8

I have a question I'm hoping you could help with?

I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection.

My question: Is it true to say that any urls that could potentially be vulnerable to sql injection always contain an 'equals' (=) symbol in the url?

Therefore, if I was to grep for all the url's that contain an '=' symbol in the url, would I miss any other url's that do not contain an '=' symbol that could still be vulnerable?

For example these all contain an '=' symbol and could potentially be vulnerable to sql injection.

http://[website]/index.php?itemid=10
http://www.[yoursite].org/site/page.asp?CID=72&DID=
http://www.[mysite].com/site/page.asp?=

Are there any instances where url's do not contain an '=' and are still vulnerable to sql injection?

-------EDIT-------

I am ONLY interested in altering/injecting the URL in my browsers URL bar to see if any URLS in my list are potentially vulnerable to sql injection (i.e not interested in injecting forms or POST requests and so on yet).

I have a list of URLS in a txt file

FILE.txt

http://www.[site].com/index.php?itemid=10
http://www.[site].com/
http://www.[site].com/site/page.asp?CID=72&DID=
http://www.[site].com/animals/pictures
http://www.[site].com/pictures
http://www.[site].com/index.php?itemid=7
http://www.[site].com/faq

I want to filter/grep this txt file so I only get the URLS that contain an '=' symbol as shown below:

FILTEREDFILE.txt

http://www.[site].com/index.php?itemid=10
http://www.[site].com/site/page.asp?CID=72&DID=
http://www.[site].com/index.php?itemid=7
http://www.[site].com/site/page.asp?CID=72&DID=

Using these URLS in the FILTEREDFILE.txt I will then use a foreach loop to add an apostrophe to the end of each one to see if it is vulnerable to sql injection by looking at the response content lengths to see if there is a change/difference.

I know that even on the URLS and do not contain an '=' that there still may be sql injection vulnerabilities in the forms and POST requests and so on, but I am not interested in those at the moment.

IMPORTANT:

I am only interested in vulnerabilities that can be determined by changing/altering the URL itself (i.e by adding an apostrophe to the end of http://www.[site].com/index.php?itemid=7 and so on).

What I want to know is whether by greping the txt file for URLS that contain an '=' symbol will I miss any URLS that could still be vulnerable that do not contain an '=' symbol. (excluding forms, POSTS, url rewrites, just manipulating the URL in the URL bar)

Hope this better explains my question,

thanks for your help

Improve this question
4
  • 2
    Any usage of $_GET, $_POST or (often forgotten) $_SERVER to construct SQL query strings is a potential vulnerability. Also if you read from any files (local or remote). Any data that your scripts use that is not hard coded is potentially subvertable. There are so many ways to get information into a web application.
    – lynks
    Commented Feb 20, 2013 at 11:36
  • thanks for your help. I know there are many other ways and places to inject, but I am going to write a script to check each url to see if it is vulnerable by adding an apostrophe to the end of each url. Obviously if the script has 5000 urls to check it will take some time, but if i can filter them urls down so the script can just check the 17 urls that look similar to http://www.[site].com/index.php?itemid=10 this will be much preferred.
    – yonetpkbji
    Commented Feb 20, 2013 at 11:43
  • Just appending an apostrophe is not a strong enough fuzzing method to determine whether there exists an SQL injection. Your scripts might correctly handle an apostrophe but be vulnerable to other types of injection. You would also need to try each $_GET variable, and all permutations, as weird combinations could trigger a vulnerability when just trying each variable in turn might not.
    – lynks
    Commented Feb 20, 2013 at 11:48
  • @lynks - Yes your right, I will have a payload.txt that will contain all permutations for example different or, and, order by strings that it will iterate through against each url and then analyse the response content lengths, i just need to know the best method to filter these urls done so i dont have so many, but still keep the ones that may potentially be vulnerbale
    – yonetpkbji
    Commented Feb 20, 2013 at 11:57

4 Answers 4

Reset to default
11

SQL injections can be performed in any part of the request. Any parameter of the HTTP request can hold SQL data that can trick the application into injecting it into the database.

