Hacking Websites Through Sql Injection

The Most Common Question People often ask from me related to hacking is How Hackers Hack our Websites. Today I am Telling You a Very Important Technique to Hack Websites With a Demo.The Technique i will use is Sql Injection.

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It happens from using poorly designed query language interpreters.

Lets Start Hacking a Website.....

1.) When You Enter a Username and Password in a Website the query Which is fired is similar to :
Select * from Admin where username = 'ishan' and password = '123' ;

Here Admin is the table name and username,password are columns in the table.

Now I Supply values for username and password as 'ishan' and '123' and an error is produced.



2.) Now Lets supply username= 1' or '1' = '1 and password = 1' or '1' = '1 and let's see what happen?



Wallaaa The Website is Hacked......

3.) Now Lets Go back to Sql Query and see what happen if we replace 'ishan' and '123' with 1' or '1' = '1 , Then Query Becomes

Select * from Admin Where username = '1' or '1' = '1' and password = '1' or = '1' = '1'

Now as we know if any of the condition in or is true then statement is true therefore username and password may not be equal to '1' but '1' = '1', This is a Universal truth.Since Both Condition of And are true now therefore the whole select query becomes true and it returns the row...

4.) Now as we don't enter any valid username and password so Which row from admin table does the Select query will retrieve.Good Question?

It will retrieve the very first row of the table
Now The basic thing in this attack is that we have Fooled the Database by manipulating query..

5.) You Can try some more username and passwords to fool database:

• admin'--


• ') or ('a'='a


• ”) or (“a”=”a


• hi” or “a”=”a

Hope That You have liked this post and don't forget to +1 and recommend this site in right pane

Note :This is for Educational Purpose only. Don't try it to cause any harm to any website or its Database

DDOS Attack - A Beginners Tutorial

Today I will discuss an Advanced Attack to Deface a site. This Attack is used to stop functioning of a site so that no one can access it.



distributed denial-of-service attack (DDOS attack) is an attempt to make a computer resource unavailable to its intended users. One common method of attack involves sending an enormous amount of request to Server or site and server will be unable to handle the requests and site will be offline for some days or months depending upon the strength of Attack i.e. (Data Sent to the Site/Server)

Basic Procedure/Logic employed in DDOS :

1.) Open Command Prompt in windows by going to Start -> All Programs -> Accessories -> Command Prompt.

2.) Type "ping site-ip -l 5120 -n 100000 -w 1".

Here "site-ip" is the IP Address of Target, You can also use site-name like "www.google.com" instead of site-ip."5120" is the size of packet sent to the target Which is 5 KB in example. "100000" is the no of requests sent to the Target. "- w 1" is the waiting time after each request which is 1 sec in example. You can change these parameters according to your need, but Don't omit these.

This Attack is also called "Ping of Death"

But In Actual a Single Computer using this Attack cannot Deface a Site for long time. Hackers Create and install botnets on different computers as trojans and use those Comprised Computers also to send these Dummy Packets to Target. When a Large no of Compromised Computer send simultaneous Requests to the target, the target site will be offline and Defaced

Note: This is for educational purpose only Don't use to harm any Server or site and most important Don't use it on my site....

Hackers language table

click here to download table