SQL Injection Tutorial [Union Based]
Hi folks..This time I m posting a good Sql injection tutorial by End3r,which I found quite interesting to read and a Gem to share. This SQL injection tutorial will clear your most of sql injection doubts and will cleanly phase in an attack strategy for you. SQL Injection is defined byhttp://www.h-spot.net/threat_glossary.htm as:
Background Information
Some commands you will need to know:
Injection SQL Queries into URL Parameters
So you've found a site: '
and want to test if it's vulnerable to SQL Injections. Begin by checking if you can execute some of your own queries, so try:
If after executing the above statement, nothing has happened and the page has remained the same, you can try:
If neither of those work, for the purposes of this tutorial move on to another site. Otherwise, if a blank page showed up you just might be in luck!
Now we want to find how many columns and which ones are showing when the select statement is executed so we use:
If you get an error decrement the number 20, if there is no error continue incrementing until you get one and then the number just before your error is the number of columns in the table you're selecting from.
returns an error, then we know that there are 15 columns in our select statement.
The next statement will null the id=5 so the script only executes our commands and not it's own, and show us which columns we can extract data from:
The comment comments out anything the script would append to the end of the statement so that only our statement is looked at.
So now look at the page and if you see any of the numbers you just typed in, you know those columns are showing, and we can gather information from them. For this example let's pretend columns 5, 7, and 9 are showing.
Now we can begin gathering information!
As you can see we selected values from the showing columns, what if we want to clean this up a bit, and put all of those selected values in one column? This is where concat() comes in:
Now look at your page, user(), database(), and version() are all in one place, and are separated by a colon this demonstrates the use of concat() and char().
The user() will usually give something like username@localhost, but you may get lucky and get username@ipaddresshere, in this instance you can try to brute force the FTP login. The version would help you look up exploits for that version of the database() in use--but only if you're a skiddy!
Before we can check if we have load_file perms, we must get an FPD (Full Path Disclosure) so we know exactly where the files are located that we're trying to open. Below are some methods to get an FPD:
You could attempt to Google the full path of the site by trying something like "/home/sitename" and hoping that you'll find something in Google
Session Cookie Trick
Thanks to haZed at enigmagroup.org. In the url type:
This will give a session_start() error and an FPD.
Now we will attempt to use load_file(), this example will load the .htaccess file, make sure you know the file you're trying to load actually exists or you may miss out on your opportunity to realize what great perms you have:
If you see the .htaccess file, congrats! You have load_file() perms. Now try to load include files such as config.inc.php for database usernames and passwords, hoping that the admin is dumb enough to use the same username and password for ftp. Another idea would be to load .htpasswd after finding it's location from .htaccess and then logging in to all the password-protected areas that you want to on the site.
If you don't see the .htaccess file, I will include one more way to extract info by using sql injections.
Using information_schema.tables
So you don't have load_file() perms? No problem, we can check for information_schema.tables.
1) 'table_name' is the name of a table that exists in all information_schema tables on every site:
If the site is showing information_schema.tables, the words 'CHARACTER_SETS' will appear in column 5. What can I do with CHARACTER_SETS you might be wondering. Well, nothing that I'm going to show you, but you can find out other tables that exist on the site. The information_schema.tables contains a list of every table in the database on the site, so you can pull up the table username and maybe password if they exist...Then what do you think the information_schema.columns hold? That's right, a list of all the columns on the site. So rather than using just the above injection you could try any of the following:
Selects all 'distinct' table names from information_schema.tables, meaning it will print out all tables at one time
Selects all tables and columns that go with each table seperated by a colon
2) If none of the above queries give you anything except for 'CHARACTER_SETS' you will have to use enumeration to determine the names of the other tables:
Then it would show the next table in line so you would modify the above to say:
Until no more tables show, then you can do the same for the columns.
3) Now after you've executed one or all of those statements, let's say you found the table 'users' and it has the columns 'username', 'password', 'id', and 'email'. To extract that info from the table, use:
And you'll get the info you requested, of course you can modify that as you like such as:
Replacing Admin with the top user's name such as admin or owner etc..
Final Tips
With any luck, one of these methods has worked for you and you were able to accomplish your goal. However, if none of them worked, you can start guessing common table names and then columns:
If the page shows up, you know the table exists and you can start guessing column names:
If you get a username, good job you guessed a correct table and column, otherwise keep guessing.
Filter Evasion Techniques
As End3r summarises it -
Background Information
- It is considered the most common web vulnerability today
- It's a flaw in the web application--not the db, or the server
- Can be injected into: Cookies, Forms, and URL parameters
- This lesson uses MySQL syntax for all examples.
