SQL injecting a search form which uses boolean mode

Question

I'm testing a web app and I could get Mysql errors by inserting ' in the search field:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' in boolean mode)' at line 1

However, when I do the usual test, entering " ' and 1=1-- " to the search field, I get this:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and 1=1--' in boolean mode)' at line 1

But this should have worked. I noticed that it appends " ' in boolean mode) " to every error it gives to me. My question is, what the problem is here and how I can get my statements performed, without getting this error?

Answer 1

I find that ' or 1=1-- is useful in less than 1% of sql injection that I come across, this payload is commonly seen in SQL Injection examples because it is a very simple statement. The problem that you are most likely experiencing is that your comment is incorrect. The -- needs to follow by a single space or it is not actually a comment, so ' or 1=1-- 1 is a comment that is compatible with many database types and it can survive a white-space trim. There are plenty of other mysql comments to choose from.

A better SQL Injection test for a MySQL database would be: ' or sleep(10)/*. If the page takes 10 second or more to load then its vulnerable, then follow up with ' or sleep(0)/* and it returns very quickly then you know it can be exploited with blind sql injection.

At this point I'm going to take that HTTP request and use SQLMap in wizard mode to exploit the vulnerability and dump the entire database. SQLMap can also perform file-io under MySQL using load_file() and into outfile. The interactive SQL shell mode is also very useful. If you want to debug a SQL payload without using it on your target I suggest sqlfiddle.