RE: SQLi with backslash

That trick is dependent upon the SQL database being configured to use the BIG-5 charset. Worth a try, but I have found that most are not. 
________________________________________
From: [email protected] [[email protected]] on behalf of Voulnet [[email protected]]
Sent: Saturday, June 25, 2011 10:51 AM
To: Robin Wood
Cc: [email protected]
Subject: Re: SQLi with backslash

Okay then, have you tried an alternate encoding? MySQL can act funny
when asian characters are used. For reference you can see this:

http://stackoverflow.com/questions/1220182/does-mysql-real-escape-string-fully-protect-against-sql-injection

Because, if I understand correctly, there would a discrepancy between
what PHP sees (thinking it is a normal multibyte character and passing
it on, and what MySQL sees if set incorrectly which would result in it
parsing the asian character as something + single quote.

By the way, have you tried the char(39) or hex encoding and verified
it didn't work?

On Sat, Jun 25, 2011 at 1:36 PM, Robin Wood <[email protected]> wrote:
> On 24 June 2011 18:17, Voulnet <[email protected]> wrote:
>> They are probably using that mysql_real_escape_string php function,
>> which escapes these characters. There are many ways to bypass it, and
>> you can find it all over the web.
>>
>> Some examples:
>>
>> use char(39) <-- ASCII decimal value of ' is 39
>> or use the hex value. For example SELECT (0x27) <-- 27 is the hex value of '.
>>
>> For example if you want to load a file, you would call
>> load_file('myfile'), using hex encoding you take 'myfile' with the
>> single quotes included and convert it to hex, then write it as
>> load_file(0x27..........27) with the rest of the hex values of the
>> filename characters filled in between.
>>
>
> No, all they are doing is stripping ' and ", they dump the statements
> to screen in the error message.
>
> And using 0x27 will just end up with the string 0x27 being inserted as
> it is inside the single quoted string. That might help if I could
> escape the quotes but that is the bit I can't do.
>
> Robin
>
>>
>> On Wed, Jun 22, 2011 at 5:03 PM, Robin Wood <[email protected]> wrote:
>>> Hi
>>> I've got a scenario where both single and double quotes are being
>>> stripped but no other escaping appears to be being performed. The
>>> database is MySQL with php on top.
>>>
>>> The query that I've found SQL injection on is in the form
>>>
>>> insert into log values ('a', 'b');
>>>
>>> where I can inject in to the second parameter.
>>>
>>> If I inject a backslash then I get
>>>
>>> insert into log values ('a', 'b\');
>>>
>>> which gives an invalid SQL statement and is how the injection was
>>> found. Can anyone come up with a way to exploit this? If I put
>>> anything before the slash isn't really worth anything and if I put
>>> anything after then the statement becomes valid and the slash escapes
>>> whatever character is after it.
>>>
>>> I thought about using the slash to encode something but couldn't get it to work.
>>>
>>> The table is write only for me, I can't see any of its entries echo'ed
>>> back to the site anywhere so I can't go for stored XSS or anything
>>> like that (maybe possible but not in the time available for the test).
>>>
>>> Apart from breaking the statement I can't see a way to exploit this,
>>> can anyone else?
>>>
>>> Robin
>>>
>>>
>>>
>>> This list is sponsored by Cenzic
>>> --------------------------------------
>>> Let Us Hack You. Before Hackers Do!
>>> It's Finally Here - The Cenzic Website HealthCheck. FREE.
>>> Request Yours Now!
>>> http://www.cenzic.com/2009HClaunch_Securityfocus
>>> --------------------------------------
>>>
>>>
>>
>



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------




This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------