SQL Injection 101: Database & SQL Basics Every Hacker Needs to Know « Null Byte :: WonderHowTo

The key to becoming a competent white hat is knowing how the technology that you are trying toexploitactually works. SQL injection is one of the most common methods of attack used today and also one of the easiest to learn. In order to understand how this attack works, you need to have a solid grasp of ... you've guessed it ... SQL.This series will start at the bottom with the fundamentals of SQL and SQL injection, moving on to database identification and more advanced techniques, and finally closing with methods used to prevent and mitigate these types of attacks.What Is SQL Injection?SQL, which stands for structured query language, is a standard language used for retrieving and manipulating data in a relational database management system (RDBMS). Data is accessed through the use of queries, which allow information to be created, read, updated, and deleted (you will often see web applications referred to as CRUD apps for this reason).Databases can be used in a variety of situations, but one of the most common configurations is a database serving as the backend to aweb application. When certain actions are performed, such as logging in or searching, queries are sent from the web app to the database.Don't Miss:The Essential Newbie's Guide to SQL Injections & Manipulating Data in a MySQL DatabaseInjection is allowed to occur when input fields are not properly sanitized or escaped. An attacker can enter malicious SQL commands in order to access data that should otherwise be out of sight. SQL injection is generally considered to be high impact because it allows attackers to retrieve sensitive information, tamper with data, destroy data, or evenescalate privilegesand issue OS commands on the server.Generally, any kind of input on a webpage is potentially vulnerable to SQL injection because that is where it interacts with the database. Authentication forms where the user logs in with a username and password are the most common types of input that are exploited but search forms, contact forms, andfile uploadsare all potential targets for injection.In the first part of this series, we will explore the basics of SQL in order to better understand the types of attacks that are performed.Anatomy of a DatabaseData contained in a relational database is stored in objects called tables. These tables are the virtual representation of relations between different elements, which consist of rows and columns. Rows, called records, contain data for every single entry in the database. Fields, which are the columns of the table, represent a specific piece of information for every record. This is better illustrated in the followingUserstable:This table contains three records and four fields; each user in the database is given an ID, Name, Username, and Password. In reality, tables are much larger than this and can contain millions of records, and the database itself can hold just as many tables. You can see how valuable SQL injection is to an attacker with this much data ripe for the picking.Data Types & OperatorsIn order to understand the data that we are working with, we need to knowthe different types of data utilized in SQL. Although exact data types vary between different database systems, in most cases, they are similar enough to tell what they are; usually, they are categorized by text, number, and date.Operators allow us to manipulate and interact with data in SQL. There arefive main categories of operators: arithmetic, bitwise, comparison, compound, and logical. Most of these are similar to other programming languages, but a few caveats do exist.Don't Miss:How to Attack Web Applications with Burp Suite & SQL InjectionStatements & SyntaxSQL statements are the code that is passed to the database in order to retrieve or modify data. Let's take a look at the following query and break it down:SELECT * FROM Users WHERE Name='John Smith';The first part of this statement (SELECT * FROM Users) selects all of the fields from theUserstable. TheWHEREclause specifies that we only want to see information from the record where"John Smith"is in theNamefield.SQL uses single quotes for strings, although most database systems will permit double quotes, and the semicolon marks the end of the statement. It should be noted that keywords, like SELECT and WHERE, are case insensitive.Comments in SQL can be written as single line or multiline:--this is a single line commentSELECT * FROM Users;/*this is amulti-line comment*/SQL injection exploits the way comments are handled by rendering certain parts of the query unnecessary. The following injection bypasses the need to input a password:SELECT * FROM Users WHERE Username='' or 1=1-- AND Password='';This will return all the records from the database since an empty string or1=1always evaluates to true, and the double dashes (--) comment out thePasswordfield.There are also keywords that exist to make arranging data easier such as MIN and MAX, BETWEEN, and ORDER BY.Let's look at the following table calledLoginSessions:Suppose we wanted to know who was logged in the longest and when — the query below would return the ID, username, and the shortest and longest session between two dates:SELECT ID, Username, MIN(SessionLength), MAX(SessionLength)FROM LoginSessionsWHERE LoginDate BETWEEN '2018-01-01' AND '2018-05-01'GROUP BY IDORDER BY MAX(SessionLength) DESC;GROUP BYconsolidates the rowsBY ID, andORDER BY MAX(SessionLength) DESCshows us the user with the longest session first (descending as opposed to ascending).Other useful statements include INSERT INTO, which inserts new records into a table, UPDATE, which updates existing records in a table, and DELETE, which is used to delete records in a table. These types of queries can be useful for SQL injection when you want to do more than just retrieve information from the database.An attacker could insert a new record indicating that they had bought something from an online store, for example, and claim that they never received the product and be compensated for it. If they really wanted to cause maximum damage, the DROP statement could be used. DROP TABLE will remove an existing table in the database, while DROP DATABASE will remove the entire database itself.Joins & UnionsJoins are used to combine rows from different tables when there is a field related between them. Here is ourUserstable from before:And a new table calledLogins:The following SQL statement returns the date Bob Jones last logged in:SELECT Users.Username, Logins.Date FROM UsersINNER JOIN Logins ON Users.ID = Logins.ID;AnINNER JOIN, or simply JOIN, like the above will return records that have matching data in both tables. A LEFT JOIN returns all records from the left table as well as records that match in the right table, while a RIGHT JOIN returns all records from the right table as well as matched record in the left table. A FULL JOIN will return all records that match in either the left or right table. Although joins aren't required for SQL injection, they can prove very useful when extracting information across tables after you've found your way in.UNION is used to combine distinct data from two or more SELECT statements. Each SELECT statement must have the same data types, the same number of columns, and they must be in the same order. UNION ALL does the same thing, but it won't eliminate duplicate rows in cases where the same data exist in both of the unioned tables. Let's look at an example using theUsersandAdminstables:The following SQL statement would provide passwords from both users and admins:SELECT Password FROM UsersUNIONSELECT Password FROM Admins;Obviously, this wouldn't be a normal query that is run against the database, but if we were allowed to inject this, we could obtain the admin passwords or any other information that isn't usually accessible.Stay Tuned for More on SQL Injection BasicsNow that we have a better understanding of the fundamentals of SQL, we can use that knowledge to perform more advanced SQL injection. Inthe following part of this series, we will explore methods to reveal more information about a database in order to narrow down attack vectors.Next Up:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful SQL InjectionFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byCaspar Rubin/Unsplash; Screenshots by drd_/Null ByteRelatedSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:SQL Injection! -- Detailed Introduction.How to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedSQL Injection 101:Advanced Techniques for Maximum ExploitationSQL Injection 101:How to Avoid Detection & Bypass DefensesSQL Injection 101:Common Defense Methods Hackers Should Be Aware OfHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1Become an Elite Hacker Part 4:Hacking a Website. [Part 1]How to Hack Databases:Hunting for Microsoft's SQL ServerNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Hack websites with SQL injectionHow To:Enumerate MySQL Databases with MetasploitHow To:SQL Injection Finding Vulnerable Websites..Coding with Typo:Structured Query Language (SQL) Part 1: What Is SQL?How to Hack Databases:Running CMD Commands from an Online MS SQL ServerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Coding with Typo:Structured Query Language: (SQL) Part 2: Getting the EssentialsHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Protect Your PHP Website from SQL Injection HacksGoogle Dorking:AmIDoinItRite?News:PostgreSQL Quick StartHow To:Hack websites with SQL injection and WebGoatNews:Hardvard.edu Remote SQL 0day