DDoS Tools

DOS Attacks and Free DOS Attacking Tools [Updated for 2017]

There are basically three types of DDOS attacks:

1. Application-layer DDOS attack
2. Protocol DOS attack
3. Volume-based DDOS attack

Application layer DDOS attack: Application-layer DDOS attacks are attacks that target Windows, Apache, OpenBSD, or other software vulnerabilities to perform the attack and crash the server.

Protocol DDOS attack: A protocol DDOS attacks is a DOS attack on the protocol level. This category includes Synflood, Ping of Death, and more.

Volume-based DDOS attack: This type of attack includes ICMP floods, UDP floods, and other kind of floods performed via spoofed packets.

There are many tools available for free that can be used to flood a server and perform an attack. A few tools also support a zombie network to perform DDOS attacks. For this post, we have compiled a few freely available DOS attacking tools.

Free DOS Attacking Tools

1. LOIC (Low Orbit Ion Canon)

LOIC is one of the most popular DOS attacking tools freely available on the Internet. This tool was used by the popular hackers group Anonymous against many big companies’ networks last year. Anonymous has not only used the tool, but also requested Internet users to join their DDOS attack via IRC.

It can be used simply by a single user to perform a DOS attack on small servers. This tool is really easy to use, even for a beginner. This tool performs a DOS attack by sending UDP, TCP, or HTTP requests to the victim server. You only need to know the URL of IP address of the server and the tool will do the rest.

Image 1: Low Orbit Ion Canon

You can see the snapshot of the tool above. Enter the URL or IP address and then select the attack parameters. If you are not sure, you can leave the defaults. When you are done with everything, click on the big button saying “IMMA CHARGIN MAH LAZER” and it will start attacking on the target server. In a few seconds, you will see that the website has stopped responding to your requests.

This tool also has a HIVEMIND mode. It lets attacker control remote LOIC systems to perform a DDOS attack. This feature is used to control all other computers in your zombie network. This tool can be used for both DOS attacks and DDOS attacks against any website or server.

The most important thing you should know is that LOIC does nothing to hide your IP address. If you are planning to use LOIC to perform a DOS attack, think again. Using a proxy will not help you because it will hit the proxy server not the target server. So using this tool against a server can create a trouble for you.

Download LOIC here:

 https://sourceforge.net/projects/loic/

2. XOIC
XOIC is another nice DOS attacking tool. It performs a DOS attack an any server with an IP address, a user-selected port, and a user-selected protocol. Developers of XOIC claim that XOIC is more powerful than LOIC in many ways. Like LOIC, it comes with an easy-to-use GUI, so a beginner can easily use this tool to perform attacks on other websites or servers.

Image 2: XOIC

In general, the tool comes with three attacking modes. The first one, known as test mode, is very basic. The second is normal DOS attack mode. The last one is a DOS attack mode that comes with a TCP/HTTP/UDP/ICMP Message.

It is an effective tool and can be used against small websites. Never try it against your own website. You may end up crashing your own website’s server.

Download XOIC: http://sourceforge.net/projects/xoic/

3. HULK (HTTP Unbearable Load King)

HULK is another nice DOS attacking tool that generates a unique request for each and every generated request to obfuscated traffic at a web server. This tool uses many other techniques to avoid attack detection via known patterns.

It has a list of known user agents to use randomly with requests. It also uses referrer forgery and it can bypass caching engines, thus it directly hits the server’s resource pool.

The developer of the tool tested it on an IIS 7 web server with 4 GB RAM. This tool brought the server down in under one minute.

Download HULK here: http://packetstormsecurity.com/files/112856/HULK-Http-Unbearable-Load-King.html

4. DDOSIM—Layer 7 DDOS Simulator

DDOSIM is another popular DOS attacking tool. As the name suggests, it is used to perform DDOS attacks by simulating several zombie hosts. All zombie hosts create full TCP connections to the target server.

This tool is written in C++ and runs on Linux systems.

