Thursday, March 13, 2014

SQL Injection : How It Works

Introduction

Lets get started at an apparently unrelated point. Lets assume we create a table in SQL. Now there are three main parts of a database management system, like SQL. They are -
  • Creating structure of table
  • Entering data
  • Making queries (and getting meaningful results from data)
So, when SQL is used to display data on a web page, it is common to let web users input their own queries. For example, if you go to a shopping website to buy a smartphone, you might want to specify what kind of smartphone you want. The site would probably be storing data about phones in table with columns like Name, Price, Company, Screen Size, OS, etc.
Now what they do is that they allow you to create a query using some sort of user friendly drop down based form which lets you select your budget, preferred company, etc. So basically, you, the user, can create queries and request data from their SQL servers without typing any code. 
This automated method of creating queries for you is relatively safe (since it doesn't give you a lot of flexibility in terms of what queries you can create, you are limited by the syntax of queries they have decided). However, there is another method of creating queries which can be exploited by us. 
A url ending in .php is a direct indication that the website/blog uses sql to deliver a lot of it's data, and that you can execute queries directly by changing the url. Usually the data in the SQL tables is protected and can be viewed directly only by certain people (admins etc.). However, when we send some rogue commands to the SQL server, it doesn't understand what to do, and returns an error.
This is a clear indication that with intelligent design of URLs, we can send queries that will make the database 'go berserk' and malfunction, and give us all the otherwise private data of its tables. This attack can be used to obtain confidential data like a list of username and passwords of all users on a website.

Steps

  1. We have to find a website which is vulnerable to SQL injection (SQLi) attacks. Vulnerability has 2 criteria. Firstly, it has to allow execution of queries from the url, and secondly, it should show an error for some kind of query or the other. An error is an indication of a SQL vulnerability.
  2. After we know that a site is vulnerable, we need to execute a few queries to know what all makes it act in an unexpected manner. Then we should obtain information about SQL version and the number of tables in database and columns in the tables.
  3. Finally we have to extract the information from the tables.
Vulnerabilities are found using your own creativity along with famous dorks (more on this in a later tutorial)
For the 2nd and 3rd step, there are 2 ways to do them-
  • Manually using some standard codes available online (and if you know SQL then you can figure most of the stuff out yourself). For example, you can instruct the database to give you all the data from a table by executing the command- 
SELECT * FROM Users WHERE UserId = 105 or 1=1
Now, while the first part of the query "UserID=105" may not be true for all user, the condition 1=1 will always be true. Basically the query asks the table to return all details of users for whom either user id = 105 or 1=1 (1 is always equal to 1, irrespective of the userId and all other factors). Effectively, you have the username and passwords and all other information about all the users of the website.

  • Using some tool - Some tools help in making the process easier. You still have to use commands but using tools is much more practical after you have an idea what is actually happening. I don't recommend all the GUI Windows tools which are found on malware filled websites, and never work. All throughout this blog we have used Kali Linux, and if you really are serious about hacking, there is no reason not to have Kali Linux installed. In Kali Linux, there is a great tool called SQLMap that we'll be using.

Quick cool example

Now suppose you develop a web app. Here are the credentials for login-
Username : abcd
Password : xyz

Now, for login, you have the following condition:

if ("abcd" == Username and "xyz" == Password) 
    LoginSuccessful
else
    LoginFailed

Now if someone enters Username which is different from abcd or password which is different from xyz, then he won't be able to login. Seems to be fine.

But wait, if a person enter username as "pqr" or 1==1 and password as "wxy" or 1==1, your code would check credentials in the following way -
("abcd"=="pqr" or 1==1) and ("xyz" == "wxy" or 1==1)
Let's translate that into boolean. 1==1 is true obviously, abcd==pqr is not true, nor is xyz==wxy. So, we get,
(false or true) and (false or true)
which becomes
true and true
which becomes
true
So, the person logged into your web app without knowing the username or password.

