[Detailed] SQL Injection Tutorial Part 2 [Explained] [SQLi] [WAFs] [String Injection]

This is the second part of my detailed SQLi explanation - simply because the thread as a whole is too big for one thread!

References
Normally references would go at the bottom of the page, but since this is the second part and you need a link to the first thread, I will put the rest of the online references here as well.

Part 1 - https://hackforums.net/showthread.php?tid=4398707
Text to URL Encoding/ASCII - http://www.w3schools.com/tags/ref_urlencode.asp
Text to hex - http://www.swingnote.com/tools/texttohex.php
OR
Download my FREE tool for simple conversion and UNION SELECT generation from here: https://hackforums.net/showthread.php?tid=4390594

If you do use my tool from the above link, please leave feedback on the thread to keep it alive, and any bugs/feature recommendations for version updates, thanks!

On to the tutorial!

Security
I'm fairly confident that you are testing various parts of this tutorial as you read it and you may be facing some problems to do with the website's security -if not, I'm confident that you have had problems with website security at other times in your hacking adventures. So, how much of a threat does 'security' actually impose on us while performing SQL Injection?

-Please note, parts of this section is talking about security as a general term, the actual outcome of some instances may differ with tougher consequences.-

WAF stands for Web Application Firewalls. WAFs are the main purpose you face the problems you do while attempting to perform various exploits against a website, including SQLi and XSS (Cross Site Scripting). WAFs can come in different shapes and sizes to protect against different vulnerabilities in different ways so you have to understand how specific ones work in order to bypass them quickly and efficiently.

Quite simply, WAFs block malicious attemps by analysing the requested URL or posted information from the user (in our GET SQLi examples, this would be the URL requsted from the browser, /login.php?id=7' ORDER BY 10-- for example). Fortunately, there are a few different ways you can bypass the parts of code it checks for - it only checks for static code such as the apostrophe symbol (') for example.

The first way I will explain is to simply encode various parts of your URL via ASCII/URL/Hex (depending on the form of injection you are using, and which part you are encoding). Take this example;
The website you are trying to SQLi is blocking your attempt to check if it is vulnerable by adding an apostrophe (') to the end of the PHP GET url, like so;
{Not my image, as I can't find a site with security right now}
Spoiler (Click to View)

In the above example, let's say our attempted URL is...

PHP Code 


<?php 
http://www.example.com/login.php?id=7' 

If we are lucky, simply changing the apostrophe (') to it's hex value (%27) {Reference to conversion tools at the start of this tutorial} could bypass the given security, and allow us access to the (hopefully) vulnerable page.

The second way I will explain, is to use simple caps alteration (I named the method, I don't know what the official name would be). As I said before, the WAFs check for static codes/words/phrases, so if the person who created or modified the WAF script(s) did not add proper code to check the requested URL, we could do something as simple as pressing shift for every other letter within our SQLi statement.

For example, let's say the following is detected, WAF analysed, and blocked...

PHP Code 


<?php 
http://www.example.com/login.php?id=7 ORDER BY 10-- 

Let's say that 'ORDER BY' keywords are detected and are causing the WAF script to generate an error and block our SQLi attempt. We can try the following...

PHP Code 


<?php 
http://www.example.com/login.php?id=7 OrDeR bY 10-- 

If the above works, you know to try caps alteration for other keywords, codes, or phrases which are blocked later on (if any!).

As an additional note; the proper way codes like these should be checked to avoid caps alteration techniques would be to convert the given text to all lower case, and then check that lowered cased string to another lower cased string, such as;

PHP Code 


<?php 
if ("order by" == "order by") {echo 'Blocked';} 

Instead of;

PHP Code 


<?php 
if ("ORDER by" == "order by") {echo 'Blocked';} 

String Injection
Some websites block the ability to perform non-string (mainly integer/boolean) statements while attempting SQL Injection, for these sites, you can try to use string injection (bet you didn't guess via the subtitle!).

Before I begin to show an example of an actual string injection, I'd like to explain exactly how using the appostrophe (') trick at the end of a PHP GET url tells us if the URL is vulnerable. Let's say we have the equivilent MySQLi query to the following Pseudo/theory...

Code 
First get the GET parameter of 'id'.

Throw the GET in to a variable.

Check the database for rows in the 'users' table where the column value of the row 'id' is the same as the GET parameter.

If would look something like this...

PHP Code 


<?php 
SELECT * FROM users WHERE id='$gotID' 

(In the above example, pretend we have already grabbed the GET parameter and put it in to a new variable named 'gotID').

So in a genuine example of loading, let's say a members profile page, it would look something like this;

PHP Code 


<?php 
URL: http://www.example.com/member.php?id=5
QUERY: SELECT * FROM users WHERE id='5' 

And here is an example of using the apostrophe (') trick at the end of the URL to check for vulnerabilities...

PHP Code 


<?php 
URL: http://www.example.com/members.php?id=5'
QUERY: SELECT * FROM users WHERE id='5'' 

Notice how the only difference between the two resulting queries is a simple apostrophe (')? That's to be expected, right?

As a general programming term, there should be an even amount of quotes, brackets, apostrophes, and braces making there an ending one to each starting one. For example, if we created a string, it would begin and end in a quote/apostrophe, like so;

PHP Code 


<?php 
$name = 'Yorkiebar'; 

If we ran the above code in a basic PHP environment, it would run perfectly fine because the syntax is correct. But, if we were to make the ending apostrophe (') in to a double, it would result in the following error;

{New declaration line}

PHP Code 


<?php 
$name = 'Yorkiebar''; 

{Error}

PHP Code 


<?php 
Parse error: syntax error, unexpected ''; ' (T_ENCAPSED_AND_WHITESPACE) in C:\xampp\htdocs\testing\test.php on line 2 

As you can see, the error is stating that because there is an odd amount of apostrophes (') [in this example], it is unable to continue with creating the variable correctly. So, going back to our MySQLi users query example, the page breaks simply because there is an odd amount of quotes/apostrophes which means the code following on from the inserted GET is now a string - therefore the ending of the line isn't recognised. If the input was filtered securely, the symbols would be stripped, or at least filtered, and so the page would not break because the string injection would not work. Get it? If not, here are some examples;

{Example - Standard query. Red=string, Blue=other}
SELECT FROM users WHERE id='5' ORDER BY 'desc'

As a side note, in this example, we are technically sorting a single row which would not make any difference. But it is just an example.

{Example - Injected query. Red=string, Blue=other}
SELECT FROM users WHERE id='5'' ORDER BY 'desc'

That was one long explanation, now we can actually move on to the string injection itself. It's fairly simple!

For each statement you perform, you simply keep the apostrophe (') at the end of the original query (to make your statement a string, therefore it's named 'string injection'). And instead of typing '--' at the end of the url type either '--+' or '--+-' depending on which one works best for you. There are others.

PHP Code 


<?php 
http://www.example.com/login.php?id=7' ORDER BY 10--+- 

Credits
This tutorial has taken me a VERY long time to create.

If you like this tutorial, please leave a reply to keep this thread alive.
Thanks!

Feel free to post some SQLi vulnerable sites in the replies to this thread so others can test this tutorial as they read it.

~Yorkiebar15 - HF~