- This lesson does not provide reasons for why sites are vulnerable, simply how to exploit them
- This lesson only provides sql injection examples for url parameters such it is such a large subject on it's own
- This lesson gives small examples of filter evasion techniques
Some commands you will need to know:
Injection SQL Queries into URL Parameters
So you've found a site: '
and want to test if it's vulnerable to SQL Injections. Begin by checking if you can execute some of your own queries, so try:
If after executing the above statement, nothing has happened and the page has remained the same, you can try:
If neither of those work, for the purposes of this tutorial move on to another site. Otherwise, if a blank page showed up you just might be in luck!
Now we want to find how many columns and which ones are showing when the select statement is executed so we use:
If you get an error decrement the number 20, if there is no error continue incrementing until you get one and then the number just before your error is the number of columns in the table you're selecting from.
returns an error, then we know that there are 15 columns in our select statement.
The next statement will null the id=5 so the script only executes our commands and not it's own, and show us which columns we can extract data from:
The comment comments out anything the script would append to the end of the statement so that only our statement is looked at.
So now look at the page and if you see any of the numbers you just typed in, you know those columns are showing, and we can gather information from them. For this example let's pretend columns 5, 7, and 9 are showing.
Now we can begin gathering information!
As you can see we selected values from the showing columns, what if we want to clean this up a bit, and put all of those selected values in one column? This is where concat() comes in:
Now look at your page, user(), database(), and version() are all in one place, and are separated by a colon this demonstrates the use of concat() and char().
The user() will usually give something like username@localhost, but you may get lucky and get username@ipaddresshere, in this instance you can try to brute force the FTP login. The version would help you look up exploits for that version of the database() in use--but only if you're a skiddy!
Before we can check if we have load_file perms, we must get an FPD (Full Path Disclosure) so we know exactly where the files are located that we're trying to open. Below are some methods to get an FPD:
You could attempt to Google the full path of the site by trying something like "/home/sitename" and hoping that you'll find something in Google
Session Cookie Trick
Thanks to haZed at enigmagroup.org. In the url type:
This will give a session_start() error and an FPD.
Now we will attempt to use load_file(), this example will load the .htaccess file, make sure you know the file you're trying to load actually exists or you may miss out on your opportunity to realize what great perms you have:
If you see the .htaccess file, congrats! You have load_file() perms. Now try to load include files such as config.inc.php for database usernames and passwords, hoping that the admin is dumb enough to use the same username and password for ftp. Another idea would be to load .htpasswd after finding it's location from .htaccess and then logging in to all the password-protected areas that you want to on the site.
If you don't see the .htaccess file, I will include one more way to extract info by using sql injections.
Using information_schema.tables
So you don't have load_file() perms? No problem, we can check for information_schema.tables.
1) 'table_name' is the name of a table that exists in all information_schema tables on every site:
If the site is showing information_schema.tables, the words 'CHARACTER_SETS' will appear in column 5. What can I do with CHARACTER_SETS you might be wondering. Well, nothing that I'm going to show you, but you can find out other tables that exist on the site. The information_schema.tables contains a list of every table in the database on the site, so you can pull up the table username and maybe password if they exist...Then what do you think the information_schema.columns hold? That's right, a list of all the columns on the site. So rather than using just the above injection you could try any of the following:
Selects all 'distinct' table names from information_schema.tables, meaning it will print out all tables at one time
Selects all tables and columns that go with each table seperated by a colon
2) If none of the above queries give you anything except for 'CHARACTER_SETS' you will have to use enumeration to determine the names of the other tables:
Then it would show the next table in line so you would modify the above to say:
Until no more tables show, then you can do the same for the columns.
3) Now after you've executed one or all of those statements, let's say you found the table 'users' and it has the columns 'username', 'password', 'id', and 'email'. To extract that info from the table, use:
And you'll get the info you requested, of course you can modify that as you like such as:
Replacing Admin with the top user's name such as admin or owner etc..
Final Tips
With any luck, one of these methods has worked for you and you were able to accomplish your goal. However, if none of them worked, you can start guessing common table names and then columns:
If the page shows up, you know the table exists and you can start guessing column names:
If you get a username, good job you guessed a correct table and column, otherwise keep guessing.
Filter Evasion Techniques
- You can URL Encode characters, hex encode them, use any encoding you like as long as your browser can interpret it
- Rather then using 'union all select' try 'UniON aLL SeLECt' to see if the filter checks case
- Try using the plus sign to split words up: ' 'uni'+'on'+' '+'all'+' '+'Se'+'lect'
- Combine the methods mentioned above using different cases, the plus operator, and not just text but encoding as well
- Be creative
As End3r summarises it -
Comments
Post a Comment