Waraxe IT Security Portal

fenindom · Beginner

i didn't now anything about sql injection
usually hacker use a way Like this
www.targethack.com//bug//bug/inject
somebody can answ my Question???
1.how can we seach the bugs for php vB.php Nuke or etc
2.why bug usually like a syntax but in SQL injection we just looking a bug like www.targethack.com//bug//bug/inject
3.why SQL inject is like another web/link
Sorry for my bad english

pabloski · Beginner

Hi,

SQL Injection works by passing SQL statements to a web application trough cookie, querystring or form parameters

this means you can embed you SQL statement in cookie variables ( if the web app use cookies and read them ), in querystrings ( i.e. h t t p ://www.victim.com/some_buggy_script?param=MY SQL INJECTION ) or in POST requests

for example if the script you're trying to attack execute the following SQL statement

"SELECT Nick, UserID, Password, Admin FROM Authors WHERE USERID = '" + Request.form("uID") + "'"

you can pass a uID form variable as follow: fakeid' UNION SELECT 'John', 'Doe', 'evil password', TRUE FROM Authors--

the resulting query will be

"SELECT Nick, UserID, Password, Admin FROM Authors WHERE USERID = 'fakeid' UNION SELECT 'John', 'Doe', 'evil password', TRUE FROM Authors--'

because fakeid doesn't exist in the remote DB, the first SELECT will return no recordset while the second will return the recordset composed by ('John', 'Doe', 'evil password', TRUE)

this means you have forced the app to recover a user with uID='Doe' and Password='evil password'

this means you can bypass the login procedure

fenindom · Beginner

how can i search the bug or create the SQL statement in put in to the site database.

waraxe · Site admin