These are main features of DDOSIM

• Simulates several zombies in attack
• Random IP addresses
• TCP-connection-based attacks
• Application-layer DDOS attacks
• HTTP DDoS with valid requests
• HTTP DDoS with invalid requests (similar to a DC++ attack)
• SMTP DDoS
• TCP connection flood on random port

Download DDOSIM here: http://sourceforge.net/projects/ddosim/

Read more about this tool here: http://stormsecurity.wordpress.com/2009/03/03/application-layer-ddos-simulator/

5. R-U-Dead-Yet

R-U-Dead-Yet is a HTTP post DOS attack tool. For short, it is also known as RUDY. It performs a DOS attack with a long form field submission via the POST method. This tool comes with an interactive console menu. It detects forms on a given URL and lets users select which forms and fields should be used for a POST-based DOS attack.

Download RUDY: https://code.google.com/p/r-u-dead-yet/

6. Tor’s Hammer

Tor’s Hammer is another nice DOS testing tool. It is a slow post tool written in Python. This tool has an extra advantage: It can be run through a TOR network to be anonymous while performing the attack. It is an effective tool that can kill Apache or IIS servers in few seconds.

Download TOR’s Hammer here: http://packetstormsecurity.com/files/98831/

7. PyLoris

PyLoris is said to be a testing tool for servers. It can be used to perform DOS attacks on a service. This tool can utilize SOCKS proxies and SSL connections to perform a DOS attack on a server. It can target various protocols, including HTTP, FTP, SMTP, IMAP, and Telnet. The latest version of the tool comes with a simple and easy-to-use GUI. Unlike other traditional DOS attacking tools, this tool directly hits the service.

Download PyLoris: http://sourceforge.net/projects/pyloris/

8. OWASP DOS HTTP POST

It is another nice tool to perform DOS attacks. You can use this tool to check whether your web server is able to defend DOS attack or not. Not only for defense, it can also be used to perform DOS attacks against a website.

Download here: https://code.google.com/p/owasp-dos-http-post/

9. DAVOSET

DAVOSET is yet another nice tool for performing DDOS attacks. The latest version of the tool has added support for cookies along with many other features. You can download DAVOSET for free from Packetstormsecurity.

Download DavoSET: http://packetstormsecurity.com/files/123084/DAVOSET-1.1.3.html

10. GoldenEye HTTP Denial Of Service Tool

GoldenEye is also a simple but effective DOS attacking tool. It was developed in Python for testing DOS attacks, but people also use it as hacking tool.

Download GoldenEye: http://packetstormsecurity.com/files/120966/GoldenEye-HTTP-Denial-Of-Service-Tool.html

Detection and Prevention of Denial of Service Attack

A DOS attack is very dangerous for an organization, so it is important to know and have a setup for preventing one. Defenses against DOS attacks involve detecting and then blocking fake traffic. A more complex attack is hard to block. But there are a few methods that we can use to block normal DOS attack. The easiest way is to use a firewall with allow and deny rules. In simple cases, attacks come from a small number of IP addresses, so you can detect those IP addresses and then add a block rule in the firewall.

But this method will fail in some cases. We know that a firewall comes at a very deep level inside the network hierarchy, so a large amount of traffic may affect the router before reaching the firewall.

Blackholing and sinkholing are newer approaches. Blackholing detects the fake attacking traffic and sends it to a black hole. Sinkholing routes all traffic to a valid IP address where traffic is analyzed. Here, it rejects back packets.

Clean pipes is another recent method of handling DOS attacks. In this method, all traffic is passed through a cleaning center, where, various methods are performed to filter back traffic. Tata Communications, Verisign, and AT&T are the main providers of this kind of protection.

As an Internet user, you should also take care of your system. Hackers can use your system as a part of their zombie network. So, always try to protect your system. Always keep your system up to date with the latest patches. Install a good antivirus solution. Always take care while installing software. Never download software from un-trusted or unknown sources. Many websites serve malicious software to install Trojans in the systems of innocent users.

Learn more about DOS attacks and get hands on experience using these tools in our Ethical Hacking training course. Fill out the form below to receive pricing and course information.

DDoS Attack Script

DDos Attack Script

Denial of service (DoS) and distributed denial of service (DDoS) attacks are an ever present threat to online businesses that can lead to downed websites, lost traffic and damaged client relationships.

