1

I am currently studying SQLi from a book which I won't mention to avoid any copyright issues. The book contains many examples of strings / code from MSSQL, MySQL, Oracle etc.

I am currently stumped as to what the equivalent syntax would be in PHP/MySQL for this example, given only in .asp (assuming a DB of MSSQL). This is an injection string as used in the browser's address bar, using ORDER BY to enumerate the number of columns in a table, iterating through ORDER BY 1, ORDER BY 2 etc. until producing an error:

hxxp://someserver.com/products.asp?id=12+order+by+1

So, would the equivalent syntax in PHP/MySQL be something like:

hxxp://someserver.com/products.php?id=12 order by 1

I'm thinking whitespace is OK here? Or perhaps:

hxxp://someserver.com/products.php?id=12%20order%20by%201

I have written an application for XAMPP in order to test, but an unable to produce an error, so I'm checking to make sure that I'm using the correct syntax.

To be clear, for the present post, I'm really only asking about syntax.

Edit: I thought I was very clear that I was only asking about whitespace in a URL... I did produce the error I was looking for.

I have found an instance where a space vs %20 do not produce the same results - as the very last character in a URL.

This (note the single space after the two hyphens):

/victim/products.php?val=100' ORDER BY 4 -- 

produces this:

Database access failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1.

While this:

/victim/products.php?val=100' ORDER BY 4 --%20

produces:

Database access failed: Unknown column '4' in 'order clause'.

Interesting...

I know that the very same build of XAMPP has no problem with a space after 2 hyphens at the end of an injection when it's in a login field using the POST method...

  • 2
    ORDER BY in this case for MySQL and MSSQL ( or T-SQL ) is the same as the syntax as you stated, and in both cases identical. If it's not working there is some form of information you are leaving out or are missing. Maybe it's a blind-case? Before checking for columns you need to verify the current scenario: error-based or blind. What happens when you inject MySQL special characters, how does the server act ? And move on from there. – dylan7 Jul 5 '16 at 1:13
  • dylan7 - thanks so much for the input! I've actually been wondering why I couldn't get the error to happen for a few weeks but tonight I tried something in desperation and it worked! I wasn't able to comment out the final back-tick in the query, 'code' -- 'code' wasn't doing it, neither was other commenting techniques. I finally tried: 'code'%20--$20'code' - and it worked! Jumping up and down like a little kid here tonight! Thanks again! EDIT: uh-oh....it would appear that the mini-Markdown 'code' isn't happening.....sorry – russ6100 Jul 5 '16 at 5:02
  • Do know your not supposed to be passing the data in via the URL, and instead use the POST command to avoid this situation. Otherwise, you just opening yourself up to attacks from hackers. – cybernard Mar 29 '18 at 2:46
1

So you have three different way of expressing a space: , + and %20. When you enter an URL, your browser will first trim it and then URL encode it. You can see this in action by taking a look at the network tab in the developer tools in Chrome. There you can see the URL that is actually being sent, as opposed to the one you enter in the URL bar.

From this we can conclude that a space and %20 are equivalent, except at the end where the space will be ignored while the %20 will not. As for + all standard compliant URL decoder (including PHP's urldecode()) will convert it to a space, so it can also be treated as equivalent (again, except if it is on the end).

So why is the space at the end important? Read the MySQL documentation:

From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.

Without a whitespace after the -- you don't get a comment. Hence the error.

0

This should be a comment, but its a bit long.

You seem to think that URLs for PHP servers are somehow different from ASP. Apart from the extension on the script (which is only a convention anyway and not a hard wired requirement, even on MSWindows) there is no difference to how the URL is encoded. Until you have an understanding of the protocol, you're not going to have much success in subverting it.

I have written an application for XAMPP in order to test

So you're trying to debug a program and hack it at the same time? You're not making life very easy for yourself. On the other hand, you want us to debug the program without giving us access to the code.

--

/someserver.com/products.xyz?id=12+order+by+1

and

/someserver.com/products.xyz?id=12%20order%20by%201

should be equivalent.

If you put this in your browser:

/someserver.com/products.xyz?id=12 order by 1

it will be converted into one of the 2 forms shown above before it is sent down the wire.

  • Read my last sentence, right before "Thanks in advance!". – russ6100 Jul 6 '16 at 0:37
  • I think my intent was made clear - I was asking for no help with debugging my code, as is evidenced by the conspicuous lack of it. – russ6100 Jul 6 '16 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.