From charlesreid1

This page contains notes on how to use Burp Suite to perform SQL injection attacks.


Union Attacks


Determining Number of Columns Returned for an Attack

Example - Determine Number of Columns

Fire up Burp Suite, switch to the Proxy tab, and open the browser. Log into the Port Swigger training site online.

Here is a simple e-commerce website with a built-in SQL injection vulnerability:

SQL Injection UNION Attack Burp 1.png

Note the category=xyz, which is the insecure portion of the application - this value is substituted into an SQL query without being sanitized first

SQL Injection UNION Attack Burp 2.png

We use the UNION SELECT payloads in this case. Trying with 1 or 2 NULL values returns a server error:

SQL Injection UNION Attack Burp 3.png

But once we try with 3 NULL values, the server successfully renders the page

SQL Injection UNION Attack Burp 4.png


Another Example: Order By, and Non-Microsoft SQL Server

MS SQL databases accept -- to start comments, but if it's not an MS SQL database, it may not accept the --. Instead, you need to use a hash sign to terminate the query early.

In this case, the procedure covered above needs to change slightly. Let's also cover how to use ORDER BY instead of SELECT NULL.

We start with the same vulnerable web application with its vulnerable "category" URL parameter:

/filter?category=xyz

Start out by browsing to that page in the Burp proxy. Turn on Intercept Traffic and refresh the page. You should now see the request for the /filter URL, with its "category" value set.

Now right click on this request, and send to repeater. Then you can turn off Intercept Traffic, and switch over to Repeater.

Here's what the un-tampered-with request might look like:

SQL Injection UNION Attack Burp 9a.png

Now we can use the following SQL query in place of the category: ' ORDER BY 1--

(This will try to order the results that are being returned by the /filter URL by the first column. Increment to 2, 3, 4, etc. to discover how many columns the SQL query being attacked is returning.)

This request, when URL-encoded, is easy enough that we probably don't need Burp to do it for us: '+ORDER+BY+1--

However, in some cases, this will still return a 500 error:

SQL Injection UNION Attack Burp 9b.png

In this case, we can try terminating the query string with a hash sign: ' ORDER BY 1 #

The hash sign must be URL-encoded, and Burp Suite will come in handy because it has built-in capabilities to obtain the URL-encoded version of a string.

When in repeater, and modifying the request URL, you can type the SQL query in a way that is NOT URL-encoded, and then select the text, and click Command-U to URL-encode the text.

Before:

SQL Injection UNION Attack Burp 9c.png

After:

SQL Injection UNION Attack Burp 9d.png

Once we send that request, we see the server return a 200 code, meaning we can continue on with our ORDER BY attacks to enumerate columns.

SQL Injection UNION Attack Burp 9e.png


Determining Column Data Types

Example - Determine Data Type of Columns

Start with the same vulnerable e-commerce application, and still using the un-sanitized "category" variable. Start by repeating the attack shown above, to verify we are still dealing with the same number of columns:

/filter?category='+UNION+SELECT+NULL,NULL,NULL--

confirm that the page renders and does not return any error, indicating we are dealing with 3 columns:

SQL Injection UNION Attack Burp 5.png

Now we modify the query:

/filter?category='+UNION+SELECT+'a',NULL,NULL--

This returns an internal server error, so the first column is not a string type:

SQL Injection UNION Attack Burp 6.png

When we try the second column, the web application successfully renders the page, which means the second column returned is a string type:

/filter?category='+UNION+SELECT+NULL,'a',NULL--

SQL Injection UNION Attack Burp 7.png

The last column is not a string type either,

/filter?category='+UNION+SELECT+NULL,NULL,'a'--

SQL Injection UNION Attack Burp 8.png


Retrieving Data from Other Columns

Example - Retrieve Data from Other Columns

Start with the same e-commerce web application with the same SQL injection vulnerability in the category variable.

SQL Injection UNION Attack Burp 9.png

We start by repeating the two SQL injection attacks covered above, to verify that the products page is returning two fields, and that both fields are strings.

Now, we know that the products category page is fetching two string columns, and so we can do a UNION attack and fetch two other string columns. In this case, the username and password columns of the users table.

Craft the SQL injection query:

/filter?category='+UNION+SELECT+username,password+FROM+users--

This will create a query that is the union of usernames/passwords with the (empty) products query:

SQL Injection UNION Attack Burp 10.png


Retrieving Multiple Values in One Column

Example - Retrieving Multiple Values in One Column

SQL Injection UNION Attack Burp 11.png


Examining the Database

Querying the Database Type and Version

Example - Retrieving Database Version from Oracle

Example - Retrieving Database Version from MySQL and MS SQL

Working with the vulnerable web app with the category parameter that is vulnerable to SQL injection.

We start by finding the number of columns. In the process, we find that -- doesn't work as a statement-terminating sequence, but # does.

SQL Injection UNION Attack Burp 9b.png

SQL Injection UNION Attack Burp 9c.png

SQL Injection UNION Attack Burp 9d.png

When we inject ' ORDER BY 1 # the application is ok

When we inject ' ORDER BY 2 # the application is ok

When we inject ' ORDER BY 3 # the application crashes, so there are 2 columns being returned

We can verify the columns being returned are text (which we can deduce from the UI, which has two text fields for each product) by injecting ' UNION SELECT 'a','a' #

This returns a 200, meaning there are 2 columns of text returned by the SQL query we are injecting

SQL Injection UNION Attack Burp 10d.png

Last, we know that we can get the version of the server (https://charlesreid1.com/wiki/SQL_Injection/UNION_Attack#Querying_the_Database_Type_and_Version) by using SELECT @@version, but this returns a string with the version number, and we have to make two columns for the union query to work.

We inject the following query: ' UNION SELECT @@version,NULL #

This will put the version in one column and nothing in the other. This adds one more product to the bottom of the list of products, which contains the SQL server version number.

This sequence shows entering the injected query in plain text, then using Command-U to render it in URL encoding, then the resulting request (note the version number in the bottom right of the third image):

SQL Injection UNION Attack Burp 10e.png

SQL Injection UNION Attack Burp 10f.png

SQL Injection UNION Attack Burp 10g.png

Resources

Links

Port Swigger Burp Suite training material:

YouTube

SQL injection lab 7 - querying db type/version on oracle: https://www.youtube.com/watch?v=neeY0iVa_0A

SQL injection lab 8 - querying db type/version on mysql and ms sql: https://www.youtube.com/watch?v=MFTk_LNRW0g

YouTube

Helpful video covering the MySQL and MS SQL version vulnerabilities: https://www.youtube.com/watch?v=MFTk_LNRW0g