SQL Injection : How to begin when the id parameter value is not numeric

Question

I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the 'id' parameter is numeric. eg: http://abc.tld/xyz?id=1

Now I have come across a situation where the id parameter value is a mixture of random characters and numbers.I tried generating an error using all the possible ways, from single quote to true and false queries to no success. I also thought it could be an encoded from something, hence tried to decode it as well using online converters. I don't need help solving the challenge, I need to know the various ways in which I can approach a URL like http://abc.tld/xyz?id=DETODHS35B5H56H.

Answer 1

The type of argument there should play no role in SQL injection other then how the SQL query is formed in the first place.

SQL injection abuses a SQL query being created from the parameter as a string. Web server treats the whole URL as a string and parses all the parameters as string as well. So even when the id is numeric, such as 1, it is treated by a web server as string and the code then inserts it as a string. This allows you to insert special characters, which would not be possible if only numbers were allowed.

However, there may be difference in the SQL query. When using string in a SQL query, the string has to be enclosed in single quotes '. Numbers can, but don't have to be. Number: SELECT * FROM Test WHERE id = $NUMBER; String: SELECT * FROM Test WHERE id = '$TEXT';

When you have a string enclosed in quotes, you have to close the quotes first. So for example you would send A'; DROP TABLES *;-- which would give you: SELECT * FROM Test WHERE id = 'A'; DROP TABLES *; --'. You can see the ' finishing the first ' so that your DROP TABLES *; command is treated as a command and not as text. The -- is used for comments in SQL and here we use it to get rid of the closing '. Otherwise, it would cause a malformed SQL query.

Please note that numbers CAN also use quotes in a query, so using this escaping method may be useful to try even if the site only uses numbers in the parameter. Also, depending on the SQL engine, other types of quotes then single quotes, such as double quotes may be usable, which would change how you have to escape them.

Answer 2

There is no difference here. You perform the SQL injection just as you would've done if the parameter value was numeric. However, seeing as your normal way of generating an error isn't working out, there's possibly some countermeasures in place. Detecting errors manually without having a trained eye can be tricky sometimes.

If you're still having trouble after considering everything I've said then maybe you should utilize something like sqlmap to assist you.