Blind SQL injection: Can you execute a hex string as part of the query?

Question

Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a blind injection. The page returns no information unless you either run a query successfully or use quotation marks in a pattern that I haven't been able to identify, in which case it says "you can't do that". It is silent if you cause any sort of error with your input. As a result I haven't been able to figure out what the backend is, what varient of SQL is being used, what the database name is or what the table names are.

The statement being run must be something like "SELECT * FROM table WHERE title='". The site will allow me to dump all the entries of the table it's querying from by injecting something' OR '1' = '1. I know there's another table in the database containing information that I need to get at (a flag), but if I try something like something' UNION SELECT * FROM users WHERE '1' = '1, it returns "you can't do that". Even after a lot of fooling around with it I haven't been able to figure out on what criteria it filters quotes--the UNION statement I tried has the same amount of quote characters as the OR '1' = '1 statement that DOES run, and adding superfluous quotation marks that don't change the meaning of the query (adding random open and close quotes, putting a single quote in a comment in the middle of the query) sometimes triggers the "you can't do that" and sometimes does not. I haven't been able to identify a pattern.

My question is this: Is there a way that I can fool it into thinking I'm using the right number/pattern of quotes, such as a pattern that I already know works, but also include a hex-encoded UNION statement that would be run as part of the query? I've been trying things like something' OR '1' = '1 CONVERT(varbinary(max), <hex code for ' UNION SELECT * FROM users WHERE '1' = '1>) but not getting any results. Since the injection is blind I can't tell if I'm doing something that's a syntax error (does that CONVERT statement actually turn the hexcode into ascii that would then be executed as part of the query?) or if my logic is off. If somebody could let me know if what I'm doing makes sense and/or point me in the right direction that would be greatly appreciated.

Thanks!

Answer 1

For a UNION to succeed, both SELECTs need to select the same number (and possibly compatible data types) of columns.

So your first task would be to identify the number of columns in your initial SELECT. You can do this with the ORDER BY clause by specifying the numeric position of the column to be sorted by:

' ORDER BY 1,'

This would end up the the query as follows:

SELECT * FROM table WHERE title='' ORDER BY 1,''

A non-existing column position would result in an error. So just increment the number until you get an error (or false response).

Then you can construct your second SELECT with that exact number of columns and UNION it with the first one. Depending on the DBMS and column types, you may need to fiddle a little bit around with the column types of the second SELECT to find compatible types.

Answer 2

The reason for the app being vulnerable is simple. Assume the vulnerable app looks like this:

SELECT * FROM items WHERE itemid = '$id'

When this query is run, the vulnerability allows you to modify it into looking like this:

SELECT * FROM items WHERE itemid = 'something' OR '1' = '1'

Hopefully you can see how that has changed the SQL query to returning all of the entries from the items table.

In order to take advantage of this to run a completely new query, you would have to do something like this:

SELECT * FROM items WHERE itemid = ''; SELECT * FROM users WHERE '1' = '1'

Does this point you in the right direction at least?