How I Hacked My College (PART 2)

Hello Everyone, here is the second part SQL INJECTION where I was able to get the complete database of my college. This story is about the challenge I got from one of the head of my System Department Saying “You can’t do anything, you will just sit in college and do small things…”. I think everyone should understand the importance of Security If someone doesn’t understand make them because this is the way we are protected from cybercriminals and cyber attacks.

I accepted the Challenge “I said nothing to him and went back to my work”. I started thinking, My Challenge for myself was to make him aware of Cyber Security not to prove him what I can do because whatever he said was just because I used to go to him and tell him this is not Secure we can hack it easily you need to improve security here and they were like okay we will do but, no one did the work so I did.

SQL INJECTION — Story Of My Challenge

I directly started hunting for SQL INJECTION, because I wanted to have the databases which were very critical for them and me too. It was almost more than 2 hours but I didn’t get anything but I didn't stop. Finally, I got one website xyz.redacted.com “Sorry I can’t disclose the website so I am using as redacted.com”. There was an option to Search Books :P

I started injecting SQL Queries to this search options and in one of the XYZ field I got a blank response, and I was like

I started Burpsuite and started injecting SQL Queries to that XYZ field again I got no response in Burpsuite too, every field was giving proper response but this XYZ was failed and I was like yes maybe BLIND SQL INJECTION here!!

I opened my SQLMAP you can download here, and started my Testing.

What is SQLMAP?

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

After 3 hours I got the message saying the “Parameter is Vulnerable” and I was