.

spit out all users and passwords in MySQL DB?

<<

wlandymore

Newbie
Newbie

Posts: 34

Joined: Thu Mar 15, 2012 9:48 am

Post Tue Apr 17, 2012 1:02 pm

spit out all users and passwords in MySQL DB?

I'm practicing a SQL injection on a DB and I've made some progress. When I enter:

') AND (SELECT * FROM mysql.user) -- AND (((1=1

I get: "Operand should contain 1 column(s)"

How can I get this to display on one line or something so that I can see the output from that command?
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Wed Apr 18, 2012 2:43 am

Re: spit out all users and passwords in MySQL DB?

its been a while, but let me try this.

the key is to know which tables and columns are containing the information you want, you can get these by requesting the information.schema database. When you have insufficient rights to access the information.schema database you can try two things, guess the names or brute force them.

in the end you want to inject a request like this:

UNION SELECT password FROM users where login_name='admin'--

there are several good sql injection tutorials out there which you can use for more information. good luck!
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

TheXero

User avatar

Full Member
Full Member

Posts: 112

Joined: Tue Dec 07, 2010 12:24 pm

Post Wed Apr 18, 2012 5:28 am

Re: spit out all users and passwords in MySQL DB?

This is where I'd start running "sqlmap" with a --dumpall xD
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Wed Apr 18, 2012 8:29 am

Re: spit out all users and passwords in MySQL DB?

TheXero wrote:This is where I'd start running "sqlmap" with a --dumpall xD


hehe, me too, hence the its been a while. i know certain challenges block such tools so being able to do it manually is a plus in that situation, in real life however...
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

wlandymore

Newbie
Newbie

Posts: 34

Joined: Thu Mar 15, 2012 9:48 am

Post Wed Apr 18, 2012 11:24 am

Re: spit out all users and passwords in MySQL DB?

I hadn't actually thought of sqlmap. I have it right on my desktop too.

Is --dumpall actually a switch for sqlmap?
<<

lorddicranius

User avatar

Sr. Member
Sr. Member

Posts: 448

Joined: Thu Mar 03, 2011 3:54 am

Post Wed Apr 18, 2012 11:29 am

Re: spit out all users and passwords in MySQL DB?

wlandymore wrote:I hadn't actually thought of sqlmap. I have it right on my desktop too.

Is --dumpall actually a switch for sqlmap?


"--dump-all", but yep! http://sqlmap.sourceforge.net/doc/README.html#s5
GSEC, eCPPT, Sec+
<<

wlandymore

Newbie
Newbie

Posts: 34

Joined: Thu Mar 15, 2012 9:48 am

Post Wed Apr 18, 2012 7:50 pm

Re: spit out all users and passwords in MySQL DB?

nah, didn't seem to work with sqlmap. Looks like I'll have to use the old fashioned way...
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Thu Apr 19, 2012 1:54 am

Re: spit out all users and passwords in MySQL DB?

see if you can access the information.schema table, it will save you loads of time and helps you configure your query once you know which tables and columns you want to extract.
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

wlandymore

Newbie
Newbie

Posts: 34

Joined: Thu Mar 15, 2012 9:48 am

Post Wed Apr 25, 2012 7:19 pm

Re: spit out all users and passwords in MySQL DB?

If I run:
') AND (select * from information_schema)-- (((1=1

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Thu Apr 26, 2012 4:49 am

Re: spit out all users and passwords in MySQL DB?

wlandymore wrote:If I run:
') AND (select * from information_schema)-- (((1=1

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...


hmm, from here you can go two ways: try to guess the correct information.schema tablename (which could be glocken_emil.information_schema) or try to guess other tables like glocken_emil.users.

come to think of it, the error gets me thinking, it looks like the query is being modified to access a table with the tablename 'glocken_emil.*'. again it has been a while but you can try to use the brute forcer in sqlmap (where you define the prefix as glocken_emil) and see if you can get some tablenames.
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

MaXe

User avatar

Hero Member
Hero Member

Posts: 671

Joined: Tue Aug 17, 2010 9:49 am

Post Thu Apr 26, 2012 8:24 am

Re: spit out all users and passwords in MySQL DB?

Use "LIMIT 0,1" in the end of your original query to return only one (1) result from your "SELECT * FROM information_schema" sub-query.

Furthermore, -- (((1=1 seems incorrect.
If you break out of a query with ' (apostrophe), you could something as simple as: AND 'a'='a . That will make the end of the query look like: 'a'='a', as it will append the "missing" apostrophe.

Using a comment like -- and then adding more data afterward seems a bit obscure, because either it (or other ways like #) works or you should avoid using it.

FYI I recommend you don't just use information_schema, but more specific queries like: information_schema.tables
I'm an InterN0T'er
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Thu Apr 26, 2012 8:40 am

Re: spit out all users and passwords in MySQL DB?

Just curious, is this one of the hacking-lab.com challenges?
The day you stop learning is the day you start becoming obsolete.
<<

MaXe

User avatar

Hero Member
Hero Member

Posts: 671

Joined: Tue Aug 17, 2010 9:49 am

Post Thu Apr 26, 2012 11:17 am

Re: spit out all users and passwords in MySQL DB?

ajohnson wrote:Just curious, is this one of the hacking-lab.com challenges?


Not that I know, as I haven't done them  ;D
I'm an InterN0T'er
<<

Partyball

Newbie
Newbie

Posts: 1

Joined: Tue Mar 06, 2012 8:40 am

Post Thu Apr 26, 2012 1:14 pm

Re: spit out all users and passwords in MySQL DB?

ajohnson wrote:Just curious, is this one of the hacking-lab.com challenges?


Yes

Return to Programming

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software