SQLI-LABS SERIES PART-15

INJECTION IN THE INSERT QUERY

INJECTION IN HEADERS

In the earlier parts of the series we looked at the GET and POST based injections and dived into details on error based SQL Injections (string type, Integer type), Double Query injections error based, Blind injections (Boolean based and Time based) or use the outfile/dumpfile to dump the info in text files . In this part we would look at the injections in the Insert Query. For this we would look at the Less-17.
A general update query looks like

INSERT INTO table (col1,col2, col3) values (val1,val2, val3);

For the purpose of the lab, we would be using the Less-18 and Less-19. These are different Lessons as the injection is in the insert Query and that to in header fields. The Less-18 talks about the injection in the "useragent" field and the Less-19 talks about the injection in the "referrer" field.

"Less-18 - INJECTION IN THE USERAGENT FIELD"

"Less-19 - INJECTION IN THE REFER FIELD."

For the purpose of fuzzing these input points we need to write a script or use interceptor proxies like Tamper data (add on for Firefox), Burp suite, Fiddler, Zap, or any other tool which allows you to modify the headers on the fly.

These sort of injections where the Header fields are being inserted into the database, our focus is to check if the data can be extracted from it is certain way. Well blind is always an option and we can use Boolean or time based injections. The process works but is overall slow.

In cases where MySQL errors are displayed by the application, this can be used to dump the values efficiently and with much lesser number of queries as compared to Blind based. The logic of Double query injections is used to dump the info.

For more details and basics of the double query injections watch the other parts of the series.
the complete list can viewed here http://www.securitytube.net/user/Audi or directly watched on youtube at http://www.youtube.com/channel/UCiOdrhE67CR8lM0z2-_fe-A/videos

SQLI-LABS SERIES PART 13

INJECTION IN UPDATE QUERY

In the earlier parts of the series we looked at the GET and POST based injections and dived into details on error based SQL Injections (string type, Integer type), Double Query injections error based, Blind injections (Boolean based and Time based) or use the outfile/dumpfile to . In this part we would look at the injections in the update Query. For this we would look at the Less-17.

A general update query looks like

UPDATE TABLE SET PARAMETER-1="some value" WHERE  PARAMETER-2="some value";

In the general case, a front end for a password update or profile update would have this query working in the backend. During a pentest be extra careful while handling these queries, because one wrong test can update the complete production database with wrong values.

CAUTION: This is for educational purposes only, please do not use the skills you gain from following the video lessons, blog to harm or test sites on the internet for whom you do not have permissions. Doing so is illegal. I do not support these sort of activities and would advice you all to stay away from the same... If you do so you are solely responsible for your actions, you have been warned.

In the update statement injection, our objective is to extract info and not update the database, therefore we can use the the basics of

• Double query injection
• Blind injection
• Dumpfile/outfile to extract the information.

Basic query injections:
Less-17 Line number 97
$update="UPDATE users SET password = '$passwd' WHERE username='$row1'";