Reading Files
DB User
SELECT USER()
SELECT CURRENT_USER()
SELECT user from mysql.userOur UNION injection payload will be as follows:
cn' UNION SELECT 1, user(), 3, 4-- -
##or
cn' UNION SELECT 1, user, 3, 4 from mysql.user-- -Which tells us our current user, which in this case is root:
User Privileges
Once again, we can use the following payload with the above query:
If we had many users within the DBMS, we can add WHERE user="root" to only show privileges for our current user root:
The query returns Y, which means YES, indicating superuser privileges. We can also dump other privileges we have directly from the schema, with the following query:
From here, we can add WHERE grantee="'root'@'localhost'" to only show our current user root privileges. Our payload would be:
And we see all of the possible privileges given to our current user:
LOAD_FILE
Note: We will only be able to read the file if the OS user running MySQL has enough privileges to read it.
Similar to how we have been using a UNION injection, we can use the above query:
Another Example
We know that the current page is search.php. The default Apache webroot is /var/www/html. Let us try reading the source code of the file at /var/www/html/search.php
However, the page ends up rendering the HTML code within the browser. The HTML source can be viewed by hitting [Ctrl + U]
Last updated