sql injection demo

Author: greyshell

web/sqli/db_house-keeping/db_clean-up.sql

@@ -0,0 +1,10 @@
+# author: greyshell
+# usage: mysql -u root -p < resource.sql
+# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+
+# sql injection: case02, clear the posts
+delete from vulnapp.tbl_post02 where user NOT LIKE 'asinha%';
+
+# sql injection: case03, clear the posts
+delete from vulnapp.tbl_post03 where user LIKE 'anonymous-%';
+update vulnapp.tbl_post03 set age = 25, comment = 'Hello', city = 'San Jose' where user = 'admin';

web/sqli/db_house-keeping/db_drop.sql

@@ -0,0 +1,16 @@
+# author: greyshell
+# usage: mysql -u root -p < resource.sql
+# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+
+# drop all tables
+# sql injection: case01
+DROP TABLE vulnapp.tbl_post01
+
+# sql injection: case02
+DROP TABLE vulnapp.tbl_post02
+DROP TABLE vulnapp.tbl_secret
+
+# sql injection: case03
+DROP TABLE vulnapp.tbl_post03
+
+DROP DATABASE vulnapp;

web/sqli/db_house-keeping/db_setup.sql

@@ -0,0 +1,48 @@
+# author: greyshell
+# usage: mysql -u root -p < resource.sql
+# alternale usage for automation: mysql -u root --password=mypass < resource.sql
+
+# create database
+CREATE DATABASE vulnapp;
+
+# sql injection: case01
+CREATE TABLE vulnapp.tbl_post01 (
+comment VARCHAR(30) NOT NULL,
+user VARCHAR(10) NOT NULL
+);
+
+INSERT INTO vulnapp.tbl_post01 (comment, user) VALUES ('hola', 'pedro');
+INSERT INTO vulnapp.tbl_post01 (comment, user) VALUES ('hi', 'usman');
+INSERT INTO vulnapp.tbl_post01 (comment, user) VALUES ('ola', 'amol');
+
+
+# sql injection: case02
+CREATE TABLE vulnapp.tbl_post02 (
+comment VARCHAR(30) NOT NULL,
+pin INT NOT NULL,
+age INT NOT NULL,
+user VARCHAR(30) NOT NULL
+);
+
+INSERT INTO vulnapp.tbl_post02 (comment, pin, age, user) VALUES ('hola', 100, 25, 'dhaval');
+
+CREATE TABLE vulnapp.tbl_secret (
+user VARCHAR(30) NOT NULL,
+token INT NOT NULL,
+password VARCHAR(30) NOT NULL
+);
+
+INSERT INTO vulnapp.tbl_secret (user, token, password) VALUES ('asinha', 777, 'blue@123');
+INSERT INTO vulnapp.tbl_secret (user, token, password) VALUES ('admin', 101, 'grey@321');
+
+# sql injection: case03
+CREATE TABLE vulnapp.tbl_post03 (
+comment VARCHAR(30) NOT NULL,
+city VARCHAR(30) NOT NULL,
+age INT NOT NULL,
+user VARCHAR(30) NOT NULL,
+PRIMARY KEY (user)
+);
+
+INSERT INTO vulnapp.tbl_post03 (comment, city, age, user) VALUES ('hello', 'mountain view', 25, 'dhaval');
+INSERT INTO vulnapp.tbl_post03 (comment, city, age, user) VALUES ('hi', 'santa clara', 19, 'admin');

web/sqli/db_setup.sql

@@ -17,7 +17,7 @@
 <body>
 <h2>SQL Injection</h2>
 <i>author: greyshell</i><br><br>
-Objective: extract admin's password and token <br><br>
+Objective: extract admin's token(INT) and password(VARCHAR) from a secret table<br><br>
 <form method="POST">
     Enter your comment:
     <label>