DarkMYSQLi- MYSQL Injection Tool Tutorial

SQL injection is one the most common bug or vulnerability in a web application that can easily be exploit, there are mainly two ways to exploit SQL injection one is manually and other is by using automatic tools. Manual process takes time and it is a slow process but remember manual process is reliable because there are so many cases out there in which automatic tools can be fail. Automatic tools to exploit SQL injection are fast, user friendly and usually don’t need any technical knowledge and skills.

Automatic tools are easy and even a newbie can use and exploit a web application server by using SQL injection, automatic tools are available for different operating system like Havij is a SQL injection tool that are used in Windows. For Linux we can use SQLmap but sqlmap is a python script so we can use it on windows too. Beside these wonderful tools there is another tool called Darkmysqli.

What Is DarkmySqli ?

Darkmysqli is a python script and a multiple purpose MYSQL injection tool. This tool allow an attacker to exploit SQL injection error on a web application.
Darkmysqli is also available on Backtrack 5 and if you are using backtrack 5 than you can use this path to open the tool.
Application –> Backtrack ? Exploitation tools ? Web exploitation tools ? darkmysqli

MYSQL Injection Using Darkmysqli Tutorial

First of all you need to understand that darkmysqli is a exploitation tool than can exploit the vulnerability, so if you want to darkmysqli first find a vulnerability on a web application. There are many tools available on to find a vulnerability on a web application.

So let suppose we have a website that is vulnerable like:
First of all we need to find column so use the command like show in the picture.


Now at this time it is good to use full scan to get the database name, number of rows and column, MYSQL version and so on.

python ./DarkMySQLi.py -u http://www.webscantest.com/datastore/search_get_by_id.php?id=4+AND+1=2+UNION+SELECT+darkc0de,darkc0de,darkc0de,darkc0de– -D scanme -T accounts -C id,uname,passwd,fname,lname –dump

On the above picture you can see the admin ID and password that is in the hash you can crack it.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Top 5 Techniques Hackers Use to hack Social Media Accounts

These days, Social Media have become a significant need in our everyday life. It encourages us to associate and connect with anyone over the...

5 Top Programming Languages for Hacking

We live in the 21st century, which is very fast-changing. This is a century of competition for information and computing resources. Every year the...

OSINT Tutorial to Track An Aircraft And Flight Information In Real-Time

No doubt Internet is said to be the world's largest repository of data and information. It contains an enormous amount of data related to...

Preventing SQL Injection in PHP Applications

SQL injection is one of the most common cybersecurity threats and as the name suggests, it is a form of injection attack. Injection attacks, on...