Burp Suite/SQL Injection: Difference between revisions

From charlesreid1
 
(11 intermediate revisions by the same user not shown)
Line 71: Line 71:
Lab 11: Blind SQL injection with conditional responses
Lab 11: Blind SQL injection with conditional responses
* https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses
* https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses
* https://www.youtube.com/watch?v=LBG_n9fr8sM&themeRefresh=1
* https://www.youtube.com/watch?v=LBG_n9fr8sM




Line 78: Line 78:
* https://www.youtube.com/watch?v=_7w-KEP_K5w
* https://www.youtube.com/watch?v=_7w-KEP_K5w
* this one takes a while, and is faster to do with the professional edition
* this one takes a while, and is faster to do with the professional edition
* visit a page, capture request, add a single quote to a cookie TrackingId parameter to raise a 500 error
* visit a page, capture request, and tamper with the cookie tracking ID parameter (per exercise instructions)
* step 1: prove parameter is vulnerable
* step 1: prove parameter is vulnerable (sql injection is possible, but can we inject valid SQL?)
* to prove the parameter is vulnerable to SQL injection, use concat operator <code>||</code>
* step 2: confirm there is a "users" table in the DB
* <code><nowiki>' || (select '') || '</nowiki></code>
* step 3: confirm there is an administrator user in the users table
* this is a well-formatted SQL query, but returns a 500 error
* step 4: check the length of the password by modifying the same query
* weird, because this should work, not return a 500 error
* step 5: output admin password one character at a time
* indication that this could be an oracle database, since it requires a FROM clause to be well-formatted
* step 6: automate with cluster bomb type attack
* <code><nowiki>' || (select '' from dual) || '</nowiki></code>
 
* Paste that SQL into the Cookie TrackingId, use Control + U to URL encode it
==SQL Injection with XML External Entities (XXE)==
* dual is a built-in Oracle database
 
* this works, indicating this is, in fact, an Oracle database
{{Main|XXE}}
* but if we replace "dual" with "dualoiweuroqiurepoiquwer" then it fails
 
* step 2: confirm users table exists in database
Lab 17: SQL injection with filter bypass via XML encoding
* <code>' || (select '' from users) || '</code>
* https://portswigger.net/web-security/xxe
* this returns an internal server error
* https://www.youtube.com/watch?v=ELdyZm0nK4g
* the problem may be with the number of fields returned (???)
* modify query to the following:
* <code>' || (select '' from users where rownum = 1) || '</code>
* that returns a 200, indicating there is, in fact, a users table in the daatabase
* step 3: confirm the administrator user exists in the users database
* to do this: modify prior SQL query
* <code><nowiki>' || (select '' from users where username='administrator') || '</nowiki></code>
* the problem: either way, this will return a 200 (if there is no administrator user, just doesn't return anything)
* solution: add conditional, and divide by zero if conditional is met
* <code><nowiki>' || (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual) || '</code></nowiki> should cause an error
* <code><nowiki>' || (select CASE WHEN (1=0) THEN TO_CHAR(1/0) ELSE '' END FROM dual) || '</code></nowiki> should NOT cause an error
* now we can use that to check for the username:
* <code><nowiki>' || (select CASE WHEN (1=0) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator') || '</nowiki></code>
* the FROM section is executed first. if it is true, then it executes the select portion of the query (which raises an error). if it is false, then it skips the select portion of the query, so it never outputs an error.
*


==Cheat Sheet==
==Cheat Sheet==


https://portswigger.net/web-security/sql-injection/cheat-sheet
https://portswigger.net/web-security/sql-injection/cheat-sheet

Latest revision as of 21:02, 4 June 2023

This page covers how to perform SQL Injection attacks with Burp Suite.

Burp Suite Training

SQL Injection Labs

Main article: SQL Injection

https://portswigger.net/web-security/sql-injection

Lab 1: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data


Lab 2: SQL injection vulnerability allowing login bypass

SQL Injection UNION Attacks

Main article: SQL Injection/UNION Attack

https://portswigger.net/web-security/sql-injection/union-attacks

Lab 3: SQL injection UNION attack, determining the number of columns returned by the query

Lab 4: SQL injection UNION attack, finding a column containing text

Lab 5: SQL injection UNION attack, retrieving data from other tables

Lab 6: SQL injection UNION attack, retrieving multiple values in a single column

Examining the Database

Lab 7: SQL injection attack, querying the database type and version on Oracle

Lab 8: SQL injection attack, querying the database type and version on MySQL and Microsoft

Lab 9: SQL injection attack, listing the database contents on non-Oracle databases

Lab 10: SQL injection attack, listing the database contents on Oracle

Blind SQL Injection

Main article: SQL Injection/Blind

https://portswigger.net/web-security/sql-injection/blind

Lab 11: Blind SQL injection with conditional responses


Lab 12: Blind SQL injection with conditional errors

  • https://portswigger.net/web-security/sql-injection/blind/lab-conditional-errors
  • https://www.youtube.com/watch?v=_7w-KEP_K5w
  • this one takes a while, and is faster to do with the professional edition
  • visit a page, capture request, and tamper with the cookie tracking ID parameter (per exercise instructions)
  • step 1: prove parameter is vulnerable (sql injection is possible, but can we inject valid SQL?)
  • step 2: confirm there is a "users" table in the DB
  • step 3: confirm there is an administrator user in the users table
  • step 4: check the length of the password by modifying the same query
  • step 5: output admin password one character at a time
  • step 6: automate with cluster bomb type attack

SQL Injection with XML External Entities (XXE)

Main article: XXE

Lab 17: SQL injection with filter bypass via XML encoding

Cheat Sheet

https://portswigger.net/web-security/sql-injection/cheat-sheet

Retrieved from "https://charlesreid1.com/w/index.php?title=Burp_Suite/SQL_Injection&oldid=29637"