1

I would like to learn to identify if a website is or may be vulnerable to SQL injection (SQLi), without using any tool such as sqlmap. I have read something about it, but I would like somebody to confirm or correct me the assumptions I have made.

Method 1

Does it mean that when inserting a (') at the end of a numerical get parameter in a URL (Ex: /agenda_dat.php?ID=10'), if the webpage shows a DBerror message or a white page, the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

Method 2

Does it mean that when doing the following

/agenda_dat.php?ID=10  (Original URL -> returns original page)
/agenda_dat.php?ID=12-2  (Returns the same page as the original one) 

the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

  • "without using any tool such as sqlmap" That's refreshing. It's much easier to answer SQLi questions if the asker knows basic discovery techniques. – Bryan Field Jul 25 '16 at 19:30
0

Method 1: Does it mean that when inserting a (') at the end of a numerical get parameter in a URL (Ex: /agenda_dat.php?ID=10'), if the webpage shows a DBerror message or a white page, the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

A white page may indicate a precondition (protection against SQLi) has kicked in, or it could indicate a thrown error.

If there is an SQL syntax error, then you have definitely found an SQLi vulnerability.

For example, the SQL involved may look like one of these, which are both exploitable.

select * from agenda where id=$id;
select * from agenda where id='$id';

Method 2: Does it mean that when doing the following

/agenda_dat.php?ID=10  (Original URL -> returns original page)
/agenda_dat.php?ID=12-2  (Returns the same page as the original one) 

the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

If arithmetic is evaluated then you are almost definitely looking at an SQLi vulnerability.

select * from agenda where id=$id;

It should have been written like so, with the proper ? value passed as as separate parameter. This would never produce an SQL syntax error.

select * from agenda where id=?;

If you discover an SQLi vulnerability, The next question of course will be what can be achieved with an exploit. Sometimes you can terminate a statement, and add a new statement to the end.

0; delete from db; -- input data
select * from agenda where id=0; delete from db; -- resulting sql

Such a multi-statement exploit can transfer sensitive data to a publicly accessible space, or alter and remove critical data bringing the operation to a halt.

On systems where multiple statements (; separated) are blocked, an SQLi on a select statement does not allow you to change data directly.

However, using incremental brute force you can determine what data is in the database, eventually stealing sensitive information, perhaps even higher login credentials. Also an SQLi that is not useful can be a clue that SQLi may exist elsewhere in the application.

2

1) If anything on the page chances, there is likely something wrong, and probably SQLi. However, if it's a Database-error, you have a big chance of it being SQLi-vulnerable. A white page on the other hand ain't necessary a guarantee it's vulnerable. Maybe the 'news article' or whatever wasn't found and the website just returns a blank page.

Also, needed to mention that there is a difference between a Database-error and a WAF-error, HTTP-error,... The latter two don't necessarily mean a SQLi-vulnerability though.

2) Yes, also this shouldn't be accepted by the server-side code. And you can be pretty sure a SQLi-vulnerability is going on.

  • 2
    I am not sure about the second one. Can't it be a programming error? I don't know how php scripts are written but could it be (since it's a scripting language) that the equation "12-2" gets solved before being passed to the sql query. What i mean to say is that if you pass $(12-2), could the engine first solve it and then pass it? – Limit Jul 25 '16 at 12:57
  • 1
    @Limit that's what I thought as well. But when you test it on some legit websites it doesn't turn out that way. – O'Niel Jul 25 '16 at 13:39
  • @ONiel I see! I still am not fully convinced but if you're aware of it then cool! – Limit Jul 25 '16 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.