Segfault ethical hacking week 10

SQL Injection & XSS (Cross-Site Scripting)

1. SQL Injection Points

SQL injection targets areas where SQL queries are executed on the web page.
To effectively perform SQLi, you must understand how parameters are used and how the backend fetches data from the database.

URL: boardRead.php?boardIdx=65

SELECT ... FROM ... WHERE idx = 65

Test injections:

• 65 AND 1=1

• 65' AND '1'='1

• 64+1

To bypass whitespace filters:

• Use comments: 65/**/AND/**/1=1

• Mix cases: 65 aNd 1=1

👉 The key is to deduce the structure of the SQL query on the server and craft your injection accordingly.

2. Types of SQL Injection

• Union-Based SQLi
   When query results are shown on the page.

• Error-Based SQLi
   When database error messages are displayed.

• Blind SQLi
   When there is no output but responses vary based on true/false conditions.
   This works in most scenarios, but is slower and harder to automate manually.

Defense Against SQL Injection

• Prepared Statements
   Compile SQL queries in advance using placeholders.
   Example:

SELECT ... FROM ... WHERE id = ?

• Whitelist Filtering
   Only allow known-safe input (e.g., for ORDER BY, table names, column names).

Notes for Penetration Testing

1. Avoid INSERT, DELETE, UPDATE queries – limit to non-destructive AND tests.

2. Avoid excessive use of comments (--, #) – may leave traces.

3. Never tamper with actual data (e.g., modifying user info).

Filter Evasion Techniques

• Whitespace Filtering: Replace spaces with comments.

  • Example: AND/**/1=1

• Bypass Parentheses Filtering: Alter syntax to work without brackets.

XSS (Cross-Site Scripting)

XSS is an attack that injects client-side scripts (typically JavaScript) into a web page to execute in another user's browser.

Purpose of XSS

Execute malicious scripts in the victim’s browser (not on the server).

What qualifies as client-side?

• HTML

• CSS

• JavaScript

Types of XSS Injection

1. Stored XSS

• The script is saved on the server and executed when the page is viewed.

• Common in:

  • User registration forms

  • Forum or bulletin board posts

Testing Stored XSS:

1. Check if input data is rendered back in the response.

2. Test with HTML special characters:

   • Example input: normaltic<""

3. Inject a basic script:

   
   <script>alert(1)</script>
   

Proof of Concept (PoC) options:

• alert(1)

• console.log()

• prompt(1)

• confirm('test')

Stored XSS is dangerous because other users viewing the data will unknowingly execute the injected script.

2. Reflected XSS

• The injected script is immediately reflected in the server's response via parameters.

• Common in:

  • Username availability checks

  • Search features (e.g., “No results found for ‘query’”)

Testing Reflected XSS:

1. Inject a payload in a GET parameter.

2. Confirm it appears in the response.

💡 Use:

<script>alert(1)</script>

Because this attack works via a malicious link, GET method must be used to share the attack vector.

Key Differences

Type	Storage Location	Execution Timing	Attack Vector
Stored	On the server	When page is viewed	Page with stored content
Reflected	In the URL/request	Immediate on request	Shared URL / link

XSS Defense Mechanisms

• Filter special characters like <, ", ', etc.

• Sanitize or encode user inputs in HTML context.

• Avoid inserting raw user input into scripts, attributes, or tags.

Why Is XSS Dangerous?

• Stored XSS: Scripts persist on the server, affecting all users who visit the infected page.

• Reflected XSS: Used for phishing-style attacks via URLs. Victims are tricked into clicking a link that executes JavaScript.

Always verify:

• Is the payload inserted in the request echoed back in the response?

• Is the page vulnerable to <script> injections?

Segfault ethical hacking week 9

SQL Injection Point

1. SQL Injection

=> Inserting SQL queries to extract desired information.
Example from DB: SELECT * FROM member

• When the SQL query result is displayed on the screen:
   → Use Union-Based SQL Injection

• When SQL error messages are shown:
   → Use Error-Based SQL Injection

• Blind SQL Injection:
   → Use Blind SQL Injection when there's a difference in response based on true/false conditions.
   It works in most situations where the above two don't apply.
   (Currently, this method feels too slow for me to use efficiently.)

The key is executing the specific SELECT query you need. Know what you want to run.

Finding SQL Injection Points

Look for areas where SQL queries are used by the database:

• For example, when SQL uses a WHERE user_id LIKE '%____%' clause
   Try:
   nor %' and '1%'='1
   This inserts an always-true condition using AND.

Check whether the result changes between:

• AND '1'='1' (true condition)

• AND '1'='2' (false condition)

If the result differs → SQLi is likely possible.

Use Burp Suite to inspect parameters, headers, and other request data.

2. When Finding SQL Injection Points:

• Focus on places where data is retrieved from the DB.

• Think about how SQL queries are used in the Web Server.

Examples:

• INSERT INTO table VALUES (...) during Sign-up

• SELECT statements used in MyPage, like:
   WHERE userid = '_____'
   → Usually, the server inserts a stored value here.

Test case:

Try:

• sfUser' and '1'='1

• sfUser' and '1'='2

If the result differs → SQLi is possible → You may be able to extract all data.

You can extract data using:

• Parameters

• Cookies

• User-Agent, etc.

SQLi is not limited to text input fields.

Understand How SQL Works

• Always consider how the server-side logic might use SQL.

• Cookies can also be injection points.

Example: A bulletin board displaying posts:

• Option parameter:
   option=title, value=test, result=...

• The query might look like:
   WHERE title LIKE '%test%'

Test:

• test% and '1%'='1 → (fails)

Try injecting in the column name:

• order by title → Try injecting SELECT inside this to test conditions.

If "true" returns content and "false" does not → Vulnerability confirmed.

 Avoid using # for comments unless absolutely necessary.

Advanced Points

• SQLi is possible in:
   1. Cookies
   2. Column names
   3. ORDER BY clauses

Case When syntax (SQL equivalent of if):

CASE WHEN (condition) THEN (true value) ELSE (false value) END

Example:

CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END

Use in sort parameter:

sort = (SELECT 1 UNION SELECT 2 WHERE (1=2))

• Results in a matrix output.

• If false condition → No output → Good test case.

To trigger errors (for error-based detection), try:

sfUser' AND (SELECT 1 UNION SELECT 2 WHERE (1=2)) AND '1'='1

---

SQL Injection Mitigation

1. Prepared Statements

• Pre-compiles the SQL query:

SELECT ... WHERE id = ?

• Originally designed to improve performance, but now widely used for SQLi prevention.

 Common mistakes:

• Not using prepared statements properly, e.g.:

WHERE id = 'user_input'

Prepared statements cannot be used for:

• ORDER BY, TABLE names, COLUMN names

Always inspect for:

• sort, ord, or other dynamically-inserted SQL identifiers.

2. Whitelist Filtering

• Whitelist filtering: Only allow specific safe keywords (preferred).

• Blacklist filtering: Block known dangerous keywords (less secure).

Segfault ethical hacking week 8

 
SQL Injection = Extracting data using SQL flaws

1. Types of SQL Injection

1.1 UNION-based SQLi

• Used when query results are displayed on the screen.

• Attacker injects a UNION SELECT to retrieve additional data.

1.2 Error-Based SQLi

• Used when SQL errors are shown on the page.

• Errors are triggered intentionally to extract database information.

1.3 Blind SQLi

• Works when the application does not display query results or errors.

• The attacker relies on behavioral differences (like page content or response time).

Depending on the situation, one of the three methods is chosen.

---

2. The Goal of SQL Injection

To execute your own SELECT queries on the server and extract sensitive data.

---

3. How to Identify SQL Injection Points

Step-by-step:

1. Find inputs that are sent to the server (text fields, cookies, headers, etc.)

2. Test with a payload like:

   ' AND '1'='1
   ' AND '1'='2
   

   • If the results differ: the input is vulnerable.

   • If results are identical: test further using variations.

Check parameters in:

• Form fields

• URL query strings

• HTTP headers (e.g. User-Agent)

• Cookies

Always consider how the server constructs its SQL queries.
Don't inject blindly — think about the query logic first.

---

4. Real-world Injection Examples

Cookie-based Injection Example

A forum post listing shows:

SELECT * FROM posts WHERE title LIKE '%sfUser%'

Test with:

' AND '1'='1  --> Returns normal results
' AND '1'='2  --> Returns nothing

Result differs → SQLi confirmed.

Column Name Injection

ORDER BY 1
ORDER BY 2
...

• Use this to guess how many columns exist.

You can also inject:

CASE WHEN (1=1) THEN column1 ELSE column2 END

Or even:

SELECT 1 UNION SELECT 2

To trigger an error or test visibility of injected data.

---

5. SQLi via ORDER BY clause

Some parameters may be used in ORDER BY clauses, allowing injection if not sanitized properly.

---

6. SQL Injection Prevention Methods

6.1 Prepared Statements

• Use placeholders (e.g., ?) to pre-compile SQL queries.

• Protects against injection by separating data from code.

SELECT * FROM users WHERE id = ?

Note:

• Can't always be used with ORDER BY, table names, or column names.

6.2 Whitelisting (Allow-List Filtering)

• Only allow approved input values.

• Safer than blacklisting forbidden characters or words.

---

7. SQL Injection Cheat Sheet Summary

1. UNION-based SQLi

• Combine queries using UNION.

• Determine number of columns using ORDER BY.

• Match data types before injecting.

Example:

sql

' UNION SELECT username, password FROM users--

2. Error-Based SQLi

• Trigger type or logic errors to reveal system details.

• Works only if DB error messages are shown to the user.

Example:

' AND 1=CONVERT(int, (SELECT TOP 1 name FROM sys.tables))--

3. Blind SQLi

A. Boolean-based Blind SQLi

• Observe content changes on the page.

Example:

' AND 1=1--  → Page loads normally  
' AND 1=2--  → Page is empty or shows error

B. Time-based Blind SQLi

• Inject SLEEP() or WAITFOR DELAY to observe response time.

Example:

' AND IF(SUBSTRING(@@version,1,1)='5', SLEEP(5), 0)--

Segfault ethical hacking week 7

 

Error Based SQL Injection

1) If the SQL query results are directly displayed on the screen → Union SQLi

2) If an error message is output → Error-Based SQLi

        : Utilizing error messages to extract data:

            (1) Logic Error

            (2) SQL Error

1) Syntax Error vs. Logic Error

• Compilation Process: When executing code, a compilation process occurs.
• Syntax Error: If a syntax error occurs, the code will not execute.
• SQL Syntax Error: Generally not useful for extracting data.
• Data Extraction: The SELECT statement must be used to retrieve data.

2) Logic Error

• SQL Error: Errors occurring due to incorrect SQL syntax can be exploited using Error-Based SQLi.
• Error Message Injection: The goal is to manipulate the error message so that it displays a SELECT query result.

Tips for Inducing Logic Errors

• Server behavior varies, requiring individual research for effective exploitation.

Extractvalue Function

Extractvalue('XML text', 'XML expression')

Example injection:

___' and extractvalue('1', concat(0x3a, (select '____'))) and '1'='1

• Replace ____ with the desired SELECT statement to extract its result.
• Special symbols must be included to trigger an error.

Concat Function

• Usage: Combines strings together.

concat('hello', 'test') -> hellotest concat(0x3a, 'test') -> :test

• Hexadecimal Representation:

• 0x3a represents :

Extractvalue Function Characteristics

• Requires special characters like : to cause an error and display data.

This method takes advantage of error messages to extract sensitive information from the database by carefully crafting SQL queries. If you're looking for further explanations or practical examples, let me know!

Error-Based SQL Injection Steps

1. Identify SQL Injection Point
• Check if SQL errors are displayed on the screen.
2. Error Output Function
• Use extractvalue to trigger an error and extract data.
3. Construct Attack Format

___' and extractvalue('1', concat(0x3a, (select '____'))) and '1'='1

Insert the desired query in place of ____ to retrieve data.

