Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something like:

username'; SELECT * FROM users;

But how can I get the input of my injection query? I did some research, and found sp_makewebtask in Microsoft SQL server, which can output .html file to a sharing folder. How can I do it in MySQL? Or is there a better way? Thanks very much.

share|improve this question
6  
"This is just for learning purpose." That's what they all say ;) –  Luc Oct 9 '13 at 20:18

4 Answers 4

The problem with your approach is that PHP is not going to (Okay, as pointed out below in the comments, it is possible, but it is unlikely) execute more than one simultaneous query and as you are closing off the initial query with a semi-colon, then trying to create a new one at the start of the SELECT. You would have to UNION or UNION ALL them.

username'; SELECT * FROM users;

Should be similar to:

username='admin' UNION ALL SELECT CONCAT(username, 0x3A, password) AS details FROM users LIMIT 0,1;

Read this link for MySQL's UNION syntax http://dev.mysql.com/doc/refman/5.0/en/union.html

There are two main types of SQL Injection, they are Blind and Error-based.

Blind is where you will not get any output from the given query, you may just notice a piece of text or image or something else missing from the page, and you have to enumerate through various options to get the desired result.

Error-based is, as the name suggests, where the script will throw an error, and you can see exactly what you need to do. You will see the result of the injection somewhere on the page or in the source code of the page at least.

In all cases, you should be able to use MySQL's INTO OUTFILE syntax to output the query results into a file, assuming you have the right permissions to do so.

http://www.tech-recipes.com/rx/1475/save-mysql-query-results-into-a-text-or-csv-file/

This is for most cases of MySQL injection, however, there are more than two types of SQLi, but for purposes of this conversation, they are the main ones you need to know about.

This is a good tutorial on SQL injections: http://www.exploit-db.com/papers/13045/

share|improve this answer
    
Thanks for your anwser. I tried the "INTO OUTFILE", but where can I write the file to? Is there a public sharing folder or should I set up a one by myself? –  Jack Owen Oct 9 '13 at 21:22
    
That totally depends on the file system permissions I imagine. You could try /tmp, that should be writable –  DarkMantis Oct 9 '13 at 21:24
    
Just to clarify, he doesn't mention anything about PHP in his question, just general SQL Injection. Also you can do multi-statement queries in PHP (but you have to go out of your way to do it). Most other languages support multi-statement queries in some form as well. This is a good explanation though! –  Abe Miessler Oct 9 '13 at 21:26
1  
    
@DarkMantis Do I have to write the file to the server where the database resides? As far as I see, I don't have write permission to that server. –  Jack Owen Oct 9 '13 at 21:30

Well there are tools like SQLMap that will do it for you, unfortunately I am not smart enough to know exactly how they are getting that data. With SQLMap you can output a number of things like database names, table names, table columns, table data and more.

I can however give an example of how you can output data in a very specific scenario. You don't talk much about the context of your SQL Injection attack so it's hard to say if this will apply in your situation.

Say for example you have a webpage that outputs a small table like below:

Product Name  | Price   
----------------------
Door knobs    | $5.00
Hammers       | $10.00
Saws          | $12.00

Depending on how the underlying queries and programming are setup it may be possible to return other data that will then be displayed in that table. Say you determine that the search query string parameter is injectable in the URL below:

http://mysite.com/store.php?search=hardware

If you are able to craft a query like the one below (leaving attack in plain text for demonstration purposes):

http://mysite.com/store.php?search=blah';SELECT username, password FROM USERS where '1'='1

The site might be programmed in such a way that it just takes whatever two columns were returned and spits them out to the table.

Again, this is a very specific example. The SQLMap method seems to work regardless, so I would be interested to hear if anyone know what they are doing.

share|improve this answer
    
Tbh in my opinion you shouldn't really use a tool without knowing what it does, for example, did you know that SQLMap spams the logs with requests from "{SOME IP} - Location - Time - (SQLMap)" or similar. Also, your injection technique there is incorrect, it would have to be search=blah' UNION ALL SELECT username, password USERS LIMIT 0,1;#'rest-of-query. Good explanation though :) –  DarkMantis Oct 9 '13 at 21:10
    
I see your point. I also think that it's ok to use a tool when you don't understand 100% of how it works as long as you continue to try and understand it... I have the sqlmap source on my machine and when I am feeling adventurous I do poke around in it (and I have learned by doing that). –  Abe Miessler Oct 9 '13 at 21:18
2  
Oh sure, there are a lot of features in SQLMap that I couldn't do manually without reading up on the source code or taking a long time to investigate what's going on, but as long as you take the effort to learn and at least know the common injection techniques, that is a good start. –  DarkMantis Oct 9 '13 at 21:20

Usually, a value fetched from SQL is displayed somewhere on the page. So, for example, if the query is fetching a name (Select name from users where id=%s), inject something like 1;select top 1 columnname from (your query here);--. Depending on the database and implementation, there may or may not be a way to dump the full table with a single command (otherwise we can always enumerate the table rows).

In other cases, one can entice the app to display SQL errors. In that case, you can try to use the query (which returns a 1x1 output) as a column name, eg select (your query here) from somerandomtable;. Usually, this will return an error (because the column won't exist) where the proposed column name will be exposed.

share|improve this answer

You can do it by dropping it somewhere: SELECT ... INTO OUTFILE for instance. (http://dev.mysql.com/doc/refman/5.0/en/select-into.html)

After which point, you could overwrite a field by using load_file() which returns a file as a single string and populating a known field in a single row that is read and displayed by the application.

(eg: "UPDATE Accounts SET bio=load_file('/etc/passwd') WHERE UserName='prettypinkponi3s';"

You could even skip that step, and use an update directly in the original injection. And that's sorta the point.

If you are injecting blind, you can take advantage of the application's lack of input validation from the database to the rendering language. And you've gotta find some values that will allow you to hold the data you're trying to exfil. (Profile pictures, bios, description fields etc etc.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.