SQL Injections are one of the most common (web) vulnerabilities. SQL injections come from a lack of encoding/escaping user-controlled input when included in SQL queries.
This example only offers us a way to understand if we are in fact testing a parameter which is susceptible to SQLi.
To test this if we change the parameter does it change the output? What if we use a single or double quote?
If we use the below string we can see that we have a point of injection.
In this example the use of spaces is blocked by the developer.
There are many ways to bypass this control however the easiest would be to use a \t tab character. We have to URL encode this though %09.
From here we can modify our payload so that it works.
Using the payload from the previous example we can see that the developer is onto our sneaky tricks and has added a control for tabs in our payload. What’s another way we can still get injection?
Here we start seeing some mitigation. However in this example it is poorly implemented.
mysql_real_escape_string – Escapes special characters in a string for use in an SQL statement. This is actually deprecated after PHP 5.5.0.
mysqli_real_escape_string – Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection.
For this example, we also have to deal with a regex which is looking to ensure that the ID parameter is an integer. However this is poorly implemented as the regex only checks to ensure that ID STARTS with an integer.
The above payload still works in this instance as the regex requirements are met. ID starts with an integer.
In this example we are adjusting the way we view the table with the ORDER BY MySQL statement. The ORDER BY statement cannot be used with values inside single quotes ' or double quotes ". If this is used, nothing will get sorted, since MySQL considers these as constants.
This is the final SQLi example, which is geared more around detection of there being an SQLi vulnerability. Here we can try using the IF statement to ascertain whether there is SQLi in this page or not.
Thanks all, I’ve really enjoyed going through these challenges. I hope you get something from them!