PS: The example here grossly simplifies a lot of things, but taking care of all details would make this more complicated than it has to be for a first tutorial in SQL injection (coming tutorials are more syntactically correct).
The first command is legit and gives you access to data of srinivas only, and only in the condition where the password is correct. The second statement gives you access to data of all accounts.
That's it for this tutorial, you now know how SQL Injections work. It might be worth your time learning some SQL on W3schools till I come up with some other tutorial. Also, check out the navigation bar at the top of the blog to see if you find something that interests you. We have a lot of tutorials for beginners in the field of hacking.
If you would like to go ahead, then here is the next tutorial in the SQL injection series-

Hacking Websites Using SQL Injection Manually

Also, a tutorial on automated Sql injection is finally here. Take a look

Sql Injection Using sqlmap in kali linux

57 comments:

  1. I Live Your Lessons

    I hope Add video lessons

    ReplyDelete
  2. Great hacker you are!!!

    ReplyDelete
  3. Hi How Are you
    I know that here use linux
    but I happen to have a problem with sqlmap recently installed Windows 8.1 along with Python 2.7, but when you open the cmd and type command sqlmap.py -u http: //www.teamger.us / store.php? ID = 1 --dbs throws me an error on a notepad
    Link: /// file G: / Error sqlmap.py
    I hope you can help me with this problem. Thank you

    ReplyDelete
  4. SELECT * FROM Users WHERE UserId = 105 or 1=1

    ReplyDelete
  5. SELECT * FROM Users WHERE UserId = 105 or 1=1

    ReplyDelete
  6. i just wanna know how do I or where do i type the sql command?

    ReplyDelete
    Replies
    1. Most of the time, you type it in the URL bar, where you type website address (after the .php in the address). Sometimes some form fields can also be used.

      Delete
  7. comment je peux pirater un compte facebook

    ReplyDelete
  8. The link 'Sql Injection Using sqlmap in kali linux' redirects to the wrong page.

    Thanks for the tutorials

    ReplyDelete
  9. This information is impressive; I am inspired with your post writing style & how continuously you describe this topic. After reading your post, thanks for taking the time to discuss this, I feel happy about it and I love learning more about this topic. Love Quotes ||Love quotes for him ||Love quotes for her

    ReplyDelete

  10. Appreciating the hard work you put into your site and detailed information you offer. It’s nice to come across a blog every once in a while that isn’t the same out of date rehashed material, Asking questions are truly good thing if you are not understanding something fully, except this article presents pleasant understanding yet, Please stay us informed like this. Thank you for sharing.

    This information is impressive; I am inspired with your post writing style & how continuously you describe this topic. After reading your post, thanks for taking the time to discuss this, I feel happy about it and I love learning more about this topic.

    great faith quotes||faith quotes bible||faith quotes images

    ReplyDelete
  11. CamYogi offers you the opportunity to book the best wedding photographers in Kolkata who have the experience and expertise to beautifully frame the precious moments of your special day.

    Find Out More at:http://camyogi.in/Kolkata

    ReplyDelete
  12. Emailnphonelist is your go-to list broker for all your online business as well as consumer lists. We are a team of data brokers who started in 2011. Moreover, we are considered as one of the very few trusted mailing list brokers online for lead generation.
    Find out more at:- https://emailnphonelist.com

    ReplyDelete
  13. Excellent Post as always and you have a great post and i like it
    โปรโมชั่นGclub ของทางทีมงานตอนนี้แจกฟรีโบนัส 50%
    เพียงแค่คุณสมัคร Gclub กับทางทีมงานของเราเพียงเท่านั้น
    ร่วมมาเป็นส่วนหนึ่งกับเว็บไซต์คาสิโนออนไลน์ของเราได้เลยค่ะ
    สมัครสมาชิกที่นี่ >>> Gclub online

    ReplyDelete
  14. This is really good blog information thanks for sharing .I am really impressed with your writing abilities

    เว็บไซต์คาสิโนออนไลน์ที่ได้คุณภาพอับดับ 1 ของประเทศ
    เป็นเว็บไซต์การพนันออนไลน์ที่มีคนมา สมัคร Gclub Royal1688
    และยังมีเกมส์สล็อตออนไลน์ 1688 slot อีกมากมายให้คุณได้ลอง
    สมัครสมาชิกที่นี่ >>> Gclub Royal1688

