Database Hacking
This is the second part of the previous writeup. If you have skipped the first part, it is recommended to read it first in order to understand and continue with this section.
Today, we will explore how to use SQL injection to interact with a database and list its contents.
After identifying the number of columns and which of them can hold string data, the next step is to determine the database type and version. We can use the SQL injection cheat sheet here.
After sending payloads, the result revealed the following information:
Get CyberLabyrinthX’s stories in your inbox
Join Medium for free to get updates from this writer.
the system is running PostgreSQL 12.22 on a 64-bit Ubuntu operating system. Specifically, Ubuntu 20.04.4 is the underlying OS, and the architecture (x86_64-pc-linux-gnu) confirms a 64-bit Linux environment. Additionally, the database was compiled using GCC 9.4.0, which provides further insight about everything.
Now that PostgreSQL has been identified, we can start sending database-specific payloads to enumerate table names and column names.
⚠️Sometimes payloads may not work as expected. In such cases, we can try sending them using different encoding techniques.
Now we can proceed to review the administrator account as well as other user accounts that were exfiltrated from the database.
