So lets begin.
I will use this 0day here by JoinSeventh.

First of all we need to find a vulnerable page.
We enter this in Google:

When you found your site you need to find admin email and username.
I will be using this site for example:

When i add ' text disappears so it is vulnerable.



NOTE: I will not demonstrate how to SQL inject.

Now we need admin username and email.
We need to inject:

Now we have 2 users.



We pick one and copy his email.
Go to the login page of the site.
It is usually here:

And press "Lost your password?"



Now you enter either username or email.
We can enter both so it doesnt matter.
I entered email.




Now when you got:

"Check your e-mail for the confirmation link."

It means that reset key is successfully sent.
Now we need to get the activation key.

Go back to the syntax you used for extracting email and username and do this:

Voila!
Now we just need to reset it.

Go to:

NOTE: Replace key= & login=

So my link will be:



Enter new password:




Login with new password and shell it.
http://www.hackforums.net/showthread.php?tid=2405188
That's it guys.