spit out all users and passwords in MySQL DB?

Viewing 13 reply threads
  • Author
    Posts
    • #7524
      wlandymore
      Participant

      I’m practicing a SQL injection on a DB and I’ve made some progress. When I enter:

      ‘) AND (SELECT * FROM mysql.user) — AND (((1=1

      I get: “Operand should contain 1 column(s)”

      How can I get this to display on one line or something so that I can see the output from that command?

    • #46995
      j0rDy
      Participant

      its been a while, but let me try this.

      the key is to know which tables and columns are containing the information you want, you can get these by requesting the information.schema database. When you have insufficient rights to access the information.schema database you can try two things, guess the names or brute force them.

      in the end you want to inject a request like this:

      UNION SELECT password FROM users where login_name=’admin’–

      there are several good sql injection tutorials out there which you can use for more information. good luck!

    • #46996
      TheXero
      Participant

      This is where I’d start running “sqlmap” with a –dumpall xD

    • #46997
      j0rDy
      Participant

      @TheXero wrote:

      This is where I’d start running “sqlmap” with a –dumpall xD

      hehe, me too, hence the its been a while. i know certain challenges block such tools so being able to do it manually is a plus in that situation, in real life however…

    • #46998
      wlandymore
      Participant

      I hadn’t actually thought of sqlmap. I have it right on my desktop too.

      Is –dumpall actually a switch for sqlmap?

    • #46999
      lorddicranius
      Participant

      @wlandymore wrote:

      I hadn’t actually thought of sqlmap. I have it right on my desktop too.

      Is –dumpall actually a switch for sqlmap?

      “–dump-all”, but yep! http://sqlmap.sourceforge.net/doc/README.html#s5

    • #47000
      wlandymore
      Participant

      nah, didn’t seem to work with sqlmap. Looks like I’ll have to use the old fashioned way…

    • #47001
      j0rDy
      Participant

      see if you can access the information.schema table, it will save you loads of time and helps you configure your query once you know which tables and columns you want to extract.

    • #47002
      wlandymore
      Participant

      If I run:
      ‘) AND (select * from information_schema)– (((1=1

      I get the error “table glocken_emil.information_schema doesn’t exist” so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure…

    • #47003
      j0rDy
      Participant

      @wlandymore wrote:

      If I run:
      ‘) AND (select * from information_schema)– (((1=1

      I get the error “table glocken_emil.information_schema doesn’t exist” so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure…

      hmm, from here you can go two ways: try to guess the correct information.schema tablename (which could be glocken_emil.information_schema) or try to guess other tables like glocken_emil.users.

      come to think of it, the error gets me thinking, it looks like the query is being modified to access a table with the tablename ‘glocken_emil.*’. again it has been a while but you can try to use the brute forcer in sqlmap (where you define the prefix as glocken_emil) and see if you can get some tablenames.

    • #47004
      MaXe
      Participant

      Use “LIMIT 0,1” in the end of your original query to return only one (1) result from your “SELECT * FROM information_schema” sub-query.

      Furthermore, — (((1=1 seems incorrect.
      If you break out of a query with ‘ (apostrophe), you could something as simple as: AND ‘a’=’a . That will make the end of the query look like: ‘a’=’a’, as it will append the “missing” apostrophe.

      Using a comment like — and then adding more data afterward seems a bit obscure, because either it (or other ways like #) works or you should avoid using it.

      FYI I recommend you don’t just use information_schema, but more specific queries like: information_schema.tables

    • #47005
      dynamik
      Participant

      Just curious, is this one of the hacking-lab.com challenges?

    • #47006
      MaXe
      Participant

      @ajohnson wrote:

      Just curious, is this one of the hacking-lab.com challenges?

      Not that I know, as I haven’t done them  ;D

    • #47007
      Partyball
      Participant

      @ajohnson wrote:

      Just curious, is this one of the hacking-lab.com challenges?

      Yes

Viewing 13 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?