How to get the output of a SQL injection?

Question

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something like:

username'; SELECT * FROM users;

But how can I get the input of my injection query? I did some research, and found sp_makewebtask in Microsoft SQL server, which can output .html file to a sharing folder. How can I do it in MySQL? Or is there a better way? Thanks very much.

Answer 1

The problem with your approach is that PHP is not going to (Okay, as pointed out below in the comments, it is possible, but it is unlikely) execute more than one simultaneous query and as you are closing off the initial query with a semi-colon, then trying to create a new one at the start of the SELECT. You would have to UNION or UNION ALL them.

username'; SELECT * FROM users;

Should be similar to:

username='admin' UNION ALL SELECT CONCAT(username, 0x3A, password) AS details FROM users LIMIT 0,1;

Read this link for MySQL's UNION syntax http://dev.mysql.com/doc/refman/5.0/en/union.html

There are two main types of SQL Injection, they are Blind and Error-based.

Blind is where you will not get any output from the given query, you may just notice a piece of text or image or something else missing from the page, and you have to enumerate through various options to get the desired result.

Error-based is, as the name suggests, where the script will throw an error, and you can see exactly what you need to do. You will see the result of the injection somewhere on the page or in the source code of the page at least.

In all cases, you should be able to use MySQL's INTO OUTFILE syntax to output the query results into a file, assuming you have the right permissions to do so.

http://www.tech-recipes.com/rx/1475/save-mysql-query-results-into-a-text-or-csv-file/

This is for most cases of MySQL injection, however, there are more than two types of SQLi, but for purposes of this conversation, they are the main ones you need to know about.

This is a good tutorial on SQL injections: http://www.exploit-db.com/papers/13045/

Answer 2

Well there are tools like SQLMap that will do it for you, unfortunately I am not smart enough to know exactly how they are getting that data. With SQLMap you can output a number of things like database names, table names, table columns, table data and more.

I can however give an example of how you can output data in a very specific scenario. You don't talk much about the context of your SQL Injection attack so it's hard to say if this will apply in your situation.

Say for example you have a webpage that outputs a small table like below:

Product Name  | Price   
----------------------
Door knobs    | $5.00
Hammers       | $10.00
Saws          | $12.00

Depending on how the underlying queries and programming are setup it may be possible to return other data that will then be displayed in that table. Say you determine that the search query string parameter is injectable in the URL below:

http://mysite.com/store.php?search=hardware

If you are able to craft a query like the one below (leaving attack in plain text for demonstration purposes):

http://mysite.com/store.php?search=blah';SELECT username, password FROM USERS where '1'='1

The site might be programmed in such a way that it just takes whatever two columns were returned and spits them out to the table.

Again, this is a very specific example. The SQLMap method seems to work regardless, so I would be interested to hear if anyone know what they are doing.

Answer 3

Usually, a value fetched from SQL is displayed somewhere on the page. So, for example, if the query is fetching a name (Select name from users where id=%s), inject something like 1;select top 1 columnname from (your query here);--. Depending on the database and implementation, there may or may not be a way to dump the full table with a single command (otherwise we can always enumerate the table rows).

In other cases, one can entice the app to display SQL errors. In that case, you can try to use the query (which returns a 1x1 output) as a column name, eg select (your query here) from somerandomtable;. Usually, this will return an error (because the column won't exist) where the proposed column name will be exposed.

Answer 4

You can do it by dropping it somewhere: SELECT ... INTO OUTFILE for instance. (http://dev.mysql.com/doc/refman/5.0/en/select-into.html)

After which point, you could overwrite a field by using load_file() which returns a file as a single string and populating a known field in a single row that is read and displayed by the application.

(eg: "UPDATE Accounts SET bio=load_file('/etc/passwd') WHERE UserName='prettypinkponi3s';"

You could even skip that step, and use an update directly in the original injection. And that's sorta the point.

If you are injecting blind, you can take advantage of the application's lack of input validation from the database to the rendering language. And you've gotta find some values that will allow you to hold the data you're trying to exfil. (Profile pictures, bios, description fields etc etc.)