13

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the address bar, nothing happens:

http://www.example.com/articles.php?id=-1' or 68 = '66; DROP ALL TABLES; --

I don't see why this isn't working. What is the correct text I must enter into the address bar to drop all the tables (and yes, I am testing this on a backup copy of the site)?

3
  • 1
    PHP and MySQL? What API do you use?
    – Gumbo
    Apr 7, 2013 at 16:18
  • @Gumbo, sorry, yes PHP and MySQL with mysqli.
    – Pamela
    Apr 7, 2013 at 16:39
  • 2
    Well, in case you use mysqli_query, you’re probably not allowed to execute multiple statements at once. You would need mysqli_multi_query instead.
    – Gumbo
    Apr 7, 2013 at 16:44

2 Answers 2

19

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.

You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). SQLMap and Havij are both tools that automate the exploitation of SQL Injection. SQLMap is a great tool with a wide range of features, and supports a wide verity of injections and DBMS'es.

1
  • 1
    I'm also rather fond of the tool 'Havij' which is quite simply 'Aim and Fire' in most cases
    – NULLZ
    Apr 11, 2013 at 14:51
0

If the site does not use apostrophes (') you can try this:

http://www.example.com/articles.php?id=-1; DROP ALL TABLES; --
2
  • 1
    It is still not working. It just displays the page as is.
    – Pamela
    Apr 7, 2013 at 16:36
  • 9
    Query stacking doesn't work in the real world, only in comic books and MS-SQL.
    – rook
    Jun 2, 2017 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.