DDoS scripts, the software that enables the execution of DDoS attacks, greatly vary in severity, ease of use and potential impact. Python, Perl and PHP are the most common programming languages used to write these scripts.

While some are used for personal rivalries and vandalism, others have been known to cause significant damage to online businesses.

DDoS scripts can be classified into several different types, based on why they were written and what they program computers to do.

Not all DDoS scripts are developed to be malicious. In fact, some are written by white hat hackers as proof of concept (POC) for a newly discovered vulnerability—proving its existence to promote better security practices. However, such scripts are often repurposed for malicious reasons.

Additionally, some DDoS scripts are used as load testing tools in order to identify limitations of a website before it is launched. An example is the ApacheBench tool, which sends a random number of HTTP requests to a server to test the amount of traffic it’s able to handle. These are also known to be repurposed for DoS attacks.

By and large, however, the term “DDoS scripts” refers to malicious software written by black hat hackers. These include DoS scripts executed from a single device, and DDoS toolkits—software packages that infect multiple connected devices, which are then collectively used as a botnet in DDoS attacks.

“I am giving away free DDoS Perl Scripts PM me on Skype...”

Conversation thread on hacker forum.

MAIN DIFFERENCES BETWEEN DDOS ATTACK SCRIPTS AND DDOS TOOLKITS

DDoS attack scripts and DDoS toolkits greatly differ, from the audience for which they are written, to how they are used to perpetrate an attack.

Broadly speaking, these differences are outlined by the following distinctions:

	DDoS Attack Scripts	DDoS Toolkits
Used for	DoS/DDoS attacks	Building a botnet infrastructure for DDoS attacks
Typical authors	White hats/Black hats	Black hats
Typical users	Hobby hackers and script kiddies	Professional hackers
Ease of use	Relatively simple to execute	Typically requires knowledge, time and resources
Attack method	Often from a single source (DoS attack)	Always from multiple sources (DDoS attack)
Typical attack type	Application layer	Network layer
Attacker motivation	Vandalism, hacktivism, personal rivalries	Creation of stresser services and/or DDoS extortion attacks
Threat to organizations	Medium	High

As the chart above shows, toolkits have the potential to inflict significantly more damage than typical DDoS scripts. This is mainly because toolkits are designed to utilize multiple sources to launch a large-scale DDoS attack.

This is not to say that DDoS scripts are harmless–far from it. Their ease of use and widespread availability means that they can be utilized to launch potentially severe attacks.

COMMON DDOS ATTACK SCRIPTS

As previously stated, attack scripts vary based on how they work and what they are capable of doing. Here, we’ll cover some of the most popular scripts and how they are used.

• Low Orbit Ion Cannon (LOIC) - This is a DoS script that disrupts a target server by sending a large number of TCP requests or through a UDP flood. It is very user friendly and doesn’t require extensive knowledge. LOIC has been used in a number of notable attacks, including those targeting the Church of Scientology and the Recording Industry Association of America.
• High Orbit Ion Cannon (HOIC) – Created as a LOIC replacement, this script was designed to launch a DDoS attack using a minimal amount of perpetrators. It works by executing a HTTP floodagainst a target server until it crashes.
The HOIC (High Orbit Ion Cannon) script launches a DDoS attack with a minimal amount of perpetrators
• Slowloris – This is an attack script designed as a simple way for a single computer to take down a server. It works by continuously sending partial HTTP GET requests to its target. The server opens more and more connections in anticipation of receiving the completed requests, which never occur.
• Torshammer – This is a slow-rate, application layer DoS attack script that uses the TOR network to mask its origin. TOR is a network of servers that routes user traffic through a series of tunnels instead of establishing direct connections. It’s used to increase online privacy.
• R-U-Dead-Yet (RUDY)– Similar to Slowloris, R-U-Dead-Yet is a slow-rate, layer-7 attack script. Named after the Finnish death metal band Children of Bodom, the script directs the attack computer to slowly open several connections on the targeted server and to keep them open as long as possible.
The HOIC (High Orbit Ion Cannon) script launches a DDoS attack with a minimal amount of perpetrators
• HTTP Unbearable Load King (HULK) - This script was originally developed as a proof-of-concept to illustrate how easy it is to take down a web server. It works by opening a flood of HTTP GET requests to overwhelm its target. The HULK script is unique in that every request has a random header and URL parameter value in order to bypass a server’s caching engine.

SCRIPT KIDDIES

One of the most significant dangers associated with DoS attack scripts is their ease of use, including by those having little or no knowledge of launching attacks.

An amateur hacker, also known as a “script kiddie,” can easily download DoS attack tools, or copy and paste attack scripts written by experienced peers, so as to attack targets of their choice. Because of their lack of knowledge, script kiddies are often looked down upon by the more experienced hacker community.

While their attacks are often nothing more than attempts to gain attention from their peers, they’re still capable of taking down a mid-sized website. Broadly speaking, most websites aren’t equipped to handle more than 50 – 100 additional requests per second. Run from a single computer, a common DoS tool such as LOIC can generate dozens of request every second with relative ease.

DDOS ATTACK SCRIPT MITIGATION

There are a number of ways Imperva Incapsula is able to protect against attacks generated by both DDoS scripts and toolkits.

Layer 7 attacks are mitigated through our Website Protection service, which deploys the Incapsula CDN in front of your server and reroutes its traffic through our network. Before any traffic is delivered to your server, it’s passed through a series of inspections and is filtered using:

• Client classification
• Visitor whitelisting and reputation
• Web application firewall
• Progressive challenges
• Behavioral anomaly detection

The Incapsula Website Protection service mitigating a massive HTTP flood

Infrastructure Protection is used to protect against layer 3/4 attacks. Once activated via a BGP announcement, traffic is routed through the Incapsula network—with only legitimate traffic being passed to the origin server. This offers unlimited on-demand scalability that can match any volumetric attack.

Infrastructure Protection was used to block a huge NTP amplification attack

DNS-targeted DDoS attacks are mitigated through our Name Server Protection service, which sets up a DNS proxy to inspect incoming DNS requests. Reputation and rate-based security heuristics are used to identify and filter out malicious DNS packets, while legitimate traffic is passed through unimpeded.

DDOS Attack

What Is DDOS Attack?

WHAT DOES DDOS MEAN?

Distributed denial of service (DDoS) attacks are a subclass of denial of service (DoS) attacks. A DDoS attack involves multiple connected online devices, collectively known as a botnet, which are used to overwhelm a target website with fake traffic.

Unlike other kinds of cyberattacks, DDoS assaults don't attempt to breach your security perimeter. Rather, they aim to make your website and servers unavailable to legitimate users. DDoS can also be used as a smokescreen for other malicious activities and to take down security appliances, breaching the target’s security perimeter.

A successful DDoS attack is a highly noticeable event impacting an entire online user base. This makes it a popular weapon of choice for hacktivists, cyber vandals, extortionists and anyone else looking to make a point or champion a cause.

DDoS assaults often last for days, weeks and even months at a time, making them extremely destructive to any online organization. Amongst other things, DDoS attacks can lead to loss of revenues, erode consumer trust, force businesses to spend fortunes in compensations and cause long-term reputation damage.

DOS VS. DDOS

The differences between DoS and DDoS are substantive and worth noting. In a DoS attack, a perpetrator uses a single Internet connection to either exploit a software vulnerability or flood a target with fake requests—usually in an attempt to exhaust server resources (e.g., RAM and CPU).

On the other hand, distributed denial of service (DDoS) attacks are launched from multiple connected devices that are distributed across the Internet. These multi-person, multi-device barrages are generally harder to deflect, mostly due to the sheer volume of devices involved. Unlike single-source DoS attacks, DDoS assaults tend to target the network infrastructure in an attempt to saturate it with huge volumes of traffic.

DDoS attacks also differ in the manner of their execution. Broadly speaking, DoS attacks are launched using homebrewed scripts or DoS tools (e.g., Low Orbit Ion Canon), while DDoS attacks are launched from botnets — large clusters of connected devices (e.g., cellphones, PCs or routers) infected with malware that allows remote control by an attacker.

DENIAL OF SERVICE ATTACK TYPES

DoS attacks can be divided into two general categories:

1. Application layer attacks (a.k.a., layer 7 attacks) can be either DoS or DDoS threats that seek to overload a server by sending a large number of requests requiring resource-intensive handling and processing. Among other attack vectors, this category includes HTTP floods, slow attacks (e.g., Slowloris or RUDY) and DNS query floodattacks.

Gaming website hit with a massive DNS flood, peaking at over 25 million packets per second

The size of application layer attacks is typically measured in requests per second (RPS), with no more than 50 to 100 RPS being required to cripple most mid-sized websites.

2. Network layer attacks (a.k.a., layer 3–4 attacks) are almost always DDoS assaults set up to clog the “pipelines” connecting your network. Attack vectors in this category include UDP flood, SYN flood, NTP amplification and DNS amplification attacks, and more.

Any of these can be used to prevent access to your servers, while also causing severe operational damages, such as account suspension and massive overage charges.

DDoS attacks are almost always high-traffic events, commonly measured in gigabits per second (Gbps) or packets per second (PPS). The largest network layer assaults can exceed 200 Gbps; however, 20 to 40 Gbps are enough to completely shut down most network infrastructures.

ATTACKER MOTIVATIONS

DoS attacks are launched by individuals, businesses and even nation-states, each with their own particular motivation:

Hacktivism – Hacktivists use DoS attacks as a means to express their criticism of everything from governments and politicians, including “big business” and current events. If they disagree with you, your site is going to go down (a.k.a., “tango down”).

Less technically-savvy than other types of attackers, hactivists tend to use premade tools to wage assaults against their targets. Anonymous is perhaps one of the best known hacktivist groups. They’re responsible for the cyberattack in February 2015 against ISIS, following the latter’s terrorist attack against the Paris offices of Charlie Hebdo, as well as the attack against the Brazilian government and World Cup sponsors in June 2014.

Typical assault method: DoS and DDoS

Cyber vandalism – Cyber vandals are often referred to as “script kiddies”—for their reliance on premade scripts and tools to cause grief to their fellow Internet citizens. These vandals are often bored teenagers looking for an adrenaline rush, or seeking to vent their anger or frustration against an institution (e.g., school) or person they feel has wronged them. Some are , of course, just looking for attention and the respect of their peers.

Alongside premade tools and scripts, cyber vandals will also result to using DDoS-for-hire services (a.k.a., booters or stressers), which can purchased online for as little as $19 a pop.

Typical assault method: DoS and DDoS

Example of booter advertised prices and capacities.

Extortion – An increasingly popular motivation for DDoS attacks is extortion, meaning a cybercriminal demands money in exchange for stopping (or not carrying out) a crippling DDoS attack. Several prominent online software companies—including MeetUp, Bitly, Vimeo, and Basecamp—have been on the receiving end of these DDoS notes, some going offline after refusing to succumb to the extortionists’ threats.

Similar to cyber vandalism, this type of attack is enabled by the existence of stresser and booter services.

Typical assault method: DDoS

Personal rivalry – DoS attacks can be used to settle personal scores or to disrupt online competitions. Such assaults often occur in the context of multiplayer online games, where players launch DDoS barrages against one another, and even against gaming servers, to gain an edge or to avoid imminent defeat by “flipping the table.”

Attacks against players are often DoS assaults, executed with widely available malicious software. Conversely, attacks against gaming servers are likely to be DDoS assaults, launched from stressers and booters .

Typical assault method: DoS, DDoS

Business competition – DDoS attacks are increasingly being used as a competitive business tool. Some of these assaults are designed to keep a competitor from participating in a significant event (e.g., Cyber Monday), while others are launched with a goal of completely shutting down online businesses for months.

One way or another, the idea is to cause disruption that will encourage your customers to flock to the competitor while also causing financial and reputational damage. An average cost of a DDoS attack to an organization can run $40,000 per hour.

Business-feud attacks are often well funded and executed by professional "hired guns," who conduct early reconnaissance and use proprietary tools and resources to sustain extremely aggressive and persistent DDoS attacks .

Typical assault method: DDoS

Cyber warfare – State-sponsored DDoS attacks are being used to silence government critics and internal opposition, as well as a means to disrupt critical financial, health and infrastructure services in enemy countries.

