Previous Step. Now Tick Related Tables And Hit Get Columns Button.
- You Have Got Columns From Ticked Table. Tick Related Columns And Press Get Data Button.
I Am Going To Choose
Username, Password, UserGroup Columns. There Should Be Stored Data Related To Admin's Username, Password Etc.
- Bingo! You Have Got Username And Password Of Admin.
How To Crack Hash?
As You Can See, We Have Received All Information Of Admin. Like Username,
Password And UserGroup. But We Have Received Password In The Shape Of Hash. In Order To See The Real Password. We Have To
Crack This Code. For Cracking This Code. We Will Make Use Of
Havij Tool Again. Follow Me To Crack This Hash.
- You Can See A Button Of MD5 In Buttons List Of Havij. Hit That Button And Paste Your Hash Code Inside It And Press Start Button.
- You Can See Password In Plain Text In Result Now. See Picture Below.
Find Admin Page
We Have Got Everything. Like Username,
Password. But Where To Use Them And Get Admin Rights? You Need To Find The Admin Login Page Of Target Site. For Finding Admin Page Of Target Site. We Will Use
Havij Again.
- In Buttons List, Press Find AdminButton. Type Homepage Url Of Target Site. Press Start Button.
You Will Get Result Same Like Hash Cracking. You Will Be Able To See The Page. Which Admin Of Your Target Site Use To Login.
