> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2023/web-exploitation/sqli-sql-injection.md).

# SQLi (SQL Injection)

<figure><img src="/files/eep1pMFgemhNNlzvGpIf" alt=""><figcaption></figcaption></figure>

### What is SQLite?

SQLite is a **lightweight**, self-contained **database engine** that's easy to use and doesn't require a separate server to operate. It's embedded into applications, making it ideal for mobile apps, small websites, and projects where simplicity and speed are crucial.

Unlike other databases, **SQLite** stores all data in a single file, making it portable and easy to manage. Despite its small size, it supports most SQL standards, allowing developers to perform complex queries and transactions efficiently. SQLite is **reliable**, fast, and perfect for many everyday database needs without the overhead of a full-fledged database system.

SQL is a standard query language used for managing and manipulating relational databases, while SQLite is a lightweight, self-contained database management system that uses SQL for its operations. It's like other SQL programs such as MySQL or PostgresSQL. This mean it has slight different syntax that others.&#x20;

### What is a SQL Injection

SQL Injection (SQLi) is a web application vulnerability where attackers inject malicious SQL queries through user inputs to manipulate backend database operations, potentially leading to unauthorized access, modification, or deletion of data. It is one of the most critical and widely exploited security flaws in web applications. Some of the most common vulerabilites:&#x20;

* **Input ':** Breaks the query and causes a database error, revealing vulnerability
* **Input 1' OR '1'='1:** Always true condition, returns all user records
* **Input 1' UNION SELECT user, password FROM users:** Extracts sensitive data like usernames and passwords

### What's a SQLite Injection

SQLite Injection is a type of security vulnerability that occurs when an attacker can insert or "inject" malicious SQL code into SQL queries executed by an SQLite database. This vulnerability arises when user inputs are integrated into SQL statements without proper sanitization or parameterization, allowing attackers to manipulate the query logic. Such injections can lead to unauthorized data access, data manipulation, and other severe security issues.

***

Let's start with a basic payload:

```
' OR '1'='1' --
```

This is a boolean login bypass. What does it do? Imagine this:

```sql
"SELECT * FROM users WHERE username = '[INPUT]' AND password = '[INPUT]';"
```

And when inject that:

```sql
SELECT * FROM users WHERE username = '' OR '1'='1' -- ' AND password = '...';
```

This comments out the password, closes the username, and makes sure its returns true. The ' is used as a indicator to end a string, a delimiter for strings.

<figure><img src="/files/JWr8fwe5CRSgFXgJJydn" alt=""><figcaption></figcaption></figure>

After putting that simple payload we get access to this screen.&#x20;

<figure><img src="/files/rS2Ns8pMHhRMF1ZHtzet" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/aF6vMsjZwFoLiFHLAJ9d" alt=""><figcaption></figcaption></figure>

With two commands, we can reach the flag.

```
' UNION SELECT name, sql, NULL FROM sqlite_master WHERE type='table' --
' UNION SELECT id, flag, NULL FROM more_table --
```

If we search up SQLite payloads, we can stumble across this website:

{% embed url="<https://swisskyrepo.github.io/PayloadsAllTheThings/SQL%20Injection/SQLite%20Injection/#sqlite-enumeration>" %}

It list a similar payload to what we are actually going to use:&#x20;

```
SELECT tbl_name FROM sqlite_master WHERE type='table'
```

Except we need to do a little bit of changing to this query. First of all, we need to select 3 columns.

```
SELECT city, address, phone FROM offices WHERE city = '...'
```

Since this is the original app query, adding UNION needs to also have 3 columns to match. Which brings us to what sqlite\_master is.

### What is SQLITE\_MASTER?

It's SQLite's internal system table that stores the entire database schema. Every table, index, view, and trigger gets a row in here automatically. It's the equivalent of:

{% embed url="<https://sqlite.org/schematab.html>" %}

<table><thead><tr><th width="178.16668701171875"></th><th width="563.4166870117188"></th></tr></thead><tbody><tr><td>SQLite</td><td><code>sqlite_master</code></td></tr><tr><td>MySQL</td><td><code>information_schema.tables</code></td></tr><tr><td>PostgreSQL</td><td><code>pg_catalog.pg_tables</code></td></tr></tbody></table>

Combining this with `WHERE type='table'` filters out indexes and views so you only see tables.&#x20;

### What is sql

You might as yourself what is "sql" in the select statement? It's a **column name** that exists inside `sqlite_master`. Not the SQL language itself — it's literally a column called `sql` that stores the full `CREATE TABLE` statement for each table. This is specific to sqlite. and which is why we were able to get the full statement creations.&#x20;

Lastly, you might ask yourself why use a Union? Well it's because it showed the column results first, meaning there's a query in the backed somewhere.

Can you see query results on the page?\
├── Yes → UNION-based injection\
└── No → Does behavior change based on input?\
├── Yes → Blind injection (boolean or time-based)\
└── No → Might not be injectable