4. Retrieve Database Name
   Insert: select database()
5. Retrieve Table Name

select table_name from information_schema.tables where table_schema = '_________' limit 1,1

6. Retrieve Column Name

select column_name from information_schema.columns where table_name='____'

7. Retrieve name Column from game_table

        select name from game limit 0,1

Segfault ethical hacking week 6

 

1. Review

SQL Injection 1

Login page

You must create it yourself to understand how it works internally during login.
It’s essential to know what happens after identification/authentication and what results are returned when a SELECT statement is executed.
Only then can you study various approaches.
Make sure to build it, test it, practice with it, and research it thoroughly.

When problems occur

1) Identify the root cause

- Many times, problems can’t be solved because the root cause isn’t identified.

- It’s important to build and run it yourself to see where and why the issue occurs.

2) After that, you will be able to find a solution.

Prepared Statment 

SQL Injection is not possible.

Segfault ethical hacking week 5

 

Web System Structure Overview

 Web (Static Resource Server)

• Delivers static files to the client (e.g., HTML, CSS, JS, images)
• Web Server Role: Responds to client requests with files(e.g., Apache, Nginx)

WAS (Web Application Server)

• Handles dynamic processing (e.g., login, user interaction, DB access)
• Languages used: ASP, JSP, PHP, Python, etc.
• Executes business logic

DB (Database)

• Stores data persistently (e.g., user info, posts)

• Language used to interact with DB: SQL

Relationship Between Client and Server

Client (Web Browser: Edge, Chrome, etc.)
    ↔ Web Server (Static files)
        ↔ WAS (Dynamic logic)
            ↔ DB (Data storage)
Front-End (FE): Visible UI — HTML, CSS, JavaScript

• Back-End (BE): Business logic (e.g., verifying login credentials)

Login and Session Concepts

    Requesting from Web Server

• Like sending a letter asking for a file

• Since the server doesn’t know who is requesting, it uses cookies in the header to identify the user

    Cookie (Client-side storage)

• Stored on the client 
• Issue: Vulnerable to theft or hijacking (can lead to unauthorized access

    

    Session (Server-side storage)

• Server creates a session ID to identify each user

• Session data is stored on the server; only session ID is passed via cookie
• Safer than using only cookies




Burp Suite (Web Proxy Tool)

• Intercepts communication between the client and web server
• Allows you to view and modify HTTP requests/responses
• Useful for testing vulnerabilities and simulating attacks

    SQL Injection

• SQL: Language used to communicate with the database
• Injection: To insert malicious code
• SQL Injection: An attack that injects malicious SQL queries into input fields to manipulate or steal data from the DB

Segfault ethical hacking week 4

 

1. Burp Suite

Burp Suite is a web proxy tool that intermediates requests and responses between the client and the web server. By using a proxy, it allows the analysis of all transmitted packets, enables packet modification, and supports the delivery of modified packets to the server.

User > Display > Appearance 

It can be switched to dark mode.

Burp Proxy Setting

Register proxy listener

Bind to Port

Set the port that the proxy listener will use.

Bind to address

    Loopback only : Receives only requests coming from the local system.

    All interafces : Receives requests from all network interfaces.

    Specific address : Receives only requests from a designated address.

2. Burp Suite Functions

Intercept :

    Halts incoming packets. Packets intercepted can be modified and sent to the web server.

History : 

    Stores all packets observed through the proxy. Detailed inspection is possible.

Repeater : 

    Sends the same request or slightly modified requests repeatedly for response analysis.

Decoder: 

    Performs operations such as encryption, decryption, or hash transformation on extracted data from packets. 

Comparer: 

    Compares two sets of data to easily identify differences

Request: 

It contains applied resources or client information.
Looking at GET /4_burp/flag.php HTTP/1.1, it is composed of:

• Method: The action to be performed (e.g., GET).
• Path: The specific route to the resource (e.g., /4_burp/flag.php).
• Protocol: The communication protocol being used (e.g., HTTP).
• Protocol Version: The version of the protocol (e.g., 1.1).

Response: 

It contains applied resources or client information.
Looking at HTTP/1.1 200 OK, it is composed of:

• Protocol: The communication protocol being used (e.g., HTTP).
• Protocol Version: The version of the protocol (e.g., 1.1).
• Status Code: Indicates the result of the request (e.g., 200 OK).

The output value is displayed with a blank line below the header.

Status Code: 

    200 : OK

    300 : Redirect

    400 : Client Error

    500: Server Error