Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose this is the only mitigation used on a server:

Dim IDPerson
IDPerson = Request.Querystring("id")
If IsNumeric(IDPerson) = True Then
IDPerson = IDPerson
Else
IDPerson = 0
End If

IDPerson is then used to write the query. The "id" is the GET variable.

I know IsNumeric will accept Hex as numeric.

Could a whole query be constructed in hex and pass the IsNumeric function?

share|improve this question
    
always wanted to know about that. i also do some stuff all the time to make sure the db isn't even touched. –  user24408 May 29 '13 at 22:34
add comment

1 Answer

up vote 1 down vote accepted

I'm gonna say that it depends on what you do later with the ID variable. If your code later converts the hex to a string and then builds queries with it, then the answer becomes 'yes'

Example:

I build an e-commerce website that looks looks up your purchase history based on your customer ID... Being a noob, I came up with a clever idea of using your email address to generate your ID by simply converting it to hexadecimal.

  • my email = customer@example.com
  • my ID would then be = 637573746f6d6572406578616d706c652e636f6d

That looks like a "pretty secure" and unique ID, so I feel really good about what I've done.

Now the injection:

Someone figures out that the user ID is simply the hex equivalent of the email address and guesses that I may be converting it back into text and using that result in a query

http://mysite.com/orderhistory?userid=637573746f6d6572406578616d706c652e636f6d

  • injected ID = 31272064726f70207461626c652075736572733b202d2d

  • ascii equivalent = 1' drop table users; --

If I, the developer, check to make sure the ID is numeric... then hex-to-text the ID... then use it in a query.... I've just allowed a sql injection

References:

Here's a similar question regarding SQL injections using only alpha-numeric characters: http://stackoverflow.com/questions/8086906/keeping-clear-of-sql-injections

Here's another thread discussing sql injection via hex: http://arstechnica.com/civis/viewtopic.php?f=20&t=107657

... Of course the right solution is to use 'real' prevention mechanisms such as parameterized queries, but this is certainly an interesting question.

share|improve this answer
    
I'm still not seeing an example anywhere of a complete query in Hex. It seems people only splash Hex in. –  k to the z May 31 '13 at 17:36
    
I added an example of how a developer gone wrong could allow the injection –  BrianAdkins May 31 '13 at 20:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.