Getting started with SQL injection in "Skynet Labs"

[Email protected]

Date: January 17, 2015

Experimental platform: Skynet Ann Laboratory . Web application Security. SQL Injection Experiment One

Lab Environment: Apache+php+mysql

Experimental principle:

1. SQL injection is an attack that inserts or adds SQL code to an application's input parameters, and then passes those parameters to the SQL Server behind the scenes for parsing and execution.
2. The traditional handmade

(1) determine if there is an injection point

Method One:

After the URL adds ' to make an error in the SQL statement, the page will prompt for an error message. This is the time to judge the presence of injection from here. Of course there is the possibility of adding ', and not adding the same, which is also possible to inject. Because it is not displayed on the page when the error message is closed.

Method Two:

Construction and 1 = 1 and and 1 = 2

If two pages do not display the same, then there is an injection.

(2) Understanding the number of fields

Method:

Order by number K/** meaning is sorted according to the size of the K field, for example, if there are only 3 fields, K = 4, then an error will be given. So you can tell by this how many fields */

(3) Get information using federated queries

Method:

Using the Union statement

Experimental steps:

1. Warm-up exercises are not fortified:

Key code:

Target: Attempt SQL injection to get the user name and password in the database.

Determine if there is an injection:

Two times the display is not the same, there is injection.

Number of guessing fields:

Among them, Mysql has the following comments:

The purpose is to take the back ' comment out

So there are 5 of fields.

Guess field content:

Attention:

(1) The SELECT statement on either side of the Union must have the same number of columns, the columns must have similar data types, and the order of the columns in each SELECT statement must be the same.

(2)%23 is a # 16-bit URL encoding.

Getting started with SQL injection in "Skynet Labs"