Website Hacking : UNION BASED SQL INJECTION

WHAT IS SQL..?

SQL which stands for Structured Query Language, is a special purpose programming language designed for management of data stored in RDBMS. SQL consists of a Data Definition Language and Data Manipulation Language.

WHAT IS SQL INJECTION..?

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

OK, so now let's move on from the geeky part and some exploitation .. XD

STEP #1

First of all we'll have to find target for ourselves. You can do so with the help of google hacking or google dorking.

The use of advanced search operators to find information that is not easily accessed through simple searches is sometimes called Google dorking or Google hacking.

Commonly used operators include:

site : restricts query results to certain site or domain.
 
intext : restricts query results to those content records which contain particular word or phrase.

inurl : restricts query results to those sites whose url contain the complete specified word or phrase.

You can download a huge list of google dorks from here.

I'll show you how to use "inurl:id=" for sql injection. So let's get started..

First, enter in the google search bar inurl:id=   and you'll get a list of sites select anyone.

You can also combine search queries like :

site:yourvictim.com inurl:id=

This query will show the result for that particular site.

 STEP #2

After selecting your target, check if it s vulnerable for sql injection. We can do so by simply inserting a ' at the end of the url. For example:

yourvictim.com/xyz.php?id=2
Then,
yourvictim.com/xyz.php?id=2'

If  you get an error message after inserting the ' .. then KABOOOM!! your victim is vulnerable to sql injection and you can move further, and if not then just move on..

Error messages can be of different kinds, as an example:

Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

STEP #3

 Now, we need to find out the number of columns in the table. Do so by replacing the quote(') at the end of the url by order by n--.

yourvictim.com/xyz.php?id=2'
Then,
yourvictim.com/xyz.php?id=2 order by n--

Keep increasing the value of n from 1 until you get an error on your screen.

If you get an error message on say n=7 then 6 is the number of columns in table.

STEP #4

We, now,  need to find out the vulnerable columns which which we can inject with our queries.

For that :

1. Replace order by n-- with union all select 1,2,3,...n. Where n is the number of columns which we found in the previous step.
2. Add a - sign after id= . Example : id=2 -> id=-2 .

After, doing so you will be shown the number of  vulnerable columns.

Select any one column and start injecting your queries.

STEP #5

For injecting your queries, replace the number of the vulnerable column you selected with your query statement in the union all select statement in the url.

For example, say your vulnerable column is 2 and you want to find out out the name of the database. you can do so by replacing 2 with datbase().

TO find the version of mysql they using you can use query @@version.

Let us find out the name of the tables in the database. For this:

1. Replace the number of your vulnerable column with the statement : group_concat(table_name)
2. At the end of the URL i.e. after union all select 1,2,3..n add from information_schema.tables where table_schema=database()--

This will give you a list of all the tables in the database. If you are looking admin credentials look for a table with some relevant name like users, admins etc..

After Selecting the table, to find out the list of all the columns in the table. Replace :

1. group_concat(table_name) with group_concat(column_name)
2. information_schema.tables where table_schema=database()-- with information_schema.columns where table_name=mysql character for table name--

FIND MYSQL CHAR FOR TABLE NAME:

First, install the HackBar addon in firefox.

https://addons.mozilla.org/en-US/firefox/addon/3899/

Then, select  SQL->MySQL->My SQL CHAR()

A dialogue box will pop, enter the name of the table and click OK.

Now, Copy the paste it in the URL after table_name=

After executing this query you will be shown with the list of all the columns in the table. select any two columns and now to get the contents of these two columns . Replace :

1. group_concat(column_name) with group_concat(firstcolumnname,0x3a,secondcolumnname)
2.  information_schema.columns where table_name=mysql character for table name-- with table name--.

And you will be dumped with all the data of both the columns.

Say we are injecting on column no. 2 then our final query would look like :

yourvictim.com inurl:id=-1 union all select 1,group_concat(firstcolumnname,0x3a,secondcolumnname),3,4 from tablename--

CHEERS !!!