SQL Injection Part 1 -- Principles and basics

 Introduction

Recently I started to learn SQL injection, which is the first point ethical hackers should learn after learning the Computer Science basics such as Computer Network. I personally think it is a bit difficult for newbies to get started with SQL injection, and I don't dare to start when it comes to CTF questions, so here I will briefly talk about the points that newbies need to pay attention to.

Text

Principles

When the web application passes SQL statements to the backend database for database operations. If the parameters entered by the user are not strictly filtered, the attacker can construct a special SQL statement, directly input it into the database engine for execution, and obtain or modify the data in the database.

Therefore, the essence of the SQL injection vulnerability is to execute the data entered by the user as code.

There are two key conditions for SQL injection: the user can control the input content; the web application brings the user input content into the database for execution.

Basics

Commonly used functions

As for MySQL database, the most commonly used functions are listed below.

system_user() # system username

user() # ordinary username

current_user()

session_user()

database()

version()

load_file() # MySQL function to read local files, and content is converted to hexadecimal or decimal

@@datadir # get the data's stored path in the server

@@basedir # get the database's installation path in the server

@@version_compile_os

group_concat() # concatenate all parameters in parentheses into a string

substr(str,start,len) # Intercept the string starting from start and len length from the str string

Most important structure for MySQL