These attacks are backed by nation-states, meaning they are well-funded and orchestrated campaigns that are executed by tech-savvy professionals.

Typical assault method: DDoS

PREPARING FOR DOS ATTACKS

You can’t prevent DoS assaults. The fact is that cybercriminals are going to attack. Some are going to hit their targets, regardless of the defenses in place.

However, there are steps you can take to spot a brewing storm, including:

• Monitoring your traffic to look for abnormalities, including unexplained traffic spikes and visits from suspect IP address and geolocations. All of these could be signs of attackers performing “dry runs” to test your defenses before committing to a full-fledged attack. Recognizing these for what they are can help you prepare for the onslaught to follow.
• Keep an eye on social media (particularly Twitter) and public wastebins (e.g., Pastebin.com) for threats, conversations and boasts that may hint on an incoming attack.
• Consider using third-party DDoS testing (i.e., pen testing) to simulate an attack against your IT infrastructure so you can be prepared when the moment of truth arrives. When you undertake this, test against a wide variety of attacks, not just those with which you are familiar.
• Create a response plan and a rapid response team, meaning a designated group of people whose job is to minimize the impact of an assault. When you plan, put in place procedures for your customer support and communication teams, not just for your IT professionals.

CHOOSING THE RIGHT MITIGATION STRATEGY

"If you spend more on coffee than on IT security, you will be hacked. What’s more, you deserve to be hacked.”

Richard Clarke - National Security Council (NSC)

This first step in preparing your organization to deal with a DDoS incident is to assess your risk. Important basic questions include:

• Which infrastructure assets need protection?
• What are the soft spots, or single points of failure?
• What is required to take them down?
• How and when will you know you’re targeted? Will it be too late?
• What are the impacts (financial and otherwise) of an extended outage?

Armed with this information, it’s then time to prioritize your concerns, examining various mitigation options within the framework of your security budget.

If you’re running a commercial website or online applications (e.g., SaaS applications, online banking, e-commerce), you’re probably going to want 24×7, always-on protection. A large law firm, on the other hand, may be more interested in protecting its infrastructure—including email servers, FTP servers, and back office platforms—than its website. This type of business may opt for an ”on demand“ solution.

The second step is to choose the method of deployment. The most common and effective way to deploy on-demand DDoS protection for your core infrastructure services across an entire subnet is via border gateway protocol (BGP) routing. However, this will only work on demand, requiring you to manually activate the security solution in case of an attack.

Consequently, if you’re in need of an always-on DDoS protection for your web application, you should use DNS redirection to reroute all website traffic (HTTP/HTTPS) through your DDoS protection provider’s network (usually integrated with a content delivery network,). The advantage of this solution is that most CDNs offer on-call scalability to absorb volumetric attacks, at the same time minimizing latency and accelerating content delivery.

Mitigating Network Layer Attacks

Dealing with network layer attacks required requires additional scalability—beyond what your own network can offer.

Consequently, in the event of an assault, a BGP announcement is made to ensure that all incoming traffic is routed through a set of scrubbing centers. Each of these has the capacity to process hundreds of Gbps worth of traffic. Powerful servers located in the scrubbing centers will then filter out malicious packets, only forwarding the clean traffic to the origin server through a GRE tunnel.

This method of mitigation provides protection against direct-to-IP attacks and is usually compatible with all types of infrastructures and communication protocols (e.g., UDP, SMTP, FTP, VoIP).

Protecting against a NTP amplification attack: 180Gbps and 50 million packets per secondMitigating Application Layer Attacks

Mitigation of application layer attacks relies on traffic profiling solutions that can scale on demand, while also being able to distinguish between malicious bots and legitimate website visitors.

For traffic profiling, best practices call for signature-based and behavior-based heuristics, combined with IP reputation scoring and a progressive use of security challenges (e.g., JS and cookie challenges).

Together, these accurately filter out malicious bot traffic, protecting against application layer attacks without any impact to your legitimate visitors.

SQL Injection

SQL Injection : How It Works

Introduction

Lets get started at an apparently unrelated point. Lets assume we create a table in SQL. Now there are three main parts of a database management system, like SQL. They are -

• Creating structure of table
• Entering data
• Making queries (and getting meaningful results from data)

So, when SQL is used to display data on a web page, it is common to let web users input their own queries. For example, if you go to a shopping website to buy a smartphone, you might want to specify what kind of smartphone you want. The site would probably be storing data about phones in table with columns like Name, Price, Company, Screen Size, OS, etc.
Now what they do is that they allow you to create a query using some sort of user friendly drop down based form which lets you select your budget, preferred company, etc. So basically, you, the user, can create queries and request data from their SQL servers without typing any code. 

This automated method of creating queries for you is relatively safe (since it doesn't give you a lot of flexibility in terms of what queries you can create, you are limited by the syntax of queries they have decided). However, there is another method of creating queries which can be exploited by us. 

A url ending in .php is a direct indication that the website/blog uses sql to deliver a lot of it's data, and that you can execute queries directly by changing the url. Usually the data in the SQL tables is protected and can be viewed directly only by certain people (admins etc.). However, when we send some rogue commands to the SQL server, it doesn't understand what to do, and returns an error.
This is a clear indication that with intelligent design of URLs, we can send queries that will make the database 'go berserk' and malfunction, and give us all the otherwise private data of its tables. This attack can be used to obtain confidential data like a list of username and passwords of all users on a website.

Steps

1. We have to find a website which is vulnerable to SQL injection (SQLi) attacks. Vulnerability has 2 criteria. Firstly, it has to allow execution of queries from the url, and secondly, it should show an error for some kind of query or the other. An error is an indication of a SQL vulnerability.
2. After we know that a site is vulnerable, we need to execute a few queries to know what all makes it act in an unexpected manner. Then we should obtain information about SQL version and the number of tables in database and columns in the tables.
3. Finally we have to extract the information from the tables.

Vulnerabilities are found using your own creativity along with famous dorks (more on this in a later tutorial)

For the 2nd and 3rd step, there are 2 ways to do them-

• Manually using some standard codes available online (and if you know SQL then you can figure most of the stuff out yourself). For example, you can instruct the database to give you all the data from a table by executing the command- 

SELECT * FROM Users WHERE UserId = 105 or 1=1

Now, while the first part of the query "UserID=105" may not be true for all user, the condition 1=1 will always be true. Basically the query asks the table to return all details of users for whom either user id = 105 or 1=1 (1 is always equal to 1, irrespective of the userId and all other factors). Effectively, you have the username and passwords and all other information about all the users of the website.

• Using some tool - Some tools help in making the process easier. You still have to use commands but using tools is much more practical after you have an idea what is actually happening. I don't recommend all the GUI Windows tools which are found on malware filled websites, and never work. All throughout this blog we have used Kali Linux, and if you really are serious about hacking, there is no reason not to have Kali Linux installed. In Kali Linux, there is a great tool called SQLMap that we'll be using.

Quick cool example

Now suppose you develop a web app. Here are the credentials for login-

Username : abcd

Password : xyz

Now, for login, you have the following condition:

if ("abcd" == Username and "xyz" == Password) 

    LoginSuccessful

else

    LoginFailed

Now if someone enters Username which is different from abcd or password which is different from xyz, then he won't be able to login. Seems to be fine.

But wait, if a person enter username as "pqr" or 1==1 and password as "wxy" or 1==1, your code would check credentials in the following way -

("abcd"=="pqr" or 1==1) and ("xyz" == "wxy" or 1==1)

Let's translate that into boolean. 1==1 is true obviously, abcd==pqr is not true, nor is xyz==wxy. So, we get,

(false or true) and (false or true)

which becomes

true and true

which becomes

true

So, the person logged into your web app without knowing the username or password.

PS: The example here grossly simplifies a lot of things, but taking care of all details would make this more complicated than it has to be for a first tutorial in SQL injection (coming tutorials are more syntactically correct).

The first command is legit and gives you access to data of srinivas only, and only in the condition where the password is correct. The second statement gives you access to data of all accounts.

That's it for this tutorial, you now know how SQL Injections work. It might be worth your time learning some SQL on W3schools till I come up with some other tutorial. Also, check out the navigation bar at the top of the blog to see if you find something that interests you. We have a lot of tutorials for beginners in the field of hacking.