    ReplyDelete
  15. Amazing nice work. This is very useful article. Thank you. For more

    ReplyDelete
  16. Great work. Very useful information. If you want to know more about this Search here

    ReplyDelete
  17. Coolest Quotes. This is one of the best article I have ever read

    ReplyDelete
  18. That a really god article. You blog is awesome.
    funny status

    ReplyDelete
  19. It is truly a nice & useful piece of info. I am glad that you just
    shared this useful information with us. Please stay
    us up to date like this.
    Thanks for sharing.
    Friends Group Names

    ReplyDelete
  20. I think your site has one of the cleanest theme I’ve came across. It really helps make reading your blog a lot easier
    wonderful article it is really good.
    FBW

    ReplyDelete
  21. I think your site has one of the cleanest theme I’ve came across. It really helps make reading your blog a lot easier
    wonderful article it is really good.
    5bestproduct

    ReplyDelete
  22. wonderful article it is really good.
    WTechni
    Hindi Me Jankari. get knowledge about blogging, SEO, Computer, Make Money. I think your site has one of the cleanest theme I’ve came across. It really helps make reading your blog a lot easier

    ReplyDelete
  23. It is truly a nice & useful piece of info. I am glad that you just
    shared this useful information with us. Please stay
    us up to date like this.
    Thanks for sharing.
    Groupon Customer Service Number

    ReplyDelete
  24. If you want to buy products which is of daily use like headphone, earphone, Kitchen wares like refrigerators, cook top, and air conditioners then our post can really help you choose the best one for you. So you must visit the Techyji - Buy the Right product. Be happy fill your home with these products.

    ReplyDelete
  25. I think your site has one of the cleanest theme I’ve came across. It really helps make reading your blog a lot easier
    wonderful article it is really good.
    5bestproduct

    ReplyDelete
  26. Cool Te Amo Status. This is one of the best article I have ever read

    ReplyDelete
  27. filmyhit provides an tips and tricks,

    technology,product keys and latest how to guide stuff. While providing all this, we foresee

    ourselves to be known as the best digital marketing. Here you will get 9xmovies etc. are some of the subjects to name that we

    cater our users in bolly4u tricks. We were recently

    recognised as the most reliable and dependable digital marketer for UrgroveMovies , and also voted as the Numero Uno

    assignment provider for the past two years. The Online website have been using their past

    experience and knowledge in order to supply the users with high quality content,essays,

    thesis,reports, journals and technolgy, Cinevood

    reflections, case study analysis, etc. There are many websites in the internet which functioning at

    skyrocketed prices.

    ReplyDelete
  28. Tricksnhub provides an tips and tricks, technology, product

    keys and latest how to guide stuff. While providing all this, we foresee ourselves to be known as

    the best digital marketing website on the web. Here you will get Movierulz and Extramovies etc. are some of the subjects to name

    that we cater our users in Tamilrockers tricks.

    We were recently recognised as the most reliable and dependable digital marketer for Filmora Key ,and

    also voted as the Numero Uno assignment provider for the past two years. The Online website have

    been using their past experience and knowledge in order to supply the users with high quality

    content,essays, thesis, reports, journals and Extratorrent Proxy technolgy, Kickass Proxy reflections, case study analysis, etc. There are

    many websites in the internet which functioning at skyrocketed prices. Be it tricksnhub, 1337x Proxy marketing or,

    computer science assignment help, taxation assignment help; we proffer our expert guidance in all

    of the assignments.

    ReplyDelete
  29. hi sir this is information really good really thanks skymovies please please share some information like this information again thanks for share this information.

    ReplyDelete
  30. wow ! What a great content! I found your blog on google and loved reading it greatly. It is a great post indeed. Much obliged to you and good fortunes. keep sharing.
    whatsapp status quotes

    ReplyDelete

  31. wow ! What a great content! I found your blog on google and loved reading it greatly. It is a great post indeed. Much obliged to you and good fortunes. keep sharing.


