Burp Suite/SQL Injection - Revision history

Unknown user: /* Blind SQL Injection */

2023-06-04T21:02:06Z

Blind SQL Injection

← Older revision		Revision as of 21:02, 4 June 2023
Line 86:		Line 86:
	* step 6: automate with cluster bomb type attack		* step 6: automate with cluster bomb type attack

	===SQL Injection with XML External Entities (XXE)===		==SQL Injection with XML External Entities (XXE)==

	{{Main\|XXE}}		{{Main\|XXE}}

2023-06-04T21:01:53Z

Blind SQL Injection

← Older revision		Revision as of 21:01, 4 June 2023
Line 71:		Line 71:
	Lab 11: Blind SQL injection with conditional responses		Lab 11: Blind SQL injection with conditional responses
	* https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses		* https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses
	* https://www.youtube.com/watch?v=LBG_n9fr8sM~~&themeRefresh=1~~		* https://www.youtube.com/watch?v=LBG_n9fr8sM

2023-06-04T21:01:36Z

SQL Injection with XML External Entities (XXE)

← Older revision		Revision as of 21:01, 4 June 2023
Line 91:		Line 91:

	Lab 17: SQL injection with filter bypass via XML encoding		Lab 17: SQL injection with filter bypass via XML encoding
	* XML External Entity attacks
	* https://portswigger.net/web-security/xxe		* https://portswigger.net/web-security/xxe
			* https://www.youtube.com/watch?v=ELdyZm0nK4g

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-06-04T21:01:18Z

SQL Injection with XML External Entities (XXE)

← Older revision		Revision as of 21:01, 4 June 2023
Line 90:		Line 90:
	{{Main\|XXE}}		{{Main\|XXE}}

	XML External Entity attacks: https://portswigger.net/web-security/xxe		Lab 17: SQL injection with filter bypass via XML encoding
			* XML External Entity attacks
			* https://portswigger.net/web-security/xxe

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-06-04T20:25:37Z

Blind SQL Injection

← Older revision		Revision as of 20:25, 4 June 2023
Line 85:		Line 85:
	* step 5: output admin password one character at a time		* step 5: output admin password one character at a time
	* step 6: automate with cluster bomb type attack		* step 6: automate with cluster bomb type attack

			===SQL Injection with XML External Entities (XXE)===

			{{Main\|XXE}}

			XML External Entity attacks: https://portswigger.net/web-security/xxe

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-05-23T18:47:59Z

Blind SQL Injection

@@ Line 78: / Line 78: @@
 * https://www.youtube.com/watch?v=_7w-KEP_K5w
 * this one takes a while, and is faster to do with the professional edition
-* visit a page, capture request, add a single quote to a cookie TrackingId parameter to raise a 500 error
+* visit a page, capture request, and tamper with the cookie tracking ID parameter (per exercise instructions)
+* step 1: prove parameter is vulnerable (sql injection is possible, but can we inject valid SQL?)
-step 1: prove parameter is vulnerable
+* step 2: confirm there is a "users" table in the DB
-* to prove the parameter is vulnerable to SQL injection, use concat operator <code>||</code>
+* step 3: confirm there is an administrator user in the users table
-* <code><nowiki>' || (select '') || '</nowiki></code>
+* step 4: check the length of the password by modifying the same query
-* this is a well-formatted SQL query, but returns a 500 error
+* step 5: output admin password one character at a time
-* weird, because this should work, not return a 500 error
+* step 6: automate with cluster bomb type attack
 ==Cheat Sheet==
 https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-05-22T02:16:52Z

Blind SQL Injection

← Older revision		Revision as of 02:16, 22 May 2023
Line 152:		Line 152:
	* payload parameter 2 - letter - Brute forcer (all alphanumeric characters, min length = max length = 1)		* payload parameter 2 - letter - Brute forcer (all alphanumeric characters, min length = max length = 1)
	* this will generate 720 requests total		* this will generate 720 requests total
			* filter > filter by response code (500 only)
			* write it out, punch it in.

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-05-22T02:13:28Z

Blind SQL Injection

@@ Line 130: / Line 130: @@
 * 200 response means first character of password is NOT a
 * 500 response means first character of password IS a
 ==Cheat Sheet==
 https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-05-22T02:07:51Z

Blind SQL Injection

← Older revision		Revision as of 02:07, 22 May 2023
Line 119:		Line 119:
	* select "1" (password length) and choose Add		* select "1" (password length) and choose Add
	* Intruder > Payloads > Numbers, sequential, from 1 to 50, step count of 1		* Intruder > Payloads > Numbers, sequential, from 1 to 50, step count of 1
			* when payload of 20 is sent, it returns a 200 status code
			* so, we know length of password is 20 (condition is not met when > 20)

			step 5: output the administrator password
			* we have 20 characters to enumerate
			* modify query from preceding, but use substring function
			* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and SUBSTR(password,1,1)='a') \|\| '</nowiki></code>
			* how does this work?
			* first thing that gets run is the FROM clause, which checks if there is a users table and a username administrator, and it checks if the first character is equal to a. if so, it will run the CASE statement, which will run the code that raises the error.
			* 200 response means first character of password is NOT a
			* 500 response means first character of password IS a

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet

2023-05-22T02:04:11Z

Blind SQL Injection

← Older revision		Revision as of 02:04, 22 May 2023
Line 115:		Line 115:
	* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and LENGTH(password)>1) \|\| '</nowiki></code>		* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and LENGTH(password)>1) \|\| '</nowiki></code>
	* the FROM section is executed first. if it is true (if password length > 1), it raises a 500 error. increment 1 until you get the final length of the password (whatever password length it returns 200 for).		* the FROM section is executed first. if it is true (if password length > 1), it raises a 500 error. increment 1 until you get the final length of the password (whatever password length it returns 200 for).
			* to generate lots of requests, right-click request and choose Send to Intruder
			* Intruder > Positions > Clear
			* select "1" (password length) and choose Add
			* Intruder > Payloads > Numbers, sequential, from 1 to 50, step count of 1

	==Cheat Sheet==		==Cheat Sheet==

	https://portswigger.net/web-security/sql-injection/cheat-sheet		https://portswigger.net/web-security/sql-injection/cheat-sheet