[Swyft™]

I need help with SQL Injection how do I do it?

[ReneG]

I'm not sure how it would be done in a sa-mp server, attackers attack forums usually.
[ame="http://www.youtube.com/watch?v=PB7hWlqTSqs&feature=related"]http://www.youtube.com/watch?v=PB7hWlqTSqs&feature=related[/ame]

[Steven82]

Quote:

Originally Posted by RockingCamman I need help with SQL Injection how do I do it?

I don't think anyone is going to give you that knowledge do to you attempting to go on servers that have SQL and injecting stuff into their databases.

[Vince]

Quote:

Originally Posted by VincentDunn I'm not sure how it would be done in a sa-mp server, attackers attack forums usually.

Mostly through login dialog. Most servers use the new DIALOG_STYLE_PASSWORD for that so the characters aren't visible anymore, but still ... Consider this query:

PHP код:

SELECT id FROM playerinfo WHERE name = '%s' AND password = sha1('%s') LIMIT 1; 


If the pass is not escaped, one could possibly input in the dialog box:

Код:

blah') OR TRUE --

which would make the query:

PHP код:

SELECT id FROM playerinfo WHERE name = '%s' AND password = sha1('blah') OR TRUE -- ) LIMIT 1; 


The double dash is the start of a comment in SQL syntax.

[ReneG]

Quote:

Originally Posted by Vince Mostly through login dialog. Most servers use the new DIALOG_STYLE_PASSWORD for that so the characters aren't visible anymore, but still ... Consider this query: PHP код: SELECT id FROM playerinfo WHERE name = '%s' AND password = sha1('%s') LIMIT 1;  If the pass is not escaped, one could possibly input in the dialog box: Код: blah') OR TRUE -- which would make the query: PHP код: SELECT id FROM playerinfo WHERE name = '%s' AND password = sha1('blah') OR TRUE -- ) LIMIT 1;  The double dash is the start of a comment in SQL syntax.

How would the information be relayed back to the attacker through a sa-mp server?

[SuperViper]

Any decent server that uses SQL escapes the string before using it in a query.

[Christopher]

Quote:

Originally Posted by VincentDunn How would the information be relayed back to the attacker through a sa-mp server?

It typically wouldn't be unless the server had been outputting the returned values from the SQL query witch in theory is stupid. This type of attack would only normally be used on a SA-MP server if you already had prior knowledge of a users ID or username.