0

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities.

However I am surprised as the injection query throw error for casting and the scanner has extract SQL server version information.

microsoft sql server 2012 (sp3) (kb3072779) - 11.0.6020.0 (x64)
oct 20 2015 15:36:27
copyright (c) microsoft corporation
web edition (64-bit) on windows nt 6.3 <x64> (build 9600: ) (hypervisor)

String used for injection

'AND 1=cast(0x5f21403264696c656d6d61 as varchar(8000)) or '1'='

When form submitted in response server throw error for casting as below.

Conversion failed when converting the varchar value '_!@2dilemma' to data type int.

Then I tried to look on web and I found below links but the do not have information how they extract data.

http://xss.cx/examples/netsparker/www.hmficweb.hinghammutual.com_80.htm

1

The variable @@version returns the current SQL Server version.

Examples here:

Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)

Apr 2 2010 15:48:46

Copyright (c) Microsoft Corporation

Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

Going back to basics, to manually find a SQL injection vulnerability you would inject something like

' OR '1'='1' UNION SELECT 1;--

into an input, which would make a query execute similar to the following

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT 1;--'

This would combine the results from the original, altered query, with the results from the additional 1 value column.

However, you first need to make sure the number of columns you are selecting matches the original query. So you may need to change the 1 to 1, 2, 1, 2, 3, 1, 2, 3, 4, etc, until you get your values returned.

Once you get a valid result returned from the page that contains your injected values, you simply replace one of the injected values with @@version. e.g.

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT @@version,2,3;--'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.