Since years,SQL Injections have been the most dreadful and frightening of allvulnerabilities discovered till date. The power of a single quote (') is beyondcomparison. SQL injection attacks were first discovered in 1998, with one ofthe first live attacks taking place in 2002 on the fashion retailer Guess andthe rest is History. Billions of Dollars and reputations have been lost. Inspite of implementing multiple forms of fixes, its a never ending war betweendevelopers and hackers. If the former comes up with a way to prevent it, thelatter comes up with a way to bypass it. The blog focuses on providing in-depth insights into the discussion of the techniques used to bypassone of such prevention methods. This blog will not help you to learn thebasics of SQL Injection; so I would recommend you to go through OWASP before even thinking about jumping into advanced techniques. This blog is morefocused on bypassing Mod_Security (Web Application Firewall) and eventually exploiting SQL Injection vulnerability. The Attack:First andforemost, we need to find our target website. In this case I am using:http://targetsite.com/demo/exams.php?sort=8Looks perfect!Right? Now let's try to insert a single quote at the end of the URL and observewhat happens:http://targetsite.com/demo/exams.php?sort=8'Hmmm!! Different response!The pageappears but no data. So something did happen but still we dont have aconfirmation whether SQL Injection exists or not. Let's modify our query a bitto see how the application responds.http://targetsite.com/demo/exams.php?sort=8' or 1=1--Normally in avulnerable website the above query would return values from the entire tablesince the Boolean condition is always true. Let's see how this websiteresponds:BLOCKED! It seems likeour target website has a WAF implemented to prevent itself from being targeted.So, if I am not wrong, any attacks directed towards the database will beblocked by Mod_Security. Well in somecases, it is possible to block such attacks if you have the implementation donecorrectly with an up-to-date version of WAF being used and regular update ofsecurity patches being rolled out. But then again,aren't we hackers? We don't give up, do we? Let's try to get around it. Soundsintriguing? Let's play.First we needto make some queries work just to be sure that SQL Injection indeed exists.Finding the Number of Columns:Till now Iwould say that we are kinda hacking in the dark. No real MySQL errors whichactually proved the presence of SQL Injection. The only success we had was whenwe used a single quote in the above mentioned URL and received a blank page inresponse...no rows...no data. This can however mean that we somehow managed tochange the structure of the underlying query and the page might be vulnerableto SQL Injection. Let's try and get some confirmation. Finding thenumber of columns present in the current database might actually prove itspresence. This can be achieved by using a simple "ORDER BY" clause.http://targetsite.com/demo/exams.php?sort=8 ORDER BY 1-- No Error! Expected Response!Cool...there's Hope after all....Let's proceedfurther...http://targetsite.com/demo/exams.php?sort=8 ORDER BY 2-- No Errorhttp://targetsite.com/demo/exams.php?sort=8 ORDER BY 3-- No Error http://targetsite.com/demo/exams.php?sort=8 ORDER BY 4-- No Error http://targetsite.com/demo/exams.php?sort=8 ORDER BY 5-- No Error http://targetsite.com/demo/exams.php?sort=8 ORDER BY 6-- No Error http://targetsite.com/demo/exams.php?sort=8 ORDER BY 7-- No Error but a Blank PageAs seen above, ORDERBY 7-- query generated a different response thereby proving