    Latest Whatsapp Status Dp 2020

    ReplyDelete
  32. Thank you for sharing your expertise. This post is very helpful.
    jokes in hindi

    ReplyDelete
  33. It is truly a nice & useful piece of info. I am glad that you just
    shared this useful information with us. Please stay
    us up to date like this.
    Thanks for sharing.

    Funny Pick Up Lines

    ReplyDelete
  34. wow ! What a great content! I found your blog on google and loved reading it greatly. It is a great post indeed. Much obliged to you and good fortunes. keep sharing.
    lws quotes

    ReplyDelete
  35. Writing articles that are very interesting and very neat, at first I did not understand how to write good articles,
    after I saw your website I began to learn and understand how to write the right articles.
    Thank you foWriting articles that are very interesting and very neat, at first I did not understand how to write good articles,
    after I saw your website I began to learn and understand how to write the right articles.
    Thank you for giving a very good example of writing, I will often come to your website to learn how to write like the one on your website.
    Satta king 2019
    r giving a very good example of writing, I will often come to your website to learn how to write like the one on your website.
    Satta king 2019

    ReplyDelete
  36. Sarkari Naukri Live Updates

    Sarkari Naukri Live Updates: Many Government Organizations including Central, States, PSUs, , Railway, SSC and others usually release government jobs notifications for various catBanksegories. These Jobs required different Eligibility Criteria and government jobs seekers from 10th Pass to Graduate and Higher Qualification aspirants.

    Various leading Government organizations releases daily different Government jobs and our effort is to provide you the platform where you can get entire essential information’s regarding these notifications on time.

    These Job Notifications are useful for all government job seekers from 10th to Graduate and also higher qualification aspirants. Just give a look for these job notifications which have been released today by Haryana Staff Selection Commission (HSSC) and Uttar Pradesh Public Service Commission (UPPSC) for various posts.

    Government Jobs Live Updates:

    3.30 P.M.: Syndicate Bank-06 Specialist Officer Posts, Last Date-05 September 2019
    Syndicate Bank has invited applications for the post of Senior Manager under Specialist Officer Dealer Posts. The eligible candidates can apply to the post through the prescribed format on or before 05 September 2019...Read Details Notification Here…

    3.00 P.M.: University of Delhi-108 Assistant Professor Posts, Last Date-20 September 2019
    University of Delhi (DU) has invited applications for the Assistant Professor (Kalindi College) Posts. Eligible candidates can apply for the post through the Online on or before 20 September 2019….Read Details Notification Here….

    2.30 P.M.: UPPSC-Assistant Professor Posts, Last Date-26 September 2019
    Uttar Pradesh Public Service Commission (UPPSC) has issued notification for Recruitment of Assistant Professor and other posts in Medical Education Department (Allopathy). Interested candidates can apply for these posts on or before 26 September 2019..Read Details Notification Here

    2.00 P.M.: HSSC-3864 PGT Posts-Last Date-18 September 2019
    Haryana Staff Selection Commission (HSSC) has released a recruitment notification for 3864 PGT Vacancies for various schools in the state against the Advt. No 13/2019.. Read Details Notification Here

    If you are Government Jobs seekers then you can get latest Government jobs notifications with live updates. You can get the latest Government Jobs Update frequently with timely Updates on regular frequency. Government jobs such as State and Central Government Jobs, PSU Jobs, Railway, SSC, Banks, Defence Jobs, Army, Navy, Air Force etc.
    You can say every single govt. jobs you can here. We will provide you the all the essential job queries relating to every Government jobs such as-Last Date, Educational Qualification, Age Limit, Application Process, How to Apply etc.
    Apart from these, you can get here the latest Government jobs divided with the various filters like education, board, location, experience, qualification etc which save your time and will provide you the jobs needed for your demand.

    ReplyDelete
  37. hey very nice article good and great information you have shared here thanks for sharing htis with us
    Satta King 2019

    ReplyDelete

© Kali Tutorials, 2016. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Shashwat Chaudhary and Kali Tutorials with appropriate and specific direction to the original content.
Bitcoin: 1B5aLqJcMW7zznffTxQwta8JTZsxBDPguC