Friday, May 24, 2024

How to Perform Manual SQL Injection While Pentesting With Single Quote Error-Based Parenthesis Method

If you are trying to hack the databases with methods like single quotes error-based injection, Integer based injection, or double quotes method but the databases are not vulnerable to those methods Manual SQL Injection will fail and you cannot connect with the database.

In short, the error-based Manual SQL injection will use a single quote to break the query and join the query, Integer-based injection will be joining the query without the single quote and double quotes will be joining the query with double quotes.

So Today we are about to learn another method which is Single Quote Error Based Parenthesis in the MySQL database in order to perform Manual SQL Injection.

Manual SQL Injection Online Lab:

  • Beginners can use this website to practice skills for SQL injection.
  • To Access the LAB Click Here

STEP 1: Breaking the Query

  • Let me try out with error based single quote injection method

  • The above figure shows a double quote error based on not working.

  • The above figure shows that Integer-based injection not working.

  • The above figure shows single quotes are breaking the database so it’s vulnerable to SQL injection.

STEP 2: Copying the Error Statement 

  • Copy and Paste the SQL Error statement into Notepad.

  • The above figure shows that Highlighted single quotes with parentheses is breaking the backend database.
  • Now you can find out this is a Single quote error-based parentheses injection.

STEP 3: Joining the Query

  • Let us add –+ to join the query http://leettime.net/sqlninja.com/tasks/basic_ch4.php?id=1′) –+

  • The above figure illustrates SQL errors are fixed with –+

STEP 4: Finding the Backend Columns using Manual SQL Injection

  • It is time to have a conversation with the database to find the number of columns. To enumerate columns we can use order by command.

  • The above Figure shows the Database with the error statement Unknown column ‘5’ in ‘order clause and this error statement says as “There are only 4 columns in the database”.

STEP 5: Finding the Backend Tables  using Manual SQL Injection

  • SQL backend may contain more Tables names with empty data also. Therefore You should first be able to find out which table names are present in these 4 columns.
  • Now we can select all 4 columns with union all select to existing URL.

  • Number 2 is the right path for database names and more. Now we have successfully found out.

STEP 6: Finding the Backend Table Names using Manual SQL Injection

  • We already knew the location of the table path, so will directly ask database name, version etc

  • The above figures show the database name found is leettime_761wHole.

  • The above figures show the database version as 5.6.36-cll-lve

STEP 7: Dumping Database Tables

  • Group_concat() is the function that returns a string with the concatenated non-NULL value from a group.
  • So we can use this Function to list all Tables from the database.
  • In Addition, we can use Information_Schema to view metadata about the objects within a database.

  • The Above Figure shs the dump of all tables as testtable1, user logs, and users.

STEP 8: Dumping all Data in Columns of Tables

  • We can dump users

  • The Above Figure shows the dump of all columns of tables containing id, username, password,user_type, sec_code.

STEP 9: Dumping all Usernames

  • The Above Figure shows the dump of all usernames admin, decompiler, devilhunte, grayhat, injector, khan, Zen, Zenodermus.

STEP 10: Dumping all passwords

  • The Above Figure shows the dump of all passwords in the database. HAPPY HACKING !!!

Also Learn: Mastery Web Hacking and Penetration Testing Complete Bundle

Website

Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles