Please enable JavaScript.
Coggle requires JavaScript to display documents.
Web Hacking - Coggle Diagram
Web Hacking
SQLI
Process
3. DBMS 갯수 테이블 구조 등 확인
Example
SELECT * FROM Table WHERE Country='Mexico' and Address='Mataderos 2312';
위 경우 인젝션을 Country 변수에 해야 원하는 Injection 값이 나올 확률이 큼
2. DBMS Identification
[
NETSPI
] [
SQLInjection.net
]
Detecting what Database Management System (DBMS) is being used is critical in being able to further exploit an injection. Without that knowledge it would not be possible to determine what tables to query, what functions are built-in, and what detections to avoid. A successful response from the below queries identify that the selected DBMS is being used.
MySQL
String Concatenation
'abc' 'def' = abcdef
e.g) page.php?id=' 'mysql' --
Oracle
String Concatenation
'abc'||'def'=abcdef
e.g) page.jsp?id='||'oracle' --
SQL Server
String Concatenation
'abc'+'def'=abcdef
1. Injection Detection
[
NETSPI
]
Injections can be detected in a number of ways. The simplest being adding a ' or " after various parameters and getting a database error returned from the web server. The sections below describe where to find and how to detect these parameters.
GET - HTTP Request
POST - Form Data
POST - JSON
POST - XML
Word Filtering Bypass Method
OR, AND가 필터될때
[
상상E비즈-논리연산자
]
OR = ||
AND = &&
Example
index.php?no=1||1&id=guest&pw=guest
서버 쿼리[WHERE id='guest' AND pw='guest' AND no='1' OR no='1']
Hex
서버에서 숫자로 처리할때 사용가능한거 아닌가?
예) id=$input_id 이런식으로
MySQL Hex
[
상상E비즈-16진수
]
MySQL은 16 진수 값을 지원한다. 숫자 문장안에서 16진수 값은 정수처럼 동작을 한다 (64-비트 표현식). 반면에, 스트링 문자에서는 바이너리 스트링처럼 동작을 하며, 각각의 16진수 쌍은 하나의 문자로 변환된다
Example
mysql> SELECT 0x5061756c; → Paul
'(Single Quote)가 필터될 때
Whitespace(공백)가 필터될때
[
PortSwigger
]
Using Annotation[/**/]
e.g) 0/＊＊/or/＊＊/1 = 0 or 1
Using %09, %0a, %0b, %0c, %0d
e.g) no=1%09or%09id='admin'
Null Byte Injection
[
wiki
]
The ability to represent a null character does not always mean the resulting string will be correctly interpreted,
as many programs will consider the null to be the end of the string.
Thus the ability to type it (in case of unchecked user input) creates a vulnerability known as null byte injection and can lead to security exploits.
Example
Null Byte로 뒤 문자열을 무시하는 경우
[
티스토리
]
= 가 필터될때
Using like
[
티스토리
]
Tool
sqlmap
[
GitHub-사용법
] [
홈페이지 취약점 분석 이야기
]
(Partial) Commoness
(DBMS, Back-end etc)
Information Schema
[
wiki
] [
Google Cloud-사용법
]
In relational databases
, the information schema is an ANSI-standard set of
read-only views that provide information about all of the tables, views, columns, and procedures in a database.
implementation
Supporting RDBMS List
Apache Hive,
Microsoft SQL Server
,
MySQL
,
PostgreSQL
, H2 Database, HSQLDB, InterSystems Cache,
MariaDB
, Presto, MemSQL
Do not Supporting RDBMS List
Apache Derby, Firebird, Microsoft Access, IBM Informix, Ingres, IBM DB2,
Oracle Database
, SAP HANA,
SQLite
, Sybase ASE, Sybase SQL Anywhere, Teradata, Vertica
How To Use
Count Number of Databases
SELECT COUNT(*) FROM information_schema.SCHEMATA;
Insert Into
Abuse, Misuse
[
PortSwigger
] [
Webhacking.kr
]
Back-end
DBMS
Oracle
Injection Types
Blind Based Injection
[
NETSPI
]
Union Based Injection
Error Based Injection
Attack Queries
MySQL
DBMS Identification
String concatenation
where id='ad' 'min', = 'admin'
PHP
String Functions
addslashes()
[
w3스쿨
]
Returns a string with
backslashes
in front of predefined characters
(Single Quote('), Double Quote("), Backslash(), NULL)
Used to prepare a string for storage
[Bypass]
멀티바이트로 인코딩인 경우의 우회
[
블로그
] [
SK인포섹 블로그
]
Substr와 함께 쓰인 경우 우회
[
티스토리
]
RegEx(Regular Expression) Functions
Regular expressions allow you to search for and replace patterns in strings
preg_match()
[
TCP스쿨-정규식표현
] [
블로그
]
[
테스트사이트1
] [
테스트사이트2
]
[
테스트사이트3
]