SQL Injection

SQL Injection explanation

---

What is SQL Injection?

SQL Injection is the act where a malicious user exploits a security vulnerability to inject and execute arbitrary SQL statements, manipulating the database into abnormal behavior.

Attack types and methods

SQL Injection

SQL Injection using a logical error

The query shown in the picture above is a SQL statement commonly used at login. Into this statement, where there's no validation of the input value, arbitrary SQL was injected with malicious intent. With ' or 1=1--, a single quote to close the single quote in the WHERE clause plus the clause or 1=1 makes the entire WHERE clause true, and inserting -- comments out the rest of the statement.

It's a simple method, but if it succeeds, you log in as the very first account created. Since the first account created is usually the administrator account, you can log in as the administrator.

Union based SQL Injection

SQL Injection using the Union command

This refers to a SQL Injection attack using the SQL operator UNION, which requests two or more queries to get results; the attacker uses this operator to insert one additional query into the original request to extract information.

Using the UNION operator, you can combine the results of two or more SELECT statements into a single result set.

However, result sets combined using the UNION operator must all have the same structure.

The query shown above is a query that searches posts in a table called Board. It compares the input value against the data in the title and contents columns, then outputs posts with similar text. Here, if you insert a SELECT statement matched together with the Union keyword as the input, the two queries are merged and appear as a single table. If such an injection succeeds, since it's a query requesting id and password, the user's personal information will be shown on screen along with the posts.

Blind SQL Injection

Blind SQL Injection is used when you don't receive a specific value or data from the database, but can only know true/false information. When SQL Injection is possible on a login form, you can extract the DB's table information through the login success/failure messages the server responds with.

The injection statement above is a method to find out the database's table name. Through an injectable login form, a malicious user injected, along with an arbitrarily-registered id abc123, the statement abc123' and ASCII(SUBSTR(SELECT name FROM information_schema.tables WHERE table_type='base table' limit 0,1) 1,1)) > 100 --.

This statement is a MySQL statement that looks up table names — using the limit keyword to look up only one table, the SUBSTR function for only the first character, and finally ASCII to convert it to an ASCII code.

Time Based SQL Injection

Time Based SQL Injection is likewise a technique that leaks database information through true/false responses instead of a specific response from the server.

When you insert an attack string using MySQL's Sleep() function to get the query result after 5 seconds, if the query result is output on screen after 5 seconds, you can determine there's a vulnerability.

Stored Procedure SQL Injection

A stored procedure is a form of SQL collection made for operational convenience; in particular, xp_cmdshell, usable in MS SQL, is injecting the Windows command netstat -an.

Error-based SQL Injection

If, when inserting special characters (a single quote (') or semicolon (;)) into GET/POST request fields, HTTP header values, cookie values, etc., a SQL error occurs, you can determine there's a vulnerability.

Strings commonly used in SQL Injection

<table style="border-collapse: collapse; width: 100%; height: 120px;" border="1" data-ke-align="alignLeft"><tbody><tr style="height: 20px;"><td style="width: 50%; text-align: center; height: 20px;"><b>String</b></td><td style="width: 50%; text-align: center; height: 20px;"><b>Description</b></td></tr><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">'</td><td style="width: 50%; text-align: left; height: 20px;">Character data delimiter</td></tr><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">;</td><td style="width: 50%; text-align: left; height: 20px;">Query delimiter</td></tr><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">--, #</td><td style="width: 50%; text-align: left; height: 20px;">Line comment delimiter<br><span style="color: #1b711d;">-- : Oracle, MSSQL</span><br><span style="color: #1b711d;"># MYSQL</span></td></tr><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">/* /</td><td style="width: 50%; text-align: left; height: 20px;">Block comment between / and */</td></tr><tr style="height: 20px;"><td style="width: 50%; text-align: left; height: 20px;">||</td><td style="width: 50%; text-align: left; height: 20px;">String concatenation <span style="color: #1b711d;">(Oracle only)</span></td></tr></tbody></table>

References:

https://noirstar.tistory.com/guestbook

https://kk-7790.tistory.com/74

https://m.blog.naver.com/koromoon/120172851234

https://tar-cvzf-studybackup-tar-gz.tistory.com/84

https://seey.tistory.com/6

---

Original (Korean): tistory — published 2021-06-03, migrated to this blog. This translation was generated with the help of AI.