Hack Websites Using Havij

Warning :- This article is only for educational purposes, By reading this article you agree that this blog is not responsible in any way for any kind  of damage caused by the information provided in this article

 

According to a survey the most common technique of hacking a website is SQL Injection. SQL Injection is a technique in which hacker insert SQL codes into web Forum to get Sensitive information like (User Name , Passwords) to access the site and Hack it.One of the popular tools is Havij, Havij is an advanced SQL injection tool which makes SQL Injection very easy for you, Along with SQL injection it has a built in admin page finder which makes it very effective.

Download Havij 

Step1: We will use google dorks to find the vulnerable websites, there is a big list of google dorks  which I will post in my future articles but at this time we will only use the following:

            inurl:index.php?id=

            inurl:trainers.php?id=

            inurl:buy.php?category=

            inurl:article.php?ID=

Just search google using one of the dork and you will see a lot of vulnerable websites.

Step2: Open any one of the website than put  ‘ after the link look:

If you get the following SQL error, that means the website is vulnerable to SQL-injection attack.  

Step3: Find SQL injection Vulnerability in tour site and insert the string (like http://www.target.com/index.asp?id=123) of it in Havij as show below.

Step 4: Now click on the Analyse button as shown below.

Step 5: Now if the your Server is Vulnerable the information about the target will appear and the columns will appear like shown in picture below:

Step 6: Now click on the Tables button and then click Get Tables button from below column as shown below:

Step 7: Now select the Tables with sensitive information and click Get Columns button.After that select the User name and Password Column to get the User name and Password and click on the Get Table button.

Step 8: Normally web server uses MD5 encryption technique, you have to decrypt this password use havij option MD5 or other MD5 decryption tools.

Step 9:After decrypting the password, you have to find the admin login page of the website. To do that use Havij options.

Step 10: Now you can login as the admin user and control the website as you want

Countermeasures:
1.Renaming the admin page will make it difficult for a hacker to locate it

2.Use a Intrusion detection system and compose the signatures for popular SQL injection strings