Quantcast

How Bad Guys Hack into Websites Using SQL Injection

Get the WebProNews Newsletter:
[ Business]

SQL Injection is one of the most common security vulnerabilities on the web. Here I’ll try to explain in detail these kinds of vulnerabilities with examples of bugs in PHP and possible solutions.

If you are not so confident with programming languages and web technologies you may be wondering what SQL stands for. Well, it’s an acronym for Structured Query Language (pronounced “sequel”). It’s “de facto” the standard language to access and manipulate data in databases.

Nowadays most websites rely on a database (usually MySQL) to store and access data.

Our example will be a common login form. Internet surfers see those login forms every day, you put your username and password in and then the server checks the credentials you supplied. Ok, that’s simple, but what happens exactly on the server when he checks your credentials?

The client (or user) sends to the server two strings, the username and the password.

Usually the server will have a database with a table where the user’s data are stored. This table has at least two columns, one to store the username and one for the password. When the server receives the username and password strings he will query the database to see if the supplied credentials are valid. He will use an SQL statement for that that may look like this:

SELECT * FROM users WHERE username='SUPPLIED_USER' AND password='SUPPLIED_PASS'

For those of you who are not familiar with the SQL language, in SQL the ‘ character is used as a delimiter for string variables. Here we use it to delimit the username and password strings supplied by the user.

In this example we see that the username and password supplied are inserted into the query between the ‘ and the entire query is then executed by the database engine. If the query returns any rows, then the supplied credentials are valid (that user exists in the database and has the password that was supplied).

Now, what happens if a user types a ‘ character into the username or password field? Well, by putting only a ‘ into the username field and leaving the password field blank, the query would become:

SELECT * FROM users WHERE username=''' AND password=''

This would trigger an error, since the database engine would consider the end of the string at the second ‘ and then it would trigger a parsing error at the third ‘ character. Let’s now see what would happen if we would send this input data:

Username: ' OR 'a'='a Password: ' OR 'a'='a

The query would become SELECT * FROM users WHERE username='' OR 'a'='a' AND password='' OR 'a'='a'

Since a is always equal to a, this query will return all the rows from the table users and the server will “think” we supplied him with valid credentials and let as in – the SQL injection was successful :).

Now we are going to see some more advanced techniques.. My example will be based on a PHP and MySQL platform. In my MySQL database I created the following table:

CREATE TABLE users ( username VARCHAR(128), password VARCHAR(128), email VARCHAR(128))

There’s a single row in that table with data:

username: testuser password: testing email: testuser@testing.com
To check the credentials I made the following query in the PHP code:

$query="select username, password from users where username='".$user."' and password='".$pass."'";

The server is also configured to print out errors triggered by MySQL (this is useful for debugging, but should be avoided on a production server).

So, last time I showed you how SQL injection basically works. Now I’ll show you how can we make more complex queries and how to use the MySQL error messages to get more information about the database structure.

Lets get started! So, if we put just an ‘ character in the username field we get an error message like You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ”” and password=”’ at line 1

That’s because the query became

select username, password from users where username=''' and password='' What happens now if we try to put into the username field a string like ‘ or user=’abc ? The query becomes

select username, password from users where username='' or user='abc ' and password=''

And this give us the error message Unknown column ‘user’ in ‘where clause’

That’s fine! Using these error messages we can guess the columns in the table. We can try to put in the username field ‘ or email=’ and since we get no error message, we know that the email column exists in that table. If we know the email address of a user, we can now just try with ‘ or email=’testuser@testing.com in both the username and password fields and our query becomes

select username, password from users where username='' or email='testuser@testing.com' and password='' or email='testuser@testing.com'

which is a valid query and if that email address exists in the table we will successfully login!

You can also use the error messages to guess the table name. Since in SQL you can use the table.column notation, you can try to put in the username field ‘ or user.test=’ and you will see an error message like Unknown table ‘user’ in where clause

Fine! Let’s try with ‘ or users.test=’ and we have Unknown column ‘users.test’ in ‘where clause’

so logically there’s a table named users :).

Basically, if the server is configured to give out the error messages, you can use them to enumerate the database structure and then you may be able to use these informations in an attack.

Add to | DiggThis | Yahoo! My Web

Technorati:

The author is a 23-year-old coder. He specializes in computer security, C and PHP coding, networking and server administration.

How Bad Guys Hack into Websites Using SQL Injection
Top Rated White Papers and Resources
  • Guest

    its not working.. perhaps the site iam trying to hack has tremendous security

  • Guest

    well, i have an Ip that i want to hack, username and a password, but it says that i m not allowed as a member. How can i change my ip, or idk? make something that allows me to entry?

  • Nemesis

    Hi. I want to hack my university’s "student information database". Well the problem is, one can only be able to hit tha database only if he is using university’s computer. The server uses a student ID and a seven digit password. The first three digits of everyone’s password are ‘uiu’ and other four is numeric (0-9). Can you tell me where can I find any software which will generate a combination for the last four digits and continue hitting the server until it finds the appropriate password?

