mysql exploitation with error messages

A colleague of mine(Aleks) forwarded me a russian presentation on exploiting SQL Injection:

http://devteev.blogspot.com/2009/10/advanced-sql-injection-lab-full-pack.html

Of all the slides, i particular liked the one in which the author demonstrates that if the mysql error messages have been enabled (using mysql_error() function), then it is possible to retrieve the data from the back-end database using the ExtractValue() function:
——————————————
>SELECT 1 AND ExtractValue(1, CONCAT(0x5c, (SELECT @@VERSION)))

produces:

Error Code : 1105
XPATH syntax error: ‘\5.1.44-community’

———————-
This should not be confused with the php errors. While the php errors are usually enabled its not “very” common to see developers printing the mysql errors using mysql_error() function. However, its still good to know and could sometimes come handy.

Overall, very nice presentation.

5 Thoughts on “mysql exploitation with error messages

  1. hi! now there’s more effective way to exploit error-based sql injection in mysql. see http://www.ptsecurity.com/download/PT-devteev-FAST-blind-SQL-Injection.pdf

  2. Bugtrace on June 29, 2010 at 12:18 pm said:

    Good trick.

  3. Pingback: HackDoxMSSQL Injection Cheat Sheet | HackDox

  4. Pingback: MSSQL Injection Cheat SheetJF's blog | JF's blog

  5. Pingback: MSSQL Injection Cheat Sheet - MOSHIUR RAHMAN NIC

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Post Navigation