can anybody explain error based sql injection attacks

Question

I practice about error based sql injection but there isn't any good reference for it ..

for example :) :

mysql> select count(*),floor(rand()*2) as a from users group by a;
ERROR 1062 (23000): Duplicate entry '0' for key 'group_key'
mysql> select count(*),floor(rand()*2) as a from users group by a;
ERROR 1062 (23000): Duplicate entry '1' for key 'group_key'
mysql> select count(*),floor(rand()*2) as a from users group by a;
+----------+---+
| count(*) | a |
+----------+---+
|       10 | 0 |
|        3 | 1 |
+----------+---+
2 rows in set (0.00 sec)

why first and second query isn't run?

it's mean the value of first or second row of equals with a column?

so why when I change the query to this can't see any error massage :

mysql> select 1,floor(rand()*2) as a from users group by a;

+---+---+
| 1 | a |
+---+---+
| 1 | 0 |
| 1 | 1 |
+---+---+
2 rows in set (0.00 sec)

I can't underestand the error based sql injection vulnerability and also I see this link:http://bugs.mysql.com/bug.php?id=58081 but still I have a question !

How this vulnerability Occurs?

Thanks

Answer 1

The vulnerability is SQL Injection. Error-Based is just a method to make the error message Show Desired Data versus just error, for when we have a blind vulnerability that shows error, so we can extract sensitive data from the database directly (instead of one bit at a time).

So how does the query work?

select count(*),concat_ws(0x3a,database(),floor(rand()*2)) as a from users group by a

First, we need count(*) because we want the database to actually do the aggregate (group by) operation and don't optimize it out.

Second, we use concat_ws(0x3a just to make things look nicer. We can just use concat(DESIRED_DATA,floor(rand()*2)).

Okay, now lets get to the logic. concat(DESIRED_DATA,floor(rand()*2)) will give you different results based on each row of the database result, because that's how rand() works. It gives one random number between 0 and 1 for every row of output. Now since our random is confined to {0,1}, it only generates two values. If these two values are different (i.e., 0 and 1) then the query runs fine, and gives you the output you saw above.

However, if they both give the same number, then the group by will fail, because the group_key which was expected to be unique (it's the ID of the temporary result table) will be duplicate, and cause the database to err.

Now, Mysql likes to tell you what exactly is the duplicate value in that query, so it shows you the duplicate key, which will be the DESIRED_DATA concatenated by 1 or 0 (hence the 0x31 to separate them more nicely).

So the two trick parts, count(*) and rand() are both needed so that MySQL actually runs this multiple times, instead of just optimizing past it. But the trick is to create a temporary table that has duplicate keys, and let MySQL tell us about the value of that key in an error.

Answer 2

Error based sql injection takes advantage of poor error handling in an application.

When the application is returning you the mysql error, you find a way (usually it's with group by) to have the interesting data returned by mysql in the error.

In your example I can't see what information you are trying to obtain but look at this site, there are good examples there.

As you can see in the examples, each request is made to trigger an error. This error will contain the value wanted by the attacker. For example, the mysql version will be retrieved with the error "Duplicate entry 'MySQL version here' for key 1".

Answer 3

Error based SQL injection is useful when you have a page that runs a query where the output is not shown, but will display a database error if there is one. While you could also exploit this using blind SQLi the error based on offers a significant speed increase.

Exploitation is based upon injection a condition that will cause an error, type casting is often used:

• select 0+@@version
• select @@version/0

While any error can be used it is important that the data you wish to extract is evaluated, so you cannot use a syntax error.

I hope this helps you understand how error based SQLi works.