So we're back with the same page that we discovered the first SQL injection with and I
said we'll get back to it because there is more that I want to do in here,
I want to show you how to to start retrieving data from the database.
So remember what we said at the start where we said this page
for example is loading products and what we wanna do is we want
to inject an SQL statement in it to load data from the users
table and hopefully get the user name and the password for the admin.
So even if the admin page is not vulnerable we'll be able to log in as a normal admin.
We can do this because we know that whatever we post, whatever we put in here
is being executed by the web application is being sent to
the database engine and the database engine is executing that query.
Therefore we want to add queries in here. That would be useful to us.
We're going to be using the union select queries to select data from the database but
before we do that we need to determine the number of columns that are being loaded.
And this also can be used to discover SQL injections anyway.
So this would be another thing that you should do to
verify that the target page is vulnerable to an SQL injection.
So we know that if we add a comma and one is equal to one, the page loads.
Normally if we add comma and page one is equal to zero.
We can see that the page is breaking.
Now another test we can do is we use the order by clause,
We can say I want to order by one
and as you can see now the page loads fine.
So we're saying we want to order by the first column,
but then if I say I want to order by a really high number,
so we know that there is no way there's
no way that this database contains this many columns.
But we're saying we want to order by this column and we're going to hit enter,
you'll see that the page will break.
So again,
this is another way for you to know if
this page is executing whatever SQL queries you're adding
but the order by can also be used to determine the number of columns.
So if we do order by one, the page loads, if we do order by a really big number,
the page breaks.
Now, what if we do order by five page breaks?
Again, that means there is less than five columns.
Let's do order by three page breaks again
and let's do order by two
and the page loads.
So now we know that there is only two columns being selected in here.
This is very simple in this example we only have two.
So you could have just started using your select statement with two columns,
but sometimes you have targets that might have 20
columns or 15 columns and I've had that before,
therefore
you would have to try 123456789, 10 all the way up to 20. Now it's a bit time consuming.
But obviously you can do it but this is a quicker way of doing it.
Also like I said,
it's a really good way for you to verify that the target is vulnerable.
The next thing you want to do,
once we know that we have two columns is start building up your Union select.
Now this is going to be the statement that we're
going to use to select data from the database.
So as you can see the back end itself is actually
using a select statement to select data from the database.
So we're going to be using another select statement that will be appended
to the existing select statement.
And therefore before we start using our select we're going to have to say union
because the union keyboard allows us to run
to select statements within the first query.
So as you can see the web application is using a select statement by itself.
And we're gonna be injecting our statement in here.
And that's why we're gonna say union first.
And then we're gonna build our statement.
So we're gonna say union select and then we need to see
where can we inject data so that we can see it on the page.
And that's why we usually do one and two because we want to
see where are we going to see one and two on the page.
If the page is vulnerable.
Now if we do that it's not gonna work. So let me show you what's gonna happen
in my courses when you when you would have done this if you have a valid SQL injection
and we know we have a valid SQL injection because we verified it using a number of ways
the page should have loaded normally and you should have seen
either one or two or both being displayed on the page
but in this case this is not happening because
the target is using a different database engine then my
SQL So in my courses I showed you how to do this with SQL in this example we don't
have my SQL now we still don't know what we have but we can see that this is not
working and therefore again I'm going to include the cheat
sheet but this comes with experience when this happens,
you can just do know instead of 12 just to verify again that
everything is working and again you're back the page is loading again.
So now that we know okay while our SQL
injection still works it's just it needs a different
way of exploiting it and it's probably using a
different database engine than what we're used to.
If you have also done my courses we need to see
where can we inject data in which of these can we inject data so that we can see it on
the page and that's why we usually do one and
two but we see that one and two doesn't work.
And therefore in this case so let me just do it here because it's bigger.
So we have null. Null.
And we want to see where can we inject data.
So instead of this null I'm gonna do a for example like this as a string.
So let's do that in here. So we're just gonna do a
and perfect.
So we know that anything that we put in here in the
first entry before the first comma whatever we put in here will
be displayed on the page and therefore if we substitute that with
an actual value that we want to select from the database,
it should be displayed in here.
So let me show you real quick again this goes back to the ticket.
Let me actually just load
that I want to show you in here.
So you can see like I said before you could
see the different type of comments that you can play with
the different ways you could select the database version.
So usually I would start with trying with my spl because that's the most common.
Again that's what you would have seen in my courses.
You should try the others but I know that this example is actually
postgres SQL therefore we're gonna put that in here in the A.
And we shouldn't have the quotes around it.
Hit enter.
So as you can see in here you have a very interesting entry
and in here you have the exact version of the database engine.
So now that we know if we want to exploit this further,
we need to use database queries that work with Postgres SQL,
you can also see the database engine is running on this version of Debian.
So obviously this could be very useful for post exploitation later on.
But going back to the cheat sheet now, if you want to get anything,
you're gonna scroll down to the postgres SQL queries.
Now, the next goal is to actually start selecting data from useful tables.
So hopefully from a users table that contains user names and passwords.