20/02/2026
Let's Practice Manual SQL Injection:
For manual sql injection we need finding a dynamic website.If a website contains parameters and values, it is generally referred to as a dynamic website. This is because dynamic websites can change or display content based on user input or preferences.For example:
A URL: example.com/product?id=101
Here, id is the parameter, and 101 is its value.This informs the server that the user wants to view information about the product with ID 101.
Identify a dynamic website that uses an SQL-based database. Test the URL by adding a single quote (') or double quote (") at the end of a parameter to check for SQL injection vulnerabilities.
Detect the Number of Columns,Use the ORDER BY clause to determine the number of columns.
Example: http://example.com/index.php?id=1 ORDER BY 1--
Increase the number (e.g., ORDER BY 2--, ORDER BY 3--) until an error occurs. The last successful number indicates the total columns.
Use the UNION SELECT statement to find columns that display data.
Example: http://example.com/index.php?id=1 UNION SELECT 1,2,3--
Replace the numbers with data (e.g., strings or null) until visible columns are identified.
Identify vulnerable column and remove the column to check version use version().Dump the database using dios(dump in one shot).Dump user and password. These steps are following for attacking.
Union based > DIOS My SQL > DIOS by zen > Zen waf (if it not worked then try another one)
For Example:
http://theory.cse.iitm.ac.in/viewevent.php?type=news&id=-45 Union Select 1,concat(username,0x3d3d,password),3,4 from admin