SQL Injection

Técnicas

Técnicas extraidas de 0x000000.com

Use inside login form: Variations: Blind injection vectors collection Beware of of the N rounds, add an extra zero and it could stall or crash your browser! Gathering info This evaluates the first char of the password hash from user 'root' which is 'a' (ASCII 97).

The hash is max 32 chars, and for every chars you'll need to execute the query with CHAR()

The way to extract hashes is done this way if single quotes are allowed, see beneath it a quoteless example. A quoteless example: Possible chars 0 to 9 - ASCII 48 to 57 ~ a to z - ASCII 97 to 122 Misc. Insert a new user into DB Retrieve /etc/passwd file, put it into a field and insert a new user.

Then login!

Write the DB user away into tmp

Change admin e-mail, for “forgot login retrieval.”

Bypassing PHP functions Bypassing addslashes() with GBK HEX encoding.

Using an HEX encoded query to bypass escaping. Inserting a new user in SQL. How to determin the HEX value for injection.

With comments. Bypassing mysql_real_escape_string() with BIG5 or GBK

(MySQL 4.1.x before 4.1.20 and 5.0.x)

Herramientas

Havij → http://www.itsecteam.com/products/havij-v116-advanced-sql-injection/

Havij http://www.taringa.net/comunidades/hackers/3552526/

PonyMagic http://poneymagic.diosdelared.com

General Injection Explorer

Safe 3 sql injector http://sourceforge.net/projects/safe3si/files/latest/download?source=directory

Enema http://code.google.com/p/enema/

Absinthe http://sourceforge.net/projects/absinthe/

Pangolin http://nosec.org/en/productservice/pangolin/

sql poison

sql map gui

bsql hacker http://labs.portcullis.co.uk/application/bsql-hacker/

Referencias

http://ha.ckers.org/sqlinjection/

http://www.antrax-labs.org/2012/01/sql-injection-desde-cero.html