MariaDB Syntax Error Injection

Context

The objective of this article is to teach how to exploit MariaDB syntax error injection for information disclosure. This technique is valuable for gaining insights into database structure by exposing sensitive information. To fully comprehend and execute this method, readers should be familiar with SQL query structures, error handling in SQL, and have prior knowledge of MariaDB error-based techniques.

Theory

Syntax Error Injection in MariaDB

Syntax error injection is an offensive technique where attackers leverage SQL syntax errors to extract sensitive information from databases. This method exploits improper error handling and verbose error messages that are often enabled by default in database systems.

In practice, this involves crafting SQL queries designed to intentionally fail. When these queries execute, they trigger detailed error messages from MariaDB. These messages can inadvertently provide valuable information about the database schema, including table names, column names, and even specific database configurations.

Understanding MariaDB Error Messages

MariaDB's error messages can be unexpectedly verbose. They are designed to assist developers in debugging but can also provide malicious actors with insights into the database structure.

The core principle of this technique is recognizing that error messages, when exposed, allow attackers to understand the data flow between the database and the application layer. By analyzing these error messages, attackers can pinpoint vulnerabilities that may reveal sensitive information, such as database structures or contents.

Type Mismatch and Invalid Query Techniques

Type mismatches and invalid SQL queries are common strategies for triggering syntax errors in MariaDB. By inserting values that do not match the expected data types, or crafting SQL statements with structural inconsistencies, attackers force the database to return error messages.

To succeed, attackers often employ carefully crafted queries that exploit input validation weaknesses. For instance, using a mismatched single quote or introducing unexpected SQL commands can induce syntax errors deliberately. Bypassing input validation is crucial for these techniques as it allows malformed queries to reach the database effectively.

Practice

MariaDB Syntax Error Injection

Below are some practical steps to execute a MariaDB syntax error injection attack, leading to information disclosure.

• Triggering a Syntax Error

  To start exploiting syntax errors, we can use mismatched quotes in a query:

  SELECT * FROM users WHERE id = 1' AND 1=2 UNION SELECT 1,2,3 -- -;
  

  This query introduces a mismatched quote after 1, causing a syntax error. If the error message is displayed, it may reveal insights such as the table structure or SQL syntax.

• Using a Subquery for Extraction

  Alternatively, a subquery can be utilized to exploit error-based vulnerabilities:

  SELECT * FROM users WHERE id = 1 AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a);
  

  This malformed query intentionally forces a syntax error using a complex subquery. The query attempts to concatenate the database name, causing an error message that can leak the database's name.

These tactics rely on being able to view the error messages, which expose internal database details valuable to attackers.

Tools

• sqlmap

• Burp Suite

These tools support SQL injection testing by automating and streamlining the injection process, making it easier to induce and analyze SQL errors.