    • Guest

      If you know the first three digits and you also know that last four digits are numeric means they are from 0-9……………

      use the permutaions and combinations to solve thi s

      find out theways and then try it on each every time

    • http://None Jack Murphy

      Try them yourself man. There are only 9999 possibilities. Do like a few hundreds everyday and if your lucky, and the numeral is under 5000, you will get to it even quicker..

  • Guest

     HI,

    i badly need a login and a password for the following website:

    http://teachers.cie.org.uk

    thanks.

  • Guest

    hi i want to hack http://65.182.110.101/VSR
    how i can do this
    any idea
    reply me
    thanx

  • Guest

    Hi. I hope someone can help me retrieve my username and password on my types. I forgot both, have changed email adresse and now I cant get in to change my blog! Any suggestions?

  • theHolyOne

    hello all, am a newbie at this. I need to hack into a bank’s online banking, i already succeded with sql injections, i got root and their long password, but cant connect to the database except through the website. How else do i do this. I am a newbie and this is my first attempt.

    Will check here for response

  • paul

    Hallo, i am new in hacking through sql injection and i dont know much about it though i understand a bit of mysql, php, html n javascript. We have a system whereby to access the internet on has to submit a username and a password. I will be greatfull if you can give me tips on how to go about it. Please inform me what is necessary to achieve this. Thank you

  • Want help

    we hav a group for hacking ! if u know about hacking & u can hack web or wap sites , u can join with us………. we can pay u tooo……

    • unknown

      yoo what site you talk about, mean at the dude who commented bout a hackin group. I’ll love to know the location of the group cause i got interest in newbies. In the real i won’t say i’m a newbie but i have intrest in them so reach me trough 61139672 intl. (don’t mind my use of english cause i aint commin in group)

    • viraj

      I can hack dude so where I have to contact,,,,,, websites wifi database I can easily access so give me contact info if u r inerested

  • Guest

    I’d be more interested in ensuring that the characters used to do the injection are not acceptable to the field. In Oracle Forms, OpenROAD frames, MS Access Forms, the input fields can all be given formats which will not accept anything detrimental, eg filters out anything but A to Z, a to z, or 0 to 9. Where the field is an object which has an event such as ‘on exit’ or ‘on setvalue’ then code attached to these events can spot bad characters and blank the whole form, or even report the IP Address of the machine or virtual machine attempting to do the hack.

  • Guest

    I want to hack grandchasers

  • Guest

    dear bro,

    I tried ur all tricks….i got how the query is going yo execute in my college attendence site…. still working…. i hope i may get success

    • Guest

      hey bro. i read this page

      “http://www.webpronews.com/expertarticles/2006/05/22/how-bad-guys-hack-into-websites-using-sql-injection”

      i would hope that you could share some of your hacking knowledge with me. would that be possible?

  • Dan

    Im not entirly sure, but i want to retrieve account information be a program that enters a-z combinations for accounts that work. I use heidi sql and navicat pro do play with SQL. im souly hacking for a good purpose and would appreciate ANY HELP

  • Humanity

    Learn propper hacking, that was to the commenters, read. Learn a decent operating system, stop whining. TTFN.
    Humanity.

  • matt

    i tried this trick on a subscription dating site and it worked.. not gonna disclose it for security purposes..well i will still like to get more trick to decoding more sites with high security parameters.. cudos.. keep the good work going i am proud of you

    • eaglesflyhigh

      hey pal, hows the going?….i’d love to learn some tricks from you
      please, write me via deedspeed_772000@yahoo dot com
      thank you for replying

    • http://www.plimus.com edu

      hi matt…can you teach me…how to hack database of email subscribers…and perhaps can you hack clickbank.com subscribers…we can be millionaire if you can do this…

      Looking forward to see your hacking brilliance…

  • eaglesflyhigh

    hey Genius, i’d love to have a master…. someone who will teach me how to hack a server without been noticed….. been trying to get into a server for about 5 months but i think the admin is super-protected…i’d need someone to take me through….contact me via deepspeed_772000 @yahoo dot com ….perhaps add me to your yahoo messenger and we could start from there…

  • Guest

    I like boobie

  • vishalthe legend

    nt wrkng in facebook or orkut user name and password field

  • Abdul Azeez

    i like ur logic.i had not yet tried this type logic in server side validation test.

    i m getting scared to give u my email id because u can hack it by using sql injection.
    ok lets come to the point.

    can i use my coding or program with any of my hand-held device.
    for e.g :-in any atm,card swapping how does it works
    or in ibm laptop by swapping a finger we are able to access desktop

  • http://nichebloggers.org Vikas

    Thank God.. now I’m safe from hackers.. many of my web pages were showing MySQL errors with DB info.. I didnt knew that this can get my site hacked..

  • me

    dear intelligents i’d like u contact coz i get u very easy money transfer web with only 4 digit password. If u rather interest in it we can co-operate…good luck.

  • Prconja

    Hello matija please email me at filip.radic93@gmail.com i want to ask you something. I need your help really badly!

  • http://192.168.2.254 Caleb

    Um, i need help hacking the parental controls on my dads compy, pls help