CIP Cyber

DarkMYSQLi- MYSQL Injection Tool Tutorial

Table of Contents

SQL injection is one the most common bug or vulnerability in a web application that can easily be exploit, there are mainly two ways to exploit SQL injection one is manually and other is by using automatic tools. Manual process takes time and it is a slow process but remember manual process is reliable because there are so many cases out there in which automatic tools can be fail. Automatic tools to exploit SQL injection are fast, user friendly and usually don’t need any technical knowledge and skills.

Automatic tools are easy and even a newbie can use and exploit a web application server by using SQL injection, automatic tools are available for different operating system like Havij is a SQL injection tool that are used in Windows. For Linux we can use SQLmap but sqlmap is a python script so we can use it on windows too. Beside these wonderful tools there is another tool called Darkmysqli.

What Is DarkmySqli ?

Darkmysqli is a python script and a multiple purpose MYSQL injection tool. This tool allow an attacker to exploit SQL injection error on a web application.
Darkmysqli is also available on Backtrack 5 and if you are using backtrack 5 than you can use this path to open the tool.
Application –> Backtrack ? Exploitation tools ? Web exploitation tools ? darkmysqli

MYSQL Injection Using Darkmysqli Tutorial

First of all you need to understand that darkmysqli is a exploitation tool than can exploit the vulnerability, so if you want to darkmysqli first find a vulnerability on a web application. There are many tools available on to find a vulnerability on a web application.

So let suppose we have a website that is vulnerable like:
First of all we need to find column so use the command like show in the picture.


Now at this time it is good to use full scan to get the database name, number of rows and column, MYSQL version and so on.

python ./DarkMySQLi.py -u http://www.webscantest.com/datastore/search_get_by_id.php?id=4+AND+1=2+UNION+SELECT+darkc0de,darkc0de,darkc0de,darkc0de– -D scanme -T accounts -C id,uname,passwd,fname,lname –dump

On the above picture you can see the admin ID and password that is in the hash you can crack it.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

What Proxies Are For

When you cannot access certain sites or hide your identity, you need a tool for that. For example, the USA proxies are in demand among

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings