0

I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol:

user="user"
pass="pass"

if "'" in user+pass:
  print "error"

else:
  db.execute("select * from users where username = '%s' and password = '%s'" % (username,password))

So when I try to inject asdf' or '1'='1 into any of the fields, the if clause stops me. I have tried to encode the quote symbol in different encodings (hex, base64, html, etc.), but it still does not work.

Any ideas?

Improve this question

2 Answers 2

Reset to default
2

Use a backslash as the last character in user. For example, for the inputs user\ and or 1=1 -- the following query is run:

select * from users where username = 'user\' and password = ' or 1=1 -- '

Where the string input is interpreted like this:

select * from users where username = 'user\' and password = ' or 1=1 -- '

Improve this answer
0
1

You control two inputs. That means you can end the first one with an escape character, effectively extending it to the start of the second input, and then put arbitrary SQL in the second one. To avoid an unmatched quote at the end of the second input, you'll need to comment out the rest of the query.

Improve this answer
3
  • But my question is, any text that I put on any of the fields will be moved to the sentence as 'text', so it's necessary to close the ', and if I add a comment without closing the quote, SQL will throw a syntax error, no? I'm a little newby with SQL syntax, so I cannot see how can I close this quoted field :/
    – g0ldrush
    Commented Dec 23, 2018 at 13:27
  • I see Sjeord already went and just handed you the answer, but please tell me you at least tried to follow the instructions, maybe looking up "SQL escape character" if you didn't know what it was or did? I expressly told you how to avoid the extra quote (which, if you followed the steps, would not be unclosed, because one of the four total quotes got escaped) causing a syntax error.
    – CBHacking
    Commented Dec 24, 2018 at 6:20
  • Yes, I tried to close the first quote with \, but after this, I was making a mistake at the password field, so I had unclosed quotes and I was not seeing where was the mistake. By the way, thx for your answer, it made me to focus on where I have to check
    – g0ldrush
    Commented Dec 24, 2018 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .