DarkMYSQLi- MYSQL Injection Tool Tutorial

SQL injection is one the most common bug or vulnerability in a web application that can easily be exploit, there are mainly two ways to exploit SQL injection one is manually and other is by using automatic tools. Manual process takes time and it is a slow process but remember manual process is reliable because there are so many cases out there in which automatic tools can be fail. Automatic tools to exploit SQL injection are fast, user friendly and usually don’t need any technical knowledge and skills.

Automatic tools are easy and even a newbie can use and exploit a web application server by using SQL injection, automatic tools are available for different operating system like Havij is a SQL injection tool that are used in Windows. For Linux we can use SQLmap but sqlmap is a python script so we can use it on windows too. Beside these wonderful tools there is another tool called Darkmysqli.

What Is DarkmySqli ?

Darkmysqli is a python script and a multiple purpose MYSQL injection tool. This tool allow an attacker to exploit SQL injection error on a web application.
Darkmysqli is also available on Backtrack 5 and if you are using backtrack 5 than you can use this path to open the tool.
Application –> Backtrack ? Exploitation tools ? Web exploitation tools ? darkmysqli

MYSQL Injection Using Darkmysqli Tutorial

First of all you need to understand that darkmysqli is a exploitation tool than can exploit the vulnerability, so if you want to darkmysqli first find a vulnerability on a web application. There are many tools available on to find a vulnerability on a web application.

So let suppose we have a website that is vulnerable like:
First of all we need to find column so use the command like show in the picture.


Now at this time it is good to use full scan to get the database name, number of rows and column, MYSQL version and so on.

python ./DarkMySQLi.py -u http://www.webscantest.com/datastore/search_get_by_id.php?id=4+AND+1=2+UNION+SELECT+darkc0de,darkc0de,darkc0de,darkc0de– -D scanme -T accounts -C id,uname,passwd,fname,lname –dump

On the above picture you can see the admin ID and password that is in the hash you can crack it.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

How to Install Kali Linux on VirtualBox [Windows Host] in 2020

Kali Linux is a Debian based Linux distribution, released on the 13th March 2013 as a complete rebuild of BackTrack Linux. It is one of...

Acunetix v13 Release Introduces Groundbreaking Innovations

The newest release of the Acunetix Web Vulnerability Scanner further improves performance and premieres best-of-breed technologies London, United Kingdom – February 5, 2019 – Acunetix,...

What is Ethical Hacking, how to be an Ethical Hacker

Hacking is the process of discovering vulnerabilities in a system and using these found vulnerabilities by gaining unauthorized access into the system to perform...

Basic steps to ensure security Online!

Security concerns are growing day by day due to the growing interconnectivity and technology. Drastic things can happen if you be a little careless...