SQL injection UNION attack
SQL injection is a web security vulnerability where an attacker can manipulate a database query by injecting malicious SQL code into user input fields (like login forms, search boxes, URL parameters).
How to Find SQL Injection
You start by paying attention to anywhere the app accepts data URLs, login forms, search boxes, filters. If that input is used to query a database, it becomes a potential entry point. And you can start to test SQL injection manually using a systematic set of tests against every entry point in the application.
When an application is vulnerable to SQL injection, and the results of the query are returned within the application’s responses, you can use the UNION Attack to retrieve data from databases.
To successfully perform a UNION-based SQL injection attack, two key things must be identified; otherwise, the attack will fail. First, you need to determine the exact number of columns returned by the original query. This is essential because the UNION operator requires both queries to return the same number of columns. Second, you must identify which of those columns can accept and display string data. This allows you to inject and retrieve meaningful information, such as usernames or passwords. Without satisfying these two conditions, a UNION attack cannot be executed successfully.
To determine the number of columns in a query, I used the ORDER BY method by incrementing the column index step by step. For example, I tested inputs like ORDER BY 1--, then ORDER BY 2--, and continued increasing the number until an error message appeared. The point at which the error occurs helps identify the total number of columns. This is the first method for finding the column count.
Another method is using UNION SELECT NULL. In this approach, we incrementally add NULL values in the UNION query, such as UNION SELECT NULL, UNION SELECT NULL, NULL, and so on, until the error message disappears. When the query executes successfully without errors, it indicates that the correct number of columns has been matched.
The key difference is that with ORDER BY, we increase the column index until an error appears, whereas with UNION SELECT NULL, we keep adding NULL values until the error disappears.
Get CyberLabyrinthX’s stories in your inbox
Join Medium for free to get updates from this writer.
When performing SQL injection, it’s important to understand that different database systems use slightly different SQL syntax. Because of this, your injected queries must match the specific database you are targeting.
For example, if the application is using an Oracle database (developed by Oracle Corporation), every SELECT statement include a FROM clause. Oracle provides a special built-in table called DUAL for this purpose. That’s why, when crafting a UNION-based payload in Oracle, it typically looks like:
‘ UNION SELECT NULL FROM DUAL —
For more detailed information about how SQL injection syntax differs across databases like PostgreSQL, MySQL, and others including differences in comment styles you can refer to a SQL injection cheat sheet here.
After identifying which columns can hold string data, the next step is usually to enumerate the table names and column names in the database. However, in this case, since I already knew the table and column names, I can proceed directly to extracting data from those columns.
After extracting the credentials from the database, I validated them by attempting to authenticate to the application. Using the retrieved username and password, I successfully logged in as the user Wiener and administrator.
Read the rest here:
https://cyberlabyrinthx.medium.com/database-hacking-95876a79d11d
