2

When I put Username:anything and Password : 1'or'1'='1, my database retrieves the first row from MYSQL table. How do I retrieve the row corresponding to Username:anything? This is for a project in which I need to show all possible SQL vulnerabilities and rectify them.

1
  • 13
    If you want to fix all sql injection vulnerabilities, don't bother finding them. Replace every query with a parameterized query. Oct 24, 2014 at 8:14

2 Answers 2

3

Basically the sql would look like this:

select * from table
where username='anything' and pw='1' or '1'='1'

We know that 'and' has precedence over 'or' so:

 select * from table
    where (username='anything' and pw='1') or '1'='1'

So if the 'anything''s password is not '1' you will get the first row since '1'='1' is always true

UPDATE:
To get the result you want you have to change username value and so for password, I'm not sure but this is nearly the values you should inject:
username='anything ('
pw=1') or '1'='1'

1
  • Given that 'anything (' would (assuming it escaped the variable replacement) cause a syntax error, you need to add more Boolean checks. Personally, I'd probably swap out the ` or '1' = '1'` check for something that uses the desired username... Oct 24, 2014 at 10:29
0

Most probably the login sql query should look like this.

select * from table
where username='user' and password='pass'

Now your aim is to get the row corresponding to the value specified as the "username".

So for that just inject an UNION query,better not to be more confused with other methods.

Here below goes the value of "username" field.

' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So after injecting the final query will look like this.

select * from users where username='' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So if you wanna get the row of a specified user,just change the value 'ShihabSoft' to any other username.

And it is just for an example because you did't even specified the query in your question.So the number of columns in the UNION query may differ according the number of columns specified in the actual query.

3
  • 2
    No need for a UNION, ' OR username='…' --  suffices.
    – Gumbo
    Oct 25, 2014 at 9:36
  • Yo yo gumbo.If so why is the need of your injection point.Just put this someuser' -- in the username parameter to accomplish this.But iam always being informative and different.Jz eloborated things to more efficient injection point.
    – ShihabSoft
    Oct 25, 2014 at 10:33
  • But I don't know the table name, and even don't know column names.
    – learner
    Nov 10, 2014 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .