SQL Injection – Payload Two – Part 4

As explained in the previous post, we can use single quote (i.e. ‘ ) to guess whether the input fields in the application are vulnerable to SQL Injection. Once the input fields are guessed as vulnerable to SQL Injection using the single quote (i.e. ‘ ) payload, we can perform further advanced payloads to access or control the data stored at the Application DB end. In this post, I will demonstrate entering an advanced payload into the input field, which sets the dynamic query behind the input field to be always true.

Pre-requisites: Go through the below pre-requisites which are required for understanding this post.

Caution: Look into the following steps before testing the application for SQL Injections:

Payload Two: Follow the below steps to simulate the payload as an attacker on the bWAPP application which is open for Penetration Testing:

Enter test’ or 1=1- – into the input fields to modify their dynamically generated SQL queries and generate a malicious SQL query. More information on this payload will be provided at the end of this post.

Case One: Enter test’ or 1=1- – into the input fields available on the bWAPP application.

Step#1 – Once the above-specified pre-requisites are ready, open the bWAPP application in the Firefox Browser using the URL http://localhost:8080/bwapp/login.php as shown below:

Step#2 – Login to the application by entering bee into the Login field and bug into the Password field and click on Login button as shown below:

Step#3 – Once the user is logged in, select SQL Injection (GET/SEARCH) option from the ‘Choose your bug’ drop-down field and click on ‘Hack’ button as shown below:

Step#4 – In the displayed ‘SQL Injection (GET/SEARCH)’ screen, enter the payload test’ or 1=1- – into the ‘Search for a movie:’ text box field and click on ‘Search’ button as shown below:

• Select * from movies where title Like = test’ or 1=1- –

• Single quote ‘ in the payload will concatenate the remaining or 1=1- – with the dynamically generated SQL query Select * from movies where tittle Like test to form Select * from movies where title Like test’ or 1=1- –
• or is the boolean operator (i.e. true or false = true, false or true = true, true or true = true, false or false = false).
• test is some random text which is not there in the movies list. Hence test if false.
• 1=1 is nothing but always true
• – – is nothing but a comment in SQL language. So everything which comes after – – will be commented out and won’t be executed.
• Hence test’ or 1=1- – (i.e. false or true results in true)
• So the dynamic generated SQL query will be treated as Select * from movies where title Like test’ or true —
• Hence the final processed query will be Select * from movies where title like true 
• Since the above query is always true, all the Movie names in the database will be retrieved as a result, as shown in the above screen-shot of Step#5 .

---

Step#3 – Observe that the admin access can be bypassed as shown below:

• Select * from Users where username= test’ or 1=1- – and password=xyzabcd

• Single quote ‘ in the payload will concatenate the remaining or 1=1- – with the dynamic generated SQL query Select * from Users where username=test and password=xyzabcd to form Select * from Users where username=test’ or 1=1- – and password=xyzabcd
• or is the boolean operator (i.e. true or false = true, false or true = true, true or true = true, false or false = false).
• test is some random text which is not there in the usernames list. Hence test if false.
• 1=1 is nothing but always true
• Hence test’ or 1=1- – (i.e. false or true results in true)
• So the dynamic generated SQL query will be treated as Select * from Users where username=true – – and password=xyzabcd
• – – is nothing but a comment in SQL language. So everything which comes after – – will be commented out and won’t be executed. i.e. and password=xyzabcd in the above query won’t be executed.
• So the dynamically generated SQL query will be executed as Select * from Users where username=true
• Hence the final processed query will be Select * from Users where username=true 
• Since the above query is always true, the first user record in the database (i.e. in most cases the admin record) will be bypassed and hence the attacker can gain the admin access as shown in this example.

---

Step#2 – Login to the application by entering bee into the Login field and bug into the Password field and click on Login button as shown below:

Step#3 – Once the user is logged in, select SQL Injection (GET/SEARCH) option from the ‘Choose your bug’ drop-down field and click on ‘Hack’ button as shown below:

Step#5 –  Observe that ‘No movies were found!’ will be displayed as the search result and also observe the searched text test in the URL of the application as shown below:

Step#6 – Now update the title text into the URL with ‘ or 1=1- – and then browse the updated URL as shown below: