Advance SQL

Same Peoples Says me that tech advance SQL Injection So Today we learn 

Advance SQL Injection 

(This is only education purpose )

What is SQL Injection attack?

SQL Injection Attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. 

SQL injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. 

Advanced SQL 

Injection Advanced SQL injection may include an enumeration of databases like MySQL, MSSQL, MS Access, Oracle, DB2, or Postgre SQL, tables and column in order to identify privilege level of users, account information of database administrator and database structure disclosure. it also includes passwords and hashes grabbing, and transferring the database to the remote machine. 

The scope of SQL Injection Attack

 SQL injection impact can be measured by observing the following parameters that an attacker is intended to overcome: 

 Bypassing the Authentication 

 Revealing sensitive information 

 Compromised Data integrity 

 Erasing the database 

 Remote Code Execution

Types of SQL Injection Attack:

• In-band SQLi 
• Inferential SQLi
• Out-of-band SQLi 

Launch SQL Injection Attacks 

Appropriate SQL injection attack from the category cab be initiate just after gathering the information about the structure of database and vulnerabilities found. By exploiting them, the injection can be successful. SQL injection attacks such as Union SQL injection, Error-based SQL injection, Blind SQL injection and other can be used to extract information from the database such as extracting Database name, tables, columns, rows, and fields. The injection can also have intended for bypassing the authentication. 

 IBM Security AppScan Standard 

Download

Click On Create New Scan

Select Scan template  demo.testfire.net

 Click Next 

Select Login Method

Select Test Policy and Click Next

Here You Select how do you want to start the scan. 

Click Finish

Here we are using a demo testing; it does not find any issue.

 If it found the issue, Issue section will show the detected issues list. To explore, click the security issue, it will show the details.

Task section will show the recommended remediation actions.

Read More

Web Application Hacker’s Toolkit

Here We know about same basic of Web Application

A Web Application Hacker’s Toolkit

Some attacks on web applications can be performed using only a standard web browser.
Most Important
The most important item in your toolkit falls into this latter category, and operates as an intercepting web proxy, enabling you to view and modify all of the HTTP messages passing between your browser and the target application. 
Second Main Category
The second main category of tool is the web application scanner.
This is a product designed to automate many of the tasks involved in attacking a web application, 
from initial mapping through to probing for vulnerabilities.

What is Web Browsers?

A web browser is not exactly a hack tool, being the standard means by which web applications are designed to be accessed. 

Internet Explorer 
Microsoft’s Internet Explorer (IE) is currently the most widely used web browser, comprising approximately 60% of the market
 at the time of writing. Virtually all web applications are designed for and tested on IE, making it a good choice for an attacker because most applications’ content and functionality will be correctly displayed and usable within IE. 

Firefox 
Firefox is currently the second most widely used web browser, comprising approximately 35% of the market at the time of writing. The majority of web applications work correctly on Firefox; however, there is no native support for ActiveX controls

Opera
Opera is a relatively little-used browser, having less than 2% of the market share at the time of this writing. Relatively few applications are specifically tested on Opera. 

Integrated Testing Suites
After the essential web browser, the most useful item in your toolkit when attacking a web application is an intercepting proxy.
There are three leading suites in widespread use, which we will examine in this section:
Burp suite

Paros 

WebScarab 

Configuring Your Browser
If you have never set up your browser to use a proxy server, this is trivial to do on any browser. 

Then perform the steps required for your browser:

Internet Explorer
In Internet Explorer, go to Tools ➪ Internet Options ➪ Connections ➪ LAN settings. Ensure that the Automatically Detect Settings and Use Automatic Configuration Script boxes are not checked. Ensure that the Use a Proxy Server for Your LAN box is checked. In the Address field, enter localhost and in the Port field enter the port used by your proxy.  Click on the Advanced button, and ensure that the Use the Same Proxy Server for All Protocols box is checked. If the hostname of  the application you are attacking is matched by any of the expressions in the Do Not Use Proxy Server for Addresses Beginning With box, remove these expressions.
 Click OK on all the dialogs to confirm the new configuration.

Web Application Spiders
Web application spiders work in a similar way to traditional web spiders — by requesting web pages, parsing these for links to other pages, and then requesting those pages, continuing recursively until all of a site’s content has been discovered.
To accommodate the differences between functional web applications and traditional web sites, application spiders must go beyond this core function and address various other challenges, such as the following:

>> Forms-based navigation, using drop-down lists, text input, and other methods.

>> JavaScript-based navigation, such as dynamically generated menus.Multistage functions requiring actions to be performed in a defined sequence.

>> Authentication and sessions.

>> The use of parameter-based identifiers, rather than the URL, to specify different content and functionality.
The appearance of tokens and other volatile parameters within the URL query string, leading to problems identifying unique content.

>> Checking for the robots.txt file, which is intended to provide a blacklist of URLs that should not be spidered, but which an attacking spider can use to discover additional content.
Automatic retrieval of the root of all enumerated directories. This can be useful to check for directory listings or default content (see Chapter 17).

>> Automatic processing and use of cookies issued by the application, to enable spidering to be performed in the context of an authenticated session.

>> Automatic testing of session-dependence of individual pages. This involves requesting each page both with and without any cookies that have been received. If the same content is retrieved, then the page does not require a session or authentication. This can be useful when probing for some kinds of access control flaw (see Chapter 8).

>>  Automatic use of the correct Referer header when issuing requests. Some applications may check the contents of this header, and this function ensures that the spider behaves as far as possible like an ordinary browser. 

>> Control of other HTTP headers used in automated spidering.

>> Control over the speed and order of automated spider requests, to avoid overwhelming the target, and if necessary behave in a stealthy manner.
                                                     Burp suite     Paros      WebScarab 

Application Fuzzers and Scanners
While it is possible to perform a successful attack using only manual techniques, to become a truly accomplished web application hacker, you need to make use of automation in your attacks, to enhance their speed and effectiveness. 

The following features are implemented in the different tool suites:

>> Automated scans to detect common vulnerabilities.

>> Manually configured scanning for common vulnerabilities.

>> A set of built-in attack payloads and versatile functions to generate arbitrary payloads in user-defined ways — for example, based on malformed encoding, character substitution, brute force, data retrieved in a previous attack, and so on.

>> Ability to save scan response data to use in reports or incorporate into further attacks.

>> Customizable functions for viewing and analyzing responses — for example, based on the appearance of specific expressions or the attack payload itself.

>> Functions for extracting useful data from the application’s responses — for example, by parsing out the username and password fields in a My Details page.

>> Functions for analyzing cookies and other tokens for any sequences.

Read More

SQL Injection Tools

 SQL Injection Tools

There are many tools which we discuss

BSQL Hacker is an automated SQL Injection Tool designed to exploit SQL injection vulnerabilities in virtually any database.

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

Marathon Tool is a malicious user

 can send heavy queries to perform a Time-Based 

Blind SQL Injection attack

Note:: You download this tools by click them..........

SQL Queries

SQL is a domain-specific language used in programming and designed for managing data held in a relational database management system, or for stream processing in a relational data stream management system.

Work OF SQL Query

Injection of SQL query will be executed on the server and replied by the

response.

SELECT * FROM [Orders]

These commands will reveal all information stored in the database "Orders"

table. If an organization maintains records of their orders into a database, all

information kept in this database table will be extracted by the command. 

SQL Delete Query

The DELETE statement is used to delete existing records in a table. To

understand, consider a table “Customers” in a database. The following

information is the table “Customers” is containing.

HERE 

You can see that an attacker perform SQL Injection attack on a website 

Here You can See when An attacker attack on a website he get same information like this 

===================================

For Android 

===================================

Tools

1. 
2.  

This is most use full tools which  I use personally

==================================

In the last we read same Evasion Techniques

Evading IDS

In order to secure database, isolated deployment in a secure network location with an intrusion detection system (IDS) is recommended. IDS keep monitoring the network and host traffic as well as a database application. The attacker has to evade IDS to access the database, for this, it uses different evading techniques. For example, IDS using Signature-based Detection system In compare the input strings against the signature to detect intrusion. Now all you have to do is to evade the signature-based detection.

Types of Signature Evasion Techniques

• In-line Comment
• Char Encoding
• String Concatenation 
• obfuscated Codes
• Manipulating White Spasea
• Hex Encoding 
• Sophisticated Matches 

What is  SQL Injection ???????????

Read More

SQL Injection

A.o.A

" SQL Injection"

SQL

 SQL stand of Structured Query Language (SQL) injection is covered.

 SQL Injection is basically insertion of malicious code or script by exploiting vulnerabilities to launch an attack powered by baCk-end components.

SQL Injection is a popular and complex method of attack on web services,applications, and Databases.

It requires deep knowledge about web application processes and its components such as databases and SQL.

SQL Injection Attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries.

SQL injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application

SQL injection vulnerability

Types of SQL Injection

SQL Injection can be classified into three major categories:

ln-band SQLi

In-Band SQL injection is a category which includes injection techniques

using same communication channel to launch the injection attack and gather

information from the response. In-Band Injection techniques include: -

Error-based SQL Injection

Union based SQL Injection

lnferential SQLi

In an Inferential SQL Injection, no data is transferred from a Web 

application.The attacker is unable to see the result of an attack hence

referred as a Blind injection.

Out-of—band SQLi 

Out-of—band SQL injection is the injection technique that uses different

channels to launch the injection and gather the responses. It requires some

features being enabled such as DNS or HTTP requests on database server

hence it is not very common

SQL Injection Methodology

>Information Gathering and SQL Injection Vulnerability Detection

>Launch SQL Injection Attacks

>Advanced SQL Injection

In the  phase of information gathering , Collect the information about the web

application, operating system, database and the structure of the components.

Evaluation of extracted information will be helpful to identify the

vulnerabilities to exploit. Information can be gathered by using different tools

and techniques such as injecting codes into the input fields to observe the

response of error messages. Evaluation of input field, hidden fields, get and

post requests, cookies, string values and detailed error messages can reveal

enough information to initial injection attack.

Appropriate SQL injection attack from the category cab be initiate just after

gathering the information about the structure of database and vulnerabilities

found. By exploiting them, the injection can be successful. SQL injection

attacks such as Union SQL injection, Error-based SQL injection, Blind SQL

injection and other can be used to extract information from the database such

as extracting Database name, tables, columns, rows, and fields. The injection

can also have intended for bypassing the authentication.

Advanced SQL injection may include an enumeration of databases like

MySQL, MSSQL, MS Access, Oracle, DB2, or Postgre SQL, tables and

column in order to identify privilege level of users, account information of

database administrator and database structure disclosure. it also includes

passwords and hashes grabbing, and transferring the database to the remote

machine.

Testing of SQL Injection

Read More