SQL Injection
A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application.
Entry point detection
Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML contentMultiple Encoding
%%2727
%25%27Merging characters
Logic Testing
Weird characters
DBMS Identification
Authentication Bypass
Authentication Bypass (Raw MD5 SHA1)
When a raw md5 is used, the pass will be queried as a simple string, not a hexstring.
Allowing an attacker to craft a string with a true statement such as ' or 'SOMETHING
Challenge demo available at http://web.jarvisoj.com:32772
Polyglot injection (multicontext)
Routed injection
Insert Statement - ON DUPLICATE KEY UPDATE
ON DUPLICATE KEY UPDATE keywords is used to tell MySQL what to do when the application tries to insert a row that already exists in the table. We can use this to change the admin password by:
Inject using payload:
The query would look like this:
INSERT INTO users (email, password) VALUES ("attacker_dummy@example.com", "bcrypt_hash_of_qwerty"), ("admin@example.com", "bcrypt_hash_of_qwerty") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_qwerty" -- ", "bcrypt_hash_of_your_password_input");
This query will insert a row for the user “attacker_dummy@example.com”. It will also insert a row for the user “admin@example.com”.
Because this row already exists, the ON DUPLICATE KEY UPDATE keyword tells MySQL to update the `password` column of the already existing row to "bcrypt_hash_of_qwerty".
After this, we can simply authenticate with “admin@example.com” and the password “qwerty”!
Information_schema.tables Alternative
Version Alternative
Last updated
Was this helpful?