How I dump the company database using SQL injection

4 min readJust now

–

Let’s begin…

Before discussing SQL injection, let me explain what it is.

SQL injection is a server-side vulnerability where an attacker tries to inject a malicious payload into a vulnerable input parameter to manipulate the database.

The Target site, which I have taken, is a vulnerable disclosure program, so due to confidentiality, I am supposed to hide sensitive information.

How does the SQL malicious payload work?

In the database, the structure of the query will be designed and structured by a backend developer using MYSQL, MSSQL, MongoDB, and so on. It depends on the use case and the client’s requirement. How some newbie developers write the backend table column, query like **SELECT * FROM TABLE_NAME WHERE username= “username” AND password= “pa…

4 min readJust now

–

Let’s begin…

Before discussing SQL injection, let me explain what it is.

SQL injection is a server-side vulnerability where an attacker tries to inject a malicious payload into a vulnerable input parameter to manipulate the database.

The Target site, which I have taken, is a vulnerable disclosure program, so due to confidentiality, I am supposed to hide sensitive information.

How does the SQL malicious payload work?

In the database, the structure of the query will be designed and structured by a backend developer using MYSQL, MSSQL, MongoDB, and so on. It depends on the use case and the client’s requirement. How some newbie developers write the backend table column, query like SELECT * FROM TABLE_NAME WHERE username= “username” AND password= “password” ;

By this, we can achieve SQL injection by injecting a malicious payload. So in SQL injection, there are four commonly classified are: Error-Based, Boolean-Based, Union-Based, and Time-Based injection.

The payload, which apparently escapes the user input by injecting error-based SQL injection ‘ OR 1=1- - How does this escape the backend query?

When attackers inject user input into the login page, the query eliminates the password query, which is written in the backend. Basically, this payload says 1=1, which is logically TRUE, so the server blindly trusts the user’s response and allows into into the dashboard without any authorization.

I don’t want to drag the entire theory in one blog before entering into practicals. We need to know some basics of SQL injection, how it works, and how attackers try to manipulate the database by using malicious payloads.

Let’s start, how I found and dumped the entire database.

Usually, I test SQL injection in the login page, but this time I did something different from the usual case, so I tried in the URL parameter with error-based SQL injection with a simple payload, as I mentioned before. It acts like something weird, it shows an error, but not a usual error, yeah, you got it, it is a SQL error. By this error, I got a big secret key hint, i.e, MYSQL, which is the database name.