1

Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a blind injection. The page returns no information unless you either run a query successfully or use quotation marks in a pattern that I haven't been able to identify, in which case it says "you can't do that". It is silent if you cause any sort of error with your input. As a result I haven't been able to figure out what the backend is, what varient of SQL is being used, what the database name is or what the table names are.

The statement being run must be something like "SELECT * FROM table WHERE title='". The site will allow me to dump all the entries of the table it's querying from by injecting something' OR '1' = '1. I know there's another table in the database containing information that I need to get at (a flag), but if I try something like something' UNION SELECT * FROM users WHERE '1' = '1, it returns "you can't do that". Even after a lot of fooling around with it I haven't been able to figure out on what criteria it filters quotes--the UNION statement I tried has the same amount of quote characters as the OR '1' = '1 statement that DOES run, and adding superfluous quotation marks that don't change the meaning of the query (adding random open and close quotes, putting a single quote in a comment in the middle of the query) sometimes triggers the "you can't do that" and sometimes does not. I haven't been able to identify a pattern.

My question is this: Is there a way that I can fool it into thinking I'm using the right number/pattern of quotes, such as a pattern that I already know works, but also include a hex-encoded UNION statement that would be run as part of the query? I've been trying things like something' OR '1' = '1 CONVERT(varbinary(max), <hex code for ' UNION SELECT * FROM users WHERE '1' = '1>) but not getting any results. Since the injection is blind I can't tell if I'm doing something that's a syntax error (does that CONVERT statement actually turn the hexcode into ascii that would then be executed as part of the query?) or if my logic is off. If somebody could let me know if what I'm doing makes sense and/or point me in the right direction that would be greatly appreciated.

Thanks!

  • Is this part of some security challenge or a live site? – Neil Smithline Dec 6 '15 at 0:13
  • A security challenge @NeilSmithline – noodlesandnoodles Dec 6 '15 at 0:13
  • Try using something along the lines of something' OR '1' = '1'; [Insert another query here] – Jonathan Gray Dec 6 '15 at 0:23
  • @JonathanGray doesn't work--gives back "you can't do that". I'm operating under the assumption that the number and spacing/setup of the quotes matter, which is why I was resorting to encoding with hex. I tried doing something' OR '1' = '1 CONVERT and the hex for closing the quote on the 1, the semicolon and the next query up until the closing quote but it doesn't work (returns nothing). I'm wondering if I'm using CONVERT wrong or if I just don't know the right table name. – noodlesandnoodles Dec 6 '15 at 0:30
  • @noodlesandnoodles It may help you just to do some basic research on the syntax of SQL, to help you understand the reason why something' OR '1' = '1 works to begin with, then you can just expand from there. The reason why I suggested a semicolon is because it allows you to escape the first query and run a completely new one. Remember when you're making your new query though, that it's expecting your query to end with an apostrophe and you must not include it in the line itself, as it is automatically inserted by the vulnerable app. – Jonathan Gray Dec 6 '15 at 0:39
2

For a UNION to succeed, both SELECTs need to select the same number (and possibly compatible data types) of columns.

So your first task would be to identify the number of columns in your initial SELECT. You can do this with the ORDER BY clause by specifying the numeric position of the column to be sorted by:

' ORDER BY 1,'

This would end up the the query as follows:

SELECT * FROM table WHERE title='' ORDER BY 1,''

A non-existing column position would result in an error. So just increment the number until you get an error (or false response).

Then you can construct your second SELECT with that exact number of columns and UNION it with the first one. Depending on the DBMS and column types, you may need to fiddle a little bit around with the column types of the second SELECT to find compatible types.

  • Thanks, this worked! Running the ORDER BY surprised me because it actually got to position 10 before it started giving met the error, but when I dump the whole table there are only 5 columns displayed. Any idea what that's about? Could there be hidden columns in the table the code is querying? Not sure if that's a thing that exists. Anyway I've narrowed the SQL variant down to either Postgres or Oracle so I'll see if I can eke the name out one letter at a time with boolean testing or timing or something. – noodlesandnoodles Dec 6 '15 at 8:17
  • @noodlesandnoodles Maybe the table is joined with others or there are other aggregated columns. – Gumbo Dec 6 '15 at 8:40
0

The reason for the app being vulnerable is simple. Assume the vulnerable app looks like this:

SELECT * FROM items WHERE itemid = '$id'

When this query is run, the vulnerability allows you to modify it into looking like this:

SELECT * FROM items WHERE itemid = 'something' OR '1' = '1'

Hopefully you can see how that has changed the SQL query to returning all of the entries from the items table.

In order to take advantage of this to run a completely new query, you would have to do something like this:

SELECT * FROM items WHERE itemid = ''; SELECT * FROM users WHERE '1' = '1'

Does this point you in the right direction at least?

  • 1
    Thanks, but I already do understand why this structure is vulnerable. I'm asking about the specifics of my CONVERT syntax and how it's being evaluated by the backend in the context of the rest of the query. – noodlesandnoodles Dec 6 '15 at 0:55
  • @noodlesandnoodles Don't worry about CONVERT, there is no need for it. Not unless you already are getting back data but you want it in another format. Or unless you're trying to cause errors for informational purposes. – Jonathan Gray Dec 6 '15 at 1:01
  • If I just include a long hex string will it be automatically converted back to ascii in the backend as part of my query? I didn't think that was the case which is why I was trying to convert it. – noodlesandnoodles Dec 6 '15 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.