5

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button.

Info on what I have and was able to find out:

  • it is obviously vulnerable being a task to log in into a system, while having forgotten the password (classic form with to input fields: name: INPUT , password: INPUT )
  • a hint is provided that my Login-ID for the tasks page is always being accepted, therefore only the password should be missing (form: name: "my ID", password: INPUT (?))
  • the server runs/emulates MySQL, I found this due to errors I received while trying different inputs (e.g. "' OR 1=1"-Tricks, Union-Commands, Outcommenting, etc.):
  • -> the structure is showed through MySQL syntax errors: SELECT name,password FROM login WHERE name='xyz' and password='xyz'
  • -> Union-commands work due to e.g. column number errors
  • Magic quotes are off (?) or I wouldn't be able to evoke SQL-commands, I guess
  • Using GBK characters to bypass the manipulation through ' didn't work either, it seems like they are not being recognized
  • No PHP code available
  • Server returns 'task solved' when the login is successful

Question: What possibilities are left for me to try in order to finally log into the system successfully via sql injection?

Examples for inputs I tried:

name: myID [which is the ID that the hint suggests]

password: ' OR '1'='1

  • server returns 'wrong answer' (login not successful), no mysql errors

name: myID' OR '1'='1' --

password: whatever

  • same result

name: myID' AND NOT ('1'='2

password: foo') AND name='myID' LIMIT 1 #

  • same result

Errors for example, when:

name: myID' OR 1=1

password: whatever

  • server returns 'wrong answer' (login not successful), results in syntax error, because input is put into ' '

closed as unclear what you're asking by Steffen Ullrich, Xander, symcbean, Rory Alsop Jan 1 '16 at 0:51

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It's not 100% clear what you are asking. My understanding is that you have a web form with name and password, and you are supposed to perform an SQL injection attack on the script this form posts to and bypass the need for the password? – jcaron Dec 31 '15 at 16:00
  • I added some examples as an edit in the question. As mentioned I also tried Union commands and some other things, but no success. – vmboy04 Dec 31 '15 at 16:52
  • You earlier said that some of the errors resulted in the generated SQL being dumped. I don't see that in your edit. Also, consider that the script may possibly check that the SQL returns a single row, and that the username actually matches the one entered. You may have to play with judiciously placed (s and `)'s to ignore just the password condition, but still keep the username condition. – jcaron Dec 31 '15 at 16:59
  • Can you further elaborate where you got this task from? Is it a school assignment? An online challenge? Other? – Neil Smithline Dec 31 '15 at 19:08
  • I think you're on the right track with your latter attempts (attempting to get a username). It's likely that it does a username check first, then does a password check (since it tells you '(no login)'). One thing I've noticed is that you haven't reported trying any line delimiters, i.e. myId'; SELECT * FROM [USERS];--. This doesn't always work, but is a good next move I think. The semicolon splits the command into two statements, allowing you to run arbitrary queries. If you end up being able to do this, you could also do something like inject (INSERT) a new userId/password for you to use. – Nate Diamond Dec 31 '15 at 19:50
3

The authentication mechanism is implemented at the back-end and hence, there are two key services which many security professionals offer:

  • White-box security assessments
  • Black-box security assessments
  • Gray-box security assessments
  • Glass-box security assessments

I won't go into details of each of these service offerings as it's plainly business model of the company, organization and the way these key services are offered but for the technical understanding, one would need to consider that it depends on the type of services the test cases have to be prepared.

For an example, one might not have access to the source code, and this must not stop an attacker given the time & resources to attack a certain entry point i.e. in this case - a login entry. What you'd need to input depends on the source code but as a black-box security consultant, you would need to figure out trial and error basis of approach of what must be the back-end and accordingly prepare your attempts.

This approach is highly time-taking but could be automated by Burp Suite 'Intruder' and a list of possible inputs could be fed to the intruder in order to automate the task for you. Additional authentication bypass have been described here. As for the errors you've received, check all of these following items:

  1. Make sure you aren't tapped into a back-end login honeypot.
  2. Make sure when automating, the application hasn't employed rate limits.
  3. If the above is true, make sure, you have adjusted timing at Intruder.
  4. If howsoever, the rate limitation measures are Geo-location based, try pivots.
  5. If system returns 'task solved', you'd require to grep the output from the results of the intruder and hence investigate that particular HTTP responses. Or, you can go through the 'response codes' and select 302 responses provided system doesn't throw 200 on every attempts (if login successful or not) or 500 at an error stage.

Sometimes, many testers over-estimate and never try simpler methods which is to see if admin/admin works or the list provided here works. It again would depend on trial and error approaches without having to know the exact source code but attempting to enumerate from all errors that you trigger and then construct your bypass. Try admin' or '1'='1'-- on both fields for an example along with others mentioned on the list.

  • 2
    I'm not sure you understood the question Shritam. As I read it, this is some hacking challenge that the OP is attempting. Do you read it differently? If I'm correct, the discussion about professional services, honeypots, rate limitations, and such, doesn't seem relevant. I do like the list of commonly successful inputs! – Neil Smithline Dec 31 '15 at 19:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.