Thursday, June 13, 2024

How to Perform Manual SQL Injection With Double Quotes Error-Based String Method

If you are trying to hack the databases with methods like single quotes error-based Manual SQL Injection, Integer based injection but the databases are not vulnerable to those methods injection will fail and you cannot connect with the database.

In short, the error-based SQL injection will use a single quote to break the query and join the query, and Integer based injection will be joining the query without the single quote.

So Today we are about to learn another method which is double-quote injection in the MySQL database.

SQL Injection ONLINE LAB:

  • Beginners can use this website to practice skills for SQL injection
  • To Access the LAB Click Here.

STEP 1: Breaking the Query

  • Let me try out with error based single quote injection method http://leettime.net/sqlninja.com/tasks/basic_ch3.php?id=1′ 
  • The above figure shows the single quote error based on not working.
  • The above figure shows integer based method is also not working.
  • The above figure shows double quotes are breaking the database so it’s vulnerable to SQL injection

STEP 2: Copying the Error Statement

  • Copy and Paste the SQL Error statement into Notepad.
  • The above figure shows that Highlighted double quotes are breaking the backend database
  • When we add double quotes which are mismatching the query like this Select username, Password from the table where id =”1″”
  • Now you can find out this is a Double quote error-based string injection.

STEP 3: Joining the Query

  • Let us add  –+  to join the query http://leettime.net/sqlninja.com/tasks/basic_ch3.php?id=1″ –+
  • The above figure illustrates SQL errors are fixed with –+
  • Whatever malicious code is placed will talk with the database and as of now you have successfully broken the query, joined the query, and finally found out it is a Double quote error-based string injection.

STEP 4: Finding the Backend Columns

  • It is time to have a conversation with the database to find the number of columns. To enumerate columns we can use order by command.
  • The above Figure shows the Database with the error statement Unknown column ‘6’ in ‘the order clause and this error statement says as “There are only 5 columns in the database”.

STEP 5: Finding the Backend Tables

  • SQL backend may contain more Tables names with empty data also. Therefore You should first be able to find out which table names are present in these 5 columns.
  • Now we can select all 5 columns with union all select to existing URL
  • The above Illustrated Figure shows Username is: 2 as the value which represents table names is present in the 2nd column of the database. Now we have successfully found out the table location in Database

STEP 6: Finding the Backend Table Names

  • We already knew the location of the table path, so will directly ask database name, version, etc
  • The above figures show the database name as leettime_761wHole
  • The above figures show the database version as 5.6.36-cll-lve

STEP 7: Dumping Database Tables

  • Group_concat() is the function that returns a string with the concatenated non-NULL value from a group.
  • So we can use this Function to list all Tables from the database.
  • In Addition, we can use Information_Schema to view metadata about the objects within a database.
  • The Above Figure shows the dump of all tables as testtable1, userlogs, users.

STEP 8: Dumping all Data in Columns of Tables

  • We can dump userlogs
SQL Injection
  • The Above Figure shows the dump of all columns of tables containing id, username, action, date

STEP 9: Dumping all Usernames

  • Here we can dump all usernames in the database.
SQL Injection
  • The Above Figure shows the dump of all usernames Zen, Inj3ct0r, Zenodermus, decompiler

STEP 10: Dumping all Date

  • Now we can dump all date
SQL Injection
SQL Injection
  • The Above Figure shows the dump of all user-created dates in the database. HAPPY HACKING !!!
Website

Latest articles

Ivanti EPM SQL Injection Flaw Let Attackers Execute Remote Code

In May 24, 2024, Zero-Day Initiative released a security advisory for Ivanti EPM which...

CISA Warns of Scammers Impersonating as CISA Employees

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a surge...

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges

Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088.With a CVSS score of 8.8, this flaw affects Microsoft...

256,000+ Publicly Exposed Windows Servers Vulnerable to MSMQ RCE Flaw

Cybersecurity watchdog Shadowserver has identified 256,000+ publicly exposed servers vulnerable to a critical Remote...

Indian National Jailed For Hacked Servers Of Company That Fired Him

An Indian national was sentenced to two years and eight months in jail for...

JetBrains Warns of GitHub Plugin that Exposes Access Tokens

A critical vulnerability (CVE-2024-37051) in the JetBrains GitHub plugin for IntelliJ-based IDEs (2023.1 and...

Critical Flaw In Apple Ecosystems Let Attackers Gain Unauthorized Access

Hackers go for Apple due to its massive user base along with rich customers,...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles