SQL Injection on LEIKAH

Database Enumeration

Mon, 01 Jan 0001 00:00:00 +0000

Database Enumeration and dumping is a crucial component of SQL Injection testing after the vulnerability has been confirmed. We can extract various sensitive data, user credentials, and much more.

Database Identification

The first step is to identify the type and version of Database Management Systems (DBMS) we are interacting with:

MySQL:

SELECT @@version;

MSSQL:

SELECT @@version;

PostgreSQL:

SELECT version()

Database User

It may also be beneficial to enumerate the user that the web application is authenticating to the database as.

SQL Injection

Mon, 01 Jan 0001 00:00:00 +0000

Web applications often interact with SQL databases to Create, Read, Update, and Delete (CRUD) data through SQL queries. SQL injection occurs when a malicious user attempts to pass input that changes the SQL query sent by the web application to the database. First, attacker has to inject code outside the expected user limit so it does not get interpreted as user input. This is accomplished by using a single or double quote to escape the limits of user input.

SQLi Manual Testing Methodology

Mon, 01 Jan 0001 00:00:00 +0000

Discover Injection Points

The first step in the methodology for testing SQL injection is identify injection points where user input would be passed into a SQL query, which can be:

HTTP GET/POST Parameters
UserAgent Strings
Cookies

We can try to insert the following SQL special characters into the query and see if they would produce a different response from the back-end:

'
"
`
)
))
\

If we see errors messages or different page responses, it means these characters are being interpreted as part of the SQL statement, potentially revealing a viable injection point.