Web Application Penetration Testing Manual SQL Injection

Web Application Penetration Testing of Websites via Manual SQL Injection

Manual SQL injection uses no tool or automated scripts . As the term says Manual SQL injection we will not be using any tools. In this tutorial you don’t need Kali Linux or any other setup for web Application Penetration Testing. You can easily carry this out from Windows machine on any normal browser !

Find A Vulnerable Website

In case you are not in a scenario of a penetration test , I though it would be a nice idea to add this section to the post just in case you need to find a vulnerable website . The first step is obviously finding a vulnerable website. There are a lot of ways to do so. the most common method of searching is by using dorks.

Learn how to identify a vulnerable website :

How to find SQL Injection Vulnerable Websites

GOOGLE Dorks

Dorks are an input query into a search engine (Google in our case) which attempt to find websites with the given text provided in the dork itself. Basically it helps you to find websites with a specific code in their url which you know is a sign of vulnerability.

You can find complete list of Google Dorks here :

List of Google Dorks SQL Injection

Using GOOGLE Dorks

Now basically what a dork does is uses Google’s “inurl” command to return websites which have a specific set of vulnerable words in url. For that, we need to know which words in the url make a website potentially vulnerable to a SQL injection attack. Many websites offer a comprehensive list of google dorks.

Though your knowledge about SQl dorks and creativity are a best tool when it comes to finding vulnerable sites, or finding a vulnerability in a given website . It can be expected after a few attempts of practicing google dorks you will be able to come up with your own.

An Example of a Dork used to find a Vulnerable website is explained as below ;

inurl:buy.php?category=

Here try to understand the structure of the commands . The inurl instructs google to look at the URLs in it’s search index and provide us with the ones which have a specific line in them. Inside the inverted commas is the specific URL which we would expect to see in a vulnerable website. All the vulnerable sites will surely have a .php in their URL, since it is an indicator that this website uses SQL database here. After the question mark you will have a ?something= clause. What lies after the = will be the exploiting code that is known to cause malfunctioning of databases and carrying out of a Sql Injection attack.

Now please set an expectation here that from the list of vulnerable websites received here, only a few are going to be Vulnerable and your task Now will be to refine further this list to vulnerable websites .

Testing sites for Manual SQL Injection vulnerabilities

This is one of the most interesting parts of the Manual SQL Injection penetration test. This is where we will find the Vulnerable websites by actually exploiting them .

#This Tutorial is only for Educational Purposes and Penetration testing without the consent of Website owner is illegal .

Lets take the example dork here , i.e.

products.php?prodID=

We then came across a site

 www.site.com/products.php?prodID=25

The task here is to test that weather the website is actually vulnerable or not . This is simple. All you have to do is insert an ‘ at the end of the url instead of 25. The url would look somewhat like this

www.site.com/products.php?prodID='

If you are lucky, then the site would be vulnerable. If it is, then there would a some kind of error showing up, which would have the words like “Not found”,”Table”,”Database”,”Row”,”Column”,”Sql”,”MysqL” or anything related to a database. In some cases, there would be no error, but there would be some berserk/ unexpected behavior on the page, like a few components not showing up properly, etc.

But the job here is not done . You have just found that the website is Vulnerable but yet need to know what rows and columns are Exploitable .

Finding number of columns/rows

This is the first step . To find the Number of rows and columns you will need to use trial and error method, and keep executing statements incrementing the number of columns till we get an error message.

www.site.com/products.php?prodID=25+order+by+1

Effectively, we added order by 1 to the end of the original url. If there is atleast one column in the table, then the page will continue to work all right. If not, then an error will be displayed. You can keep increasing the number of columns till you get an error. Lets assume you get an error for

www.site.com/products.php?prodID=25+order+by+6

This means that the page had 5 columns, and the database couldn’t handle the query when you asked for the 6th one. So now we know two things

The site is vulnerable to SQL injection
It has 5 columns

Now you need to know which of the columns is vulnerable !!

Finding Vulnerable columns

Assume we are working on our hypothetical site www.site.com which has 5 columns. We now need to find out which of those columns are vulnerable. Vulnerable columns allow us to submit commands and queries to the SQL database through the URL. We now need to find which of the columns is vulnerable. To do this, enter the following into the url

www.site.com/products.php?prodID=25+union+select+1,2,3,4,5

In some cases you might need to put a – behind the 25. The page will now load properly, except for a number showing up somewhere. This is the vulnerable column. Note it down.
Let’s say the page refreshes and displays a 2 on the page, thus 2 being the vulnerable column for us to inject into.

Now we know which column is vulnerable. Next part is obtaining the SQL version, since the remaining tutorial will vary depending on which version of SQL is being used.

The point of this article was for you to know what is the logic behind the tools that target the websites for SQL injection . Now that we have estimated the number of Rows and the Vulnerable Columns , need is to get the fruitful data from the Database . We will accomplish such cumbersome tasks using a Tool such as SQL MAP .

In the Next Post we will see How to use a Simple tool such as SQL Map to Get the information from the Database .