Penetration Testing for Blind SQL Injection using BBQSQL
SQL (Structured Query Language) is the language used for interaction with databases. SQL injection is a web application attack that injects malicious syntax in SQL Queries.
BLIND SQL INJECTION
Blind SQL Injection consists of techniques for exploiting the SQL injection vulnerabilities by performing a binary search one character at a time, which is very time consuming .
An example of Blind SQL injection is :
UNAME = "' or (ASCII(SUBSTR(SELECT user(),1,1))>63) --";
PASS = "";
QUERY = "select * from users where pass=md5('"+PASS+"') and uname='"+UNAME+"'";
QUERY evaluates to:
from users where pass=md5('')
and uname='' or (ASCII(SUBSTR(SELECT user(),1,1))>63) --'
from users where pass=md5('') and
ASCII( << char -> int
SUBSTR( << slice string
SELECT user() << current user
,1,1) << first char
)>63 << 63 = '?'
) --' << comment
There are a lot of tools available for penetration testing for Blind SQL injection such as:
- BSQL Hacker
During penetration testing, if these tools don’t work, we’ll end up writing a custom script. So here is a treat! BBSQL can simplify a tricky blind SQL injection attack.
Blind SQL Injection with BBQSQL
BBSQL can be used to exploit the Blind SQL injection and can help to reach for hidden vulnerabilities.
BBSQL is fast, simple, versatile, and extensible.
BBQSQL is a blind SQL injection framework written in Python. It is extremely useful when attacking tricky SQL injection vulnerabilities. BBQSQL is also a semi-automatic tool, allowing quite a bit of customization for those hard to trigger SQL injection findings.
The tool is built to be database agnostic and is extremely versatile. It also has an intuitive UI to make setting up attacks much easier. Python gevent is also implemented, making BBQSQL extremely fast.
Similar to other SQL injection tools you provide certain request information.
Must provide the usual information:
- HTTP Method
- Encoding methods
- Redirect behavior
- HTTP Auth
Here is a usage guide for the tool :
root@kali:~# bbqsql _______ _______ ______ ______ ______ __ | \ | \ / \ / \ / \ | \ | $$$$$$$\| $$$$$$$\| $$$$$$\| $$$$$$\| $$$$$$\| $$ | $$__/ $$| $$__/ $$| $$ | $$| $$___\$$| $$ | $$| $$ | $$ $$| $$ $$| $$ | $$ \$$ \ | $$ | $$| $$ | $$$$$$$\| $$$$$$$\| $$ _| $$ _\$$$$$$\| $$ _| $$| $$ | $$__/ $$| $$__/ $$| $$/ \ $$| \__| $$| $$/ \ $$| $$_____ | $$ $$| $$ $$ \$$ $$ $$ \$$ $$ \$$ $$ $$| $$ \ \$$$$$$$ \$$$$$$$ \$$$$$$\ \$$$$$$ \$$$$$$\ \$$$$$$$$ \$$$ \$$$ _.(-)._ .' '. / 'or '1'='1 \ |'-...___...-'| \ '=' / `'._____.'` / | \ /.--'|'--.\ /'-.__|__.-'\ |  BBQSQL injection toolkit (bbqsql) Lead Development: Ben Toews(mastahyeti) Development: Scott Behrens(arbit) Menu modified from code for Social Engineering Toolkit (SET) by: David Kennedy (ReL1K) SET is located at: http://www.secmaniac.com(SET) Version: 1.0 The 5 S's of BBQ: Sauce, Spice, Smoke, Sizzle, and SQLi Select from the menu: 1) Setup HTTP Parameters 2) Setup BBQSQL Options 3) Export Config 4) Import Config 5) Run Exploit 6) Help, Credits, and About 99) Exit the bbqsql injection toolkit bbqsql>
Happy hunting! Blind SQL is now simple and fast.
# This tool works extremely quickly. Try it, it comes built into Kali Linux!
#For educational purposes only, penetration testing without permission is a legal offence. The author holds no responsibility if you misuse this tutorial.