Non-working approaches (multi-query, insert/delete/update)
mysql_query
doesn't support multi-query:
multiple queries are not supported
This means that appending another query via ;
to delete, edit, or insert data will not work. You are stuck with the select query you have.
We can also see that the selected data is not displayed, so you indeed have a blind injection.
Unlikely approach: Write a Shell File
Theoretically, you could try to write data to a file, for example to get a PHP shell. It might look something like this:
' UNION SELECT '<?php passthru($_GET['x']);' INTO OUTFILE '/var/www/404.php' -- -
It is however unlikely that you have sufficient permissions for this. You would not only need an SQL user that has the permission to write to a file and a directory that the mysql user can actually write to, but the mysql server would also need to be running without the --secure-file-priv
option, which isn't the case by default in modern systems.
Read Data Blind: Error Based
The above means that the only attack-vector is reading data from the database. If you are lucky, errors will be displayed to you.
If errors are displayed, you will simply need to create an error which contains the information you want to read. One way is to use extractvalue
:
' or extractvalue(1,version()) -- -
Instead of simply asking for the version, you can select table- and column-names from the INFORMATION_SCHEMA
. Once you find interesting tables, read the data.
Read Data Blind: Content Based
Maybe you were unlucky, and errors are not shown. You can still extract data by asking yes/no questions:
' AND substring(version(),1,1)='5
As you can see, the whole query including your injection will return true if the MySQL version is 5, and false otherwise. So depending on what happens - the script dies or it doesn't - you know what version MySQL is.
Instead of asking for the version, you can ask for other data, for example the first character of the password hash of the first user in the mysql users table.
You can optimize the approach by using ascii and asking if the value is larger or smaller than a certain number, and then narrow the window of possible character.
You will probably want to use a tool or custom script for actual exploitation though, as you will need a lot of requests.
Read Data Blind: Timing Based
Just for completeness sake: In case that you get no feedback at all (no banned message), you could still exploit injections into select based on the time it takes for a request to complete.
The idea is the same as content based exploitation, but instead of getting a different response, you will either perform a slow task or not:
' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23
Manually exploiting blind SQL injection in SELECT statement
because that would make it more applicable to other users (the attack vector is mostly irrelevant, the important part is that it's blind and into select; and also that it's PHP and MySQL, but that seemed too long for a title), and I would have removed the second code block to shorten the question (it's just a repetition).