Burpsuite/SQL Injection - Revision history

Unknown user: /* Union Attacks */

2022-03-17T02:11:26Z

Union Attacks

← Older revision		Revision as of 02:11, 17 March 2022
Line 52:		Line 52:
	Now, use that to craft a query. For example, suppose the injection-vulnerable query returns 5 columns, 3 of them are text. Further suppose that we are after usernames and passwords, and we know we can find them in the "users" table. Then we need to craft a query that will result in two columns of text (one column is usernames, other column is passwords) and UNION that with the 5 columns the injection-vulnerable query returns.		Now, use that to craft a query. For example, suppose the injection-vulnerable query returns 5 columns, 3 of them are text. Further suppose that we are after usernames and passwords, and we know we can find them in the "users" table. Then we need to craft a query that will result in two columns of text (one column is usernames, other column is passwords) and UNION that with the 5 columns the injection-vulnerable query returns.

	If the query returns columns of type string, number, string, string, number, then we could use this ~~query~~:		If the query returns columns of type string, number, string, string, number, then we could use this value for the category variable:

	<pre>		<pre>

2022-03-17T01:39:36Z

Examining Databases

← Older revision		Revision as of 01:39, 17 March 2022
Line 95:		Line 95:

	GET /filter?category='+UNION+SELECT+NULL,NULL+FROM+users_bbdvzx-- HTTP/1.1		GET /filter?category='+UNION+SELECT+NULL,NULL+FROM+users_bbdvzx-- HTTP/1.1

			GET /filter?category='+UNION+SELECT+*+FROM+users_bbdvzx-- HTTP/1.1
	</pre>		</pre>

2022-03-17T01:38:13Z

Examining Databases

← Older revision		Revision as of 01:38, 17 March 2022
Line 93:		Line 93:
	<pre>		<pre>
	GET /filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables-- HTTP/1.1		GET /filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables-- HTTP/1.1

			GET /filter?category='+UNION+SELECT+NULL,NULL+FROM+users_bbdvzx-- HTTP/1.1
	</pre>		</pre>

2022-03-17T01:37:28Z

Examining Databases

← Older revision		Revision as of 01:37, 17 March 2022
Line 91:		Line 91:


	<~~code~~>		<pre>
	GET /filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables-- HTTP/1.1		GET /filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables-- HTTP/1.1
	</pre>		</pre>

2022-03-17T01:37:17Z

Examining Databases

← Older revision		Revision as of 01:37, 17 March 2022
Line 89:		Line 89:
	*** <code>TABLE_NAME</code>		*** <code>TABLE_NAME</code>
	*** <code>TABLE_TYPE</code>		*** <code>TABLE_TYPE</code>


			<code>
			GET /filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables-- HTTP/1.1
			</pre>

	=Resources=		=Resources=

2022-03-17T01:34:32Z

Examining Databases

← Older revision		Revision as of 01:34, 17 March 2022
Line 81:		Line 81:
	* Obtain a list of all tables in the database (also requires crafting a UNION attack)		* Obtain a list of all tables in the database (also requires crafting a UNION attack)
	** See cheat sheet for list of SQL server list-all-tables functions: https://portswigger.net/web-security/sql-injection/cheat-sheet		** See cheat sheet for list of SQL server list-all-tables functions: https://portswigger.net/web-security/sql-injection/cheat-sheet
			** This one can be tricky, mainly because the SELECT *, and the variable number of columns returned
			** Can concatenate different columns together, but that requires knowing the names of fields
			** Is there a way to get names of fields in a given table??
			** Columns returned by <code>SELECT * FROM information_schema.tables</code> include the following:
			*** <code>TABLE_CATALOG</code>
			*** <code>TABLE_SCHEMA</code>
			*** <code>TABLE_NAME</code>
			*** <code>TABLE_TYPE</code>

	=Resources=		=Resources=

2022-03-17T01:24:51Z

Examining Databases

← Older revision		Revision as of 01:24, 17 March 2022
Line 77:		Line 77:

	* Determine what version the server is (this will require crafting a UNION attack)		* Determine what version the server is (this will require crafting a UNION attack)
	** ~~List~~ of SQL version functions: https://portswigger.net/web-security/sql-injection/cheat-sheet		** See cheat sheet for list of SQL version functions: https://portswigger.net/web-security/sql-injection/cheat-sheet

	* Obtain a list of all tables in the database (also requires crafting a UNION attack)		* Obtain a list of all tables in the database (also requires crafting a UNION attack)
	** ~~List~~ of SQL server list-all-tables functions: https://portswigger.net/web-security/sql-injection/cheat-sheet		** See cheat sheet for list of SQL server list-all-tables functions: https://portswigger.net/web-security/sql-injection/cheat-sheet

	=Resources=		=Resources=

2022-03-17T01:24:22Z

Examining Databases

← Older revision		Revision as of 01:24, 17 March 2022
Line 67:		Line 67:

	In this section we cover some strategies for using UNION attacks to obtain information about the database.		In this section we cover some strategies for using UNION attacks to obtain information about the database.

			* Perform the above steps to determine how many columns are returned by an injectable query and what their types are

			* Determine what character is the comment character, <code>--</code> or <code>#</code>
			** This is a pretty easy way to get some info on the type of server
			** List of SQL server comment styles: https://portswigger.net/web-security/sql-injection/cheat-sheet
			** <code>--</code> is Oracle, MS SQL, PostgreSQL
			** <code>#</code> is MySQL

			* Determine what version the server is (this will require crafting a UNION attack)
			** List of SQL version functions: https://portswigger.net/web-security/sql-injection/cheat-sheet

			* Obtain a list of all tables in the database (also requires crafting a UNION attack)
			** List of SQL server list-all-tables functions: https://portswigger.net/web-security/sql-injection/cheat-sheet

	=Resources=		=Resources=

2022-03-17T01:07:30Z

Union Attacks

← Older revision		Revision as of 01:07, 17 March 2022
Line 62:		Line 62:
	Note, if a query that can be injected only returns one field, and you want to retrieve multiple fields from another table with a single UNION query, you can use string concatenation to combine multiple fields into a single column, and perform the UNION on single columns.		Note, if a query that can be injected only returns one field, and you want to retrieve multiple fields from another table with a single UNION query, you can use string concatenation to combine multiple fields into a single column, and perform the UNION on single columns.

			=Examining Databases=

			{{Main\|SQL Injection/UNION Attack}}

			In this section we cover some strategies for using UNION attacks to obtain information about the database.





	=Resources=		=Resources=

2022-03-17T01:05:58Z