Edit

Testing for SQL

Page currently under construction, pardon our dust

  • All credit goes to: https://guide.offsecnewbie.com/5-sql

Create an Error

  • If the server is being weird with sql like queries you might have found an injection point

  • Now you need to figure out how to inject data in the query without creating an error. To do so you first need to find how to escape from the current context:

  • Try these characters

     [Nothing]
'
"
`
')
")
`)
'))
"))
`))

  • Then, you need to know how to fix the query so there isn't errors.

  • In order to fix the query you can input data so the previous query accept the new data, or you can just input your data and add a comment symbol add the end.

  • Note that if you can see error messages or you can spot differences when a query is working and when it's not this phase will be more easy.

    Comments

    MySQL
#comment
-- comment     [Note the space after the double dash]
/*comment*/
/*! MYSQL Special SQL */

PostgreSQL
--comment
/*comment*/

MSQL
--comment
/*comment*/

Oracle
--comment

SQLite
--comment
/*comment*/

HQL
HQL does not support comments

  • Source for above paragraph: https://book.hacktricks.xyz/pentesting-web/sql-injection

3306 Remotely

  • If you have root access remotely like the example above you can get access to the user's wordpress password. alt text

  • If you can not crack the password you can change it to something you know - in fact just change the pass to something you know eg

  • alt text

  • alt text

Identifying SQL Injection

  • Let's say that you have some site like this

  • Or a form like this

  • alt text

  • Now to test if it is vulnerable you add to the end of url ' (quote).

  • If you get an error like:

  • "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..." or something similar

  • That means its vulnerable !

  • Find the number of columns

  • To find number of columns you use statement ORDER BY (tells database how to order the result) so how to use it? Well just increment the number until you get an error.

  • That means that the database has 3 columns, cause you get an error on 4.

Check for UNION function

  • With union you can select more data in one SQL statement.

  • So you have:

  • If that doesn't work or you get some error, then try:

  • The dashes tells SQL not to process anything passed the 3, in the case above.

  • If you see some numbers on screen, i.e 1 or 2 or 3 then the UNION works!!

Check for MySQL version

  • Lets say that you have number 2 on the screen, now to check for version

  • You replace the number 2 with @@version or version() and get something like 4.1.33-log or 5.0.45 or similar.

  • It should look like:

  • If you get an error:

  • You need the convert() function

  • Or with hex() and unhex()

  • And you will get the MySQL version

Generic Bypasses

  • Blacklist using keywords - bypass using uppercase/lowercase

  • Blacklist using keywords case insensitive - bypass using an equivalent operator

Getting table and column name

  • If the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) you must guess the table and column names

  • Common table names are:

  • Common column names are:

  • For example:

  • If you see number 2 on the screen like before, then that's good, you know that there is a table called admin in the database. Else try another table name.

  • Now to check column names:

  • If you get an error, then try the other column name

  • You will hopefully see the password on the screen in hash or plain-text, it depends of how the database is set up. For example i.e md5 hash, mysql hash, sha1...

  • Now you must complete query to look nice for that you can use concat() function (it joins strings).

  • Note that I put 0x3a, its hex value for : (so 0x3a is hex value for colon)

  • There is another way to do that, char(58), ascii value for a colon

  • Now you get displayed username:password on screen, i.e admin:admin or admin:somehash when you have this, you can login like admin or some superuser :D if can't guess the right table name, you can always try mysql.user (default) it has user and password columns, so an example would be

Test number of columns and Watch for any Error

Test Injectable columns - Watch for visual Indicators (WAF filters)

Enumerate Information

Enumerate Database

Enumerate Tables

Enumerate Columns

Enumerate RAW Data

Confirm MYSQL version - If Returns true then end value is true

  • Test if subset works - If returns True then subset works

  • Test if subset works, test for mysql.user - If returns True then subset works

Injection

Adding Gaps between requests

MsSql blind exploitation

  • For numeric contexts (look for differences):

  • Once we found the injection, we can leak data from the DB by guessing one character at a time as follows:

  • If it is true, we know the db_name starts with 109(m).

  • Ask if the first character of the user is 'a':

  • Check if the admin table exists:

  • Finding number of columns using ORDER BY

  • We can use order by to sort the result by a given column number, if the column does not exist, we will get an error:

  • MySql UNION code execution

  • Joins the result of two queries

  • Two queries should return the same # of columns.

  • Data-types in columns of the select must be of the same orcompatible type.

  • Once you have the right number of columns (i.e. 3) you can find the mysql version:

  • mysql users:

  • If the result displays garbage from the first query, you can add a false condition to only show the union result AND 1=0 UNION...

  • Read files

  • Write files

  • Other payloads:

SQLMap

  • The best tool out there for automating SQLi

  • Can be used with Zap or Burp as a proxy, standalone, or fed a request from Zap or Burp

Useful Automation Flags

  • In order to not have to answer its prompts, append --batch

  • To put sqlmap in easy mode append --wizard

Opsec

  • sqlmap uses sqlmap as its default user-agent, this is clearly not idea for anything that is not Hack The Box

  • --mobile Imitate smartphone through HTTP User-Agent header

  • --random-agent Use randomly selected HTTP User-Agent header value

  • --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" To use a specific user agent

  • Sqlmap also has a risk and level value to control the thoroughness of its tests

Standalone Version

  • Sqlmap will need to identify the injection points on the site

  • This will allow it to spider the page at a depth of two and attempt injection on any identified injection points

Sqlmap with Burp/Zap Request

  • Capture a request in which you provide input to the form box that you want tested in either zap or burp.

  • Save off that request with all the headers to your local attack box

  • Now feed that file into sqlmap

Authentication with Sqlmap

  • If you are able to login to a webserver via credentials or another means, and you want sqlmap to test parameters that are only accessible past the login page, you need to figure out how the application is conducting session management.

  • More often than not it is with a cookie

  • Capture ALL of the cookies in the request like this:

  • Now with your cookies in your clipboard buffer add them into your command

Enumerating the Databases with Sqlmap

  • Once sqlmap has identified a vulnerability, and you want to enumerate all the databases use:

  • --dbs

Enumerating the Tables in a Database

  • Once you are able to dump the database names with sqlmap, now enumerate the tables in your database of interest

Dumping a Database

  • However, say we want the tables out of the sqli database

  • Output should look something like this:

Dumping a Table

  • To dump a particular table from a database

File Read with SqlMap

  • To read a file on the remote system:

  • If successful, simply cat out the file stored now on your local system

User Password Dump

  • Sqlmap will automate the process of looking for users and passwords, across multiple databases

Using a Proxy with Sqlmap

  • Burp and Zap can both be used as a proxy for sqlmap requests

  • Set your foxy proxy or other extension to use zap to proxy requests

  • Start zap (should go without saying)

  • Proxy with burp request read

  • Now you can go through your zap history and see the exact requests sqlmap is making (will need to url decode in most cases

SQL Database Output Trick

  • When running sql commands from a shell sometimes the output from commands that rely on a table can get messed up. Below the output is normal but if you run the first command and your table is messed up, you can run the second command and get normal output

PreviousTesting for RFINextTesting for XSS

Last updated