Revision as of 01:17, 22 May 2023

This page covers how to perform SQL Injection attacks with Burp Suite.

Burp Suite Training

Main article: SQL Injection

Lab 1: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

Lab 2: SQL injection vulnerability allowing login bypass

https://portswigger.net/web-security/sql-injection/lab-login-bypass
https://www.youtube.com/watch?v=ML3aGaloczI
lab doesn't require burp suite, just feeding SQL queries into login form
guessing SELECT firstname FROM users WHERE username='admin' AND password='admin'
single quotes raising internal errors are a sign of SQL Injection vulnerability
if at first you don't succeed, try, try again: admin, administrator, etc etc etc
https://www.youtube.com/watch?v=fMPvCyD2v4w
This is another version of the same lab, but using the Python requests library

Main article: SQL Injection/UNION Attack

Lab 3: SQL injection UNION attack, determining the number of columns returned by the query

Lab 4: SQL injection UNION attack, finding a column containing text

Lab 5: SQL injection UNION attack, retrieving data from other tables

Lab 6: SQL injection UNION attack, retrieving multiple values in a single column

Lab 7: SQL injection attack, querying the database type and version on Oracle

Lab 8: SQL injection attack, querying the database type and version on MySQL and Microsoft

Lab 9: SQL injection attack, listing the database contents on non-Oracle databases

Lab 10: SQL injection attack, listing the database contents on Oracle

Main article: SQL Injection/Blind

Lab 11: Blind SQL injection with conditional responses

Lab 12: Blind SQL injection with conditional errors

https://portswigger.net/web-security/sql-injection/blind/lab-conditional-errors
https://www.youtube.com/watch?v=_7w-KEP_K5w
this one takes a while, and is faster to do with the professional edition
visit a page, capture request, add a single quote to a cookie TrackingId parameter to raise a 500 error
step 1: prove parameter is vulnerable
to prove the parameter is vulnerable to SQL injection, use concat operator ||
' || (select ) || '
this is a well-formatted SQL query, but returns a 500 error
weird, because this should work, not return a 500 error
indication that this could be an oracle database, since it requires a FROM clause to be well-formatted
' || (select from dual) || '
Paste that SQL into the Cookie TrackingId, use Control + U to URL encode it
dual is a built-in Oracle database
this works, indicating this is, in fact, an Oracle database
but if we replace "dual" with "dualoiweuroqiurepoiquwer" then it fails
step 2: confirm users table exists in database
' || (select from users) || '
this returns an internal server error
the problem may be with the number of fields returned (???)
modify query to the following:
' || (select from users where rownum = 1) || '

@@ Line 78: / Line 78: @@
 * https://www.youtube.com/watch?v=_7w-KEP_K5w
 * this one takes a while, and is faster to do with the professional edition
+* visit a page, capture request, add a single quote to a cookie TrackingId parameter to raise a 500 error
+* step 1: prove parameter is vulnerable
+* to prove the parameter is vulnerable to SQL injection, use concat operator <code>||</code>
+* <code>' || (select '') || '</code>
+* this is a well-formatted SQL query, but returns a 500 error
+* weird, because this should work, not return a 500 error
+* indication that this could be an oracle database, since it requires a FROM clause to be well-formatted
+* <code>' || (select '' from dual) || '</code>
+* Paste that SQL into the Cookie TrackingId, use Control + U to URL encode it
+* dual is a built-in Oracle database
+* this works, indicating this is, in fact, an Oracle database
+* but if we replace "dual" with "dualoiweuroqiurepoiquwer" then it fails
+* step 2: confirm users table exists in database
+* <code>' || (select '' from users) || '</code>
+* this returns an internal server error
+* the problem may be with the number of fields returned (???)
+* modify query to the following:
+* <code>' || (select '' from users where rownum = 1) || '</code>
 ==Cheat Sheet==
 https://portswigger.net/web-security/sql-injection/cheat-sheet