SQL Injection : How It Works
Lets get started at an apparently unrelated point. Lets assume we create a table in SQL. Now there are three main parts of a database management system, like SQL. They are –
- Creating structure of table
- Entering data
- Making queries (and getting meaningful results from data)
Now what they do is that they allow you to create a query using some sort of user friendly drop down based form which lets you select your budget, preferred company, etc. So basically, you, the user, can create queries and request data from their SQL servers without typing any code.
This is a clear indication that with intelligent design of URLs, we can send queries that will make the database ‘go berserk’ and malfunction, and give us all the otherwise private data of its tables. This attack can be used to obtain confidential data like a list of username and passwords of all users on a website.
- We have to find a website which is vulnerable to SQL injection (SQLi) attacks. Vulnerability has 2 criteria. Firstly, it has to allow execution of queries from the url, and secondly, it should show an error for some kind of query or the other. An error is an indication of a SQL vulnerability.
- After we know that a site is vulnerable, we need to execute a few queries to know what all makes it act in an unexpected manner. Then we should obtain information about SQL version and the number of tables in database and columns in the tables.
- Finally we have to extract the information from the tables.
- Manually using some standard codes available online (and if you know SQL then you can figure most of the stuff out yourself). For example, you can instruct the database to give you all the data from a table by executing the command-
SELECT * FROM Users WHERE UserId = 105 or 1=1
Now, while the first part of the query “UserID=105” may not be true for all user, the condition 1=1 will always be true. Basically the query asks the table to return all details of users for whom either user id = 105 or 1=1 (1 is always equal to 1, irrespective of the userId and all other factors). Effectively, you have the username and passwords and all other information about all the users of the website.
- Using some tool – Some tools help in making the process easier. You still have to use commands but using tools is much more practical after you have an idea what is actually happening. I don’t recommend all the GUI Windows tools which are found on malware filled websites, and never work. All throughout this blog we have used Kali Linux, and if you really are serious about hacking, there is no reason not to have Kali Linux installed. In Kali Linux, there is a great tool called SQLMap that we’ll be using.
Quick cool example
if ("abcd" == Username and "xyz" == Password) LoginSuccessful else LoginFailed
But wait, if a person enter username as “pqr” or 1==1 and password as “wxy” or 1==1, your code would check credentials in the following way –
|The first command is legit and gives you access to data of srinivas only, and only in the condition where the password is correct. The second statement gives you access to data of all accounts.|