DarkMYSQLi- MYSQL Injection Tool Tutorial

SQL injection is one the most common bug or vulnerability in a web application that can easily be exploit, there are mainly two ways to exploit SQL injection one is manually and other is by using automatic tools. Manual process takes time and it is a slow process but remember manual process is reliable because there are so many cases out there in which automatic tools can be fail. Automatic tools to exploit SQL injection are fast, user friendly and usually don’t need any technical knowledge and skills.

Automatic tools are easy and even a newbie can use and exploit a web application server by using SQL injection, automatic tools are available for different operating system like Havij is a SQL injection tool that are used in Windows. For Linux we can use SQLmap but sqlmap is a python script so we can use it on windows too. Beside these wonderful tools there is another tool called Darkmysqli.

What Is DarkmySqli ?

Darkmysqli is a python script and a multiple purpose MYSQL injection tool. This tool allow an attacker to exploit SQL injection error on a web application.
Darkmysqli is also available on Backtrack 5 and if you are using backtrack 5 than you can use this path to open the tool.
Application –> Backtrack ? Exploitation tools ? Web exploitation tools ? darkmysqli

MYSQL Injection Using Darkmysqli Tutorial

First of all you need to understand that darkmysqli is a exploitation tool than can exploit the vulnerability, so if you want to darkmysqli first find a vulnerability on a web application. There are many tools available on to find a vulnerability on a web application.

So let suppose we have a website that is vulnerable like:
First of all we need to find column so use the command like show in the picture.


Now at this time it is good to use full scan to get the database name, number of rows and column, MYSQL version and so on.

python ./DarkMySQLi.py -u http://www.webscantest.com/datastore/search_get_by_id.php?id=4+AND+1=2+UNION+SELECT+darkc0de,darkc0de,darkc0de,darkc0de– -D scanme -T accounts -C id,uname,passwd,fname,lname –dump

On the above picture you can see the admin ID and password that is in the hash you can crack it.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Top 10 things to Do After Installing Kali Linux

Kali Linux is considered to be one of the best hacking distribution of this era, it is developed by Offensive Security to give an...

Become a spy in your own right with Xnspy Android spying app

Having become widely popular among parents and employers, spying apps have become quite the norm nowadays. Android spying apps have made it a lot...

e-Services Portals Potentially Expose Government Infrastructure to File-based Attacks

More and more users are embracing technology to perform their day-to-day activities. It’s not only private businesses that are forced to establish digital channels...

What is Nmap? How to use Nmap for Information Gathering

Nmap stands for Network Mapper, a powerful network scanning and host detection tool that is being used to perform reconnaissance in a very first...