Friday, March 29, 2024

How to Perform Manual SQL Injection While Pentesting With Single Quote Error-Based Parenthesis Method

If you are trying to hack the databases with methods like single quotes error-based injection, Integer based injection, or double quotes method but the databases are not vulnerable to those methods Manual SQL Injection will fail and you cannot connect with the database.

In short, the error-based Manual SQL injection will use a single quote to break the query and join the query, Integer-based injection will be joining the query without the single quote and double quotes will be joining the query with double quotes.

So Today we are about to learn another method which is Single Quote Error Based Parenthesis in the MySQL database in order to perform Manual SQL Injection.

Manual SQL Injection Online Lab:

  • Beginners can use this website to practice skills for SQL injection.
  • To Access the LAB Click Here

STEP 1: Breaking the Query

  • Let me try out with error based single quote injection method

  • The above figure shows a double quote error based on not working.

  • The above figure shows that Integer-based injection not working.

  • The above figure shows single quotes are breaking the database so it’s vulnerable to SQL injection.

STEP 2: Copying the Error Statement 

  • Copy and Paste the SQL Error statement into Notepad.

  • The above figure shows that Highlighted single quotes with parentheses is breaking the backend database.
  • Now you can find out this is a Single quote error-based parentheses injection.

STEP 3: Joining the Query

  • Let us add –+ to join the query http://leettime.net/sqlninja.com/tasks/basic_ch4.php?id=1′) –+

  • The above figure illustrates SQL errors are fixed with –+

STEP 4: Finding the Backend Columns using Manual SQL Injection

  • It is time to have a conversation with the database to find the number of columns. To enumerate columns we can use order by command.

  • The above Figure shows the Database with the error statement Unknown column ‘5’ in ‘order clause and this error statement says as “There are only 4 columns in the database”.

STEP 5: Finding the Backend Tables  using Manual SQL Injection

  • SQL backend may contain more Tables names with empty data also. Therefore You should first be able to find out which table names are present in these 4 columns.
  • Now we can select all 4 columns with union all select to existing URL.

  • Number 2 is the right path for database names and more. Now we have successfully found out.

STEP 6: Finding the Backend Table Names using Manual SQL Injection

  • We already knew the location of the table path, so will directly ask database name, version etc

  • The above figures show the database name found is leettime_761wHole.

  • The above figures show the database version as 5.6.36-cll-lve

STEP 7: Dumping Database Tables

  • Group_concat() is the function that returns a string with the concatenated non-NULL value from a group.
  • So we can use this Function to list all Tables from the database.
  • In Addition, we can use Information_Schema to view metadata about the objects within a database.

  • The Above Figure shs the dump of all tables as testtable1, user logs, and users.

STEP 8: Dumping all Data in Columns of Tables

  • We can dump users

  • The Above Figure shows the dump of all columns of tables containing id, username, password,user_type, sec_code.

STEP 9: Dumping all Usernames

  • The Above Figure shows the dump of all usernames admin, decompiler, devilhunte, grayhat, injector, khan, Zen, Zenodermus.

STEP 10: Dumping all passwords

  • The Above Figure shows the dump of all passwords in the database. HAPPY HACKING !!!

Also Learn: Mastery Web Hacking and Penetration Testing Complete Bundle

Website

Latest articles

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles