Re: SQLi with backslash

On 25 June 2011 23:40, Voulnet <[email protected]> wrote:
> Have you tried a backslash to let MySQL auto escape a single quote for you?

All single and double quotes are being stripped by the application
before getting to the SQL query.

Nice try though.

Robin

> Example:
>
> insert into log values('a\', ' );drop table log --');
>
> If I am correct, the first parameter would be 'a\', ' <-- this would
> be because with the backslash, MySQL would escape the next single
> quote, and consider the starting single quote of the 2nd parameter as
> the closing quote of the 1st parameter, then what you input as the 2nd
> parameter would be executed, so you terminate the insert correctly and
> execute your SQLi string.
>
> I am not sure if it would work, but I'm sure you can play around with
> that concept and get it to to work. You might have some lack finding
> column truncation issues, too.
>
> ---------------------------------------------------------
> Voulnet: Your local geek
> Stalk me on twitter @Voulnet
>
>
> On Sat, Jun 25, 2011 at 10:33 PM, Robin Wood <[email protected]> wrote:
>> On 25 June 2011 17:51, Voulnet <[email protected]> wrote:
>>> Okay then, have you tried an alternate encoding? MySQL can act funny
>>> when asian characters are used. For reference you can see this:
>>>
>>> http://stackoverflow.com/questions/1220182/does-mysql-real-escape-string-fully-protect-against-sql-injection
>>>
>>> Because, if I understand correctly, there would a discrepancy between
>>> what PHP sees (thinking it is a normal multibyte character and passing
>>> it on, and what MySQL sees if set incorrectly which would result in it
>>> parsing the asian character as something + single quote.
>>
>> Just tried and it didn't work, was worth a try.
>>
>>> By the way, have you tried the char(39) or hex encoding and verified
>>> it didn't work?
>>
>> Yes, it won't work as the char(39) is inside the quotes so is just
>> taken as a string:
>>
>> insert into log values ('a', 'xx char(39) ...');
>>
>> To use it I would have to have broken out of the quotes first.
>>
>> Robin
>>
>>>
>>> On Sat, Jun 25, 2011 at 1:36 PM, Robin Wood <[email protected]> wrote:
>>>> On 24 June 2011 18:17, Voulnet <[email protected]> wrote:
>>>>> They are probably using that mysql_real_escape_string php function,
>>>>> which escapes these characters. There are many ways to bypass it, and
>>>>> you can find it all over the web.
>>>>>
>>>>> Some examples:
>>>>>
>>>>> use char(39) <-- ASCII decimal value of ' is 39
>>>>> or use the hex value. For example SELECT (0x27) <-- 27 is the hex value of '.
>>>>>
>>>>> For example if you want to load a file, you would call
>>>>> load_file('myfile'), using hex encoding you take 'myfile' with the
>>>>> single quotes included and convert it to hex, then write it as
>>>>> load_file(0x27..........27) with the rest of the hex values of the
>>>>> filename characters filled in between.
>>>>>
>>>>
>>>> No, all they are doing is stripping ' and ", they dump the statements
>>>> to screen in the error message.
>>>>
>>>> And using 0x27 will just end up with the string 0x27 being inserted as
>>>> it is inside the single quoted string. That might help if I could
>>>> escape the quotes but that is the bit I can't do.
>>>>
>>>> Robin
>>>>
>>>>>
>>>>> On Wed, Jun 22, 2011 at 5:03 PM, Robin Wood <[email protected]> wrote:
>>>>>> Hi
>>>>>> I've got a scenario where both single and double quotes are being
>>>>>> stripped but no other escaping appears to be being performed. The
>>>>>> database is MySQL with php on top.
>>>>>>
>>>>>> The query that I've found SQL injection on is in the form
>>>>>>
>>>>>> insert into log values ('a', 'b');
>>>>>>
>>>>>> where I can inject in to the second parameter.
>>>>>>
>>>>>> If I inject a backslash then I get
>>>>>>
>>>>>> insert into log values ('a', 'b\');
>>>>>>
>>>>>> which gives an invalid SQL statement and is how the injection was
>>>>>> found. Can anyone come up with a way to exploit this? If I put
>>>>>> anything before the slash isn't really worth anything and if I put
>>>>>> anything after then the statement becomes valid and the slash escapes
>>>>>> whatever character is after it.
>>>>>>
>>>>>> I thought about using the slash to encode something but couldn't get it to work.
>>>>>>
>>>>>> The table is write only for me, I can't see any of its entries echo'ed
>>>>>> back to the site anywhere so I can't go for stored XSS or anything
>>>>>> like that (maybe possible but not in the time available for the test).
>>>>>>
>>>>>> Apart from breaking the statement I can't see a way to exploit this,
>>>>>> can anyone else?
>>>>>>
>>>>>> Robin
>>>>>>
>>>>>>
>>>>>>
>>>>>> This list is sponsored by Cenzic
>>>>>> --------------------------------------
>>>>>> Let Us Hack You. Before Hackers Do!
>>>>>> It's Finally Here - The Cenzic Website HealthCheck. FREE.
>>>>>> Request Yours Now!
>>>>>> http://www.cenzic.com/2009HClaunch_Securityfocus
>>>>>> --------------------------------------
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------