For example, Amazon has the product IDs in the URL http://www.amazon.com/gp/product/B008GFRB9E This is called an URL rewrite and the webserver extracts the product id from the URL and uses it to query the database for it.

Without having the source code available, there is no way to know what SQL queries are being performed. One web application can perform a reverse DNS on the connecting IP address and insert that name in the database. But the IP can resolve to a string that performs an SQL injection.

Here are some of the ways to get variables from the URL into the web application:

When parsing your links remember that characters can be URL encoded.

Improve this answer
7
  • Okay yes that helped a lot, thanks. Excluding sites that use url rewriting would it be a good idea to filter my list of url's to only get the ones that contain an '=' symbol then, so I can then use this new list to go on and add apostrophes and so on to check if they are vulnerable to sql injection? Other than urls that have had url rewriting done to them would this be an accurate way of getting a list of urls that could potentially be vulnerable? thank you very much for your help.
    – yonetpkbji
    Commented Feb 20, 2013 at 10:26
  • Also am I correct in thinking that URL rewriting dosn't prevent sql injection from occuring, just makes it more difficult to inject than say http://[website]/index.php?itemid=10 as I could just add an apostrophe to the end of this url to check if it us vulnerable?
    – yonetpkbji
    Commented Feb 20, 2013 at 10:33
  • URL rewrite is just one of the ways you could pass data to the application. It's true that url?variable=value is the most common way to pass information but there are MANY other ways. Passing data with POST is the next most common way. URL rewrite make detection of injection points more difficult for automated tools.
    – Cristian Dobre
    Commented Feb 20, 2013 at 10:39
  • Okay then, i understand what your saying now. I know why I was a little confused by your answer. I'll just edit my question to explain what I am trying to do a little better, thanks
    – yonetpkbji
    Commented Feb 20, 2013 at 11:00
  • 1
    @RoryMcCune Generally referred to as Clean Urls or RESTful Urls. en.wikipedia.org/wiki/Clean_URL
    – BZink
    Commented Feb 21, 2013 at 19:15
1

It is possible to not contain the equal sign, even if there was no URL rewrite, but it will depend on how badly is the website coded.

Any part of the web url, that will result in an sql query, could be used to do sql injection if not properly sanitized.

Get variables could be passed with no value, just the definition.

Consider this example:

URL: http://site.com/user.php?user-1234

Code:

foreach ($_GET as $k => $v) {
    $k2 = explode('-', $k);
    if ($k2[0]='user') $res=$k2[1];
}
//do sql query with $res
Improve this answer
1

All input is vulnerable to SQL injection, so you need to always filter and check on the server side. Don't worry about where it comes from, just any time you are using a variable from the user, from reading a file, more or less anytime you do not have the value hardcoded, you should do the proper escaping and checking.

If you are not already familiar with OWASP, I suggest you start with their guide on SQL Injection.

I would not rely on the equal string as a detector, you might get a SQL injection that changes functionality or trips up a boolean check with a simple comment injection attack.

Also, as noted in the other answers, if you filter on query strings you miss out on pages which process form data transmitted via POST method. For example, if you had the url that processes the results of a form submission, it might not have any get parameters, but there will still be SQL injection possible when the POST values are processed. I did read your full post, but I am not sure why you would not want to check against all input forms if you are doing the effort to test your application. Better to run some automated tools like nikto, burp's scanner, or AppScan if you have the funds.

It seems like you are putting in a great deal of effort to only cover part of the problem. Also, if you have the source code, I would start there if you are a programmer rather than identifying the pages, because there might be multiple pages which call the same function.

Improve this answer
0

Short answer no you cannot assume that only URLs with an = in them are possible vectors for SQL injection.

The problem with this assumption is that it ignores the use of content handlers and web frameworks which use the url path information to determine what handler/procedure is called and how to handle the path information. Consider many REST based services that use this approach as well as many popular web frameworks.

I could have a URL like

http://example.com/handler/argument1/argument2/arguement3

where handler is called and passed arguement1, arguement2 and arguement3. Depending on how handler is implemented and what it does, it cold easily provide a vector for sql injection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .