Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just found in logs that someone try to exectue this SQL injection

/commands.php?id=-1+union+select+0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a

anybody know what he/she wated to do? Is it valid? Anybody know how to decode those hex strings?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

With so less information, it's hard to say if it worked and what it did.

You can try to execute this command and see what it does. It is harmless : The hex part is just 0x6c6f67696e70776e7a, repeated 10 times and it translate to ?loginpwnz

share|improve this answer
    
I don't have vulnerable script, I don't even have commands.php file, so I will need to create it to test it. But if it's just loginpwnz text then It look like it will not work, since to test number of columns in Select you want to test with Union select you need to put contants (like numbers). –  jcubic Jul 11 '12 at 8:53
    
That's not correct. You can put whatever you want in an union when testing the number of columns, as long as it isn't filtered. –  Zzz Jul 11 '12 at 9:00
    
What is not correct? –  Cyril N. Jul 11 '12 at 10:05
    
Sorry I was replying to @jcubic, there's nothing wrong with your answer. –  Zzz Jul 11 '12 at 15:56
add comment

Well, a few minutes of googling give pretty interesting results ;> Someone was scanning your website. To scan it, this: tool had been used.

I recommend you to use this tool again and check if the attacker found any flaw in your web application.

share|improve this answer
    
Thanks, I try to search for that in google, but didn't search hard enough. And I don't use any query string, I have htaccess rule that return 403 for those.v And it is not actually and php just simple php script without any input from outside. –  jcubic Jul 11 '12 at 10:39
add comment

It's trying to see if that page is vulnerable to sql injection. It uses id=-1 to make the original query return no results so the union is executed (since usually only the first record is fetched). If the union is executed, the attacker will find 'loginpwnz' in the returned page (the hex is to avoid using quotes, which might be escaped).

Since the union select must return the same exact number of columns, the attacker is probably trying from 1 to n columns.

share|improve this answer
    
So that hex is interpreted as string? –  jcubic Jul 11 '12 at 10:32
    
I think you pretty much covered it all with this answer. Very good and explanatory answer! –  Chris Andrè Dale Jul 11 '12 at 13:46
1  
@jcubic, yes mysql can interpret hex literals as strings see Hexadecimal Literals –  Zzz Jul 11 '12 at 15:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.