4

I am doing a black-box test on a website. It has a form and i was testing it with different inputs. When i enter some specific inputs, it returns internal error.

Some inputs that give internal error:

  • ';--'
  • ';---'

Some inputs that doesn't give error:

  • ';--
  • ';-f-'
  • ";--"
  • ;--'

As you can see it's not a normal SQL injection flaw. If it was a normal SQL injection, results for ';-- and ';--' and ';-- ' should not differ.

If you have any insights in the way that this input is tested or the flaw that i am dealing with. Btw I can test more inputs if necessary.

  • 4
    This seems a bit like 'do my pentest for me'? – Owen C. Jones Aug 9 '16 at 10:37
  • 3
    i am doing my pentest. i just needed a simple help. isn't here about this? – Moradnejad Aug 10 '16 at 3:17
  • @ananda I would check if there is not a replace to swap ' for " in the code. – T. Sar Aug 11 '16 at 11:46
  • @ThalesPereira No, there isn't. – Moradnejad Aug 11 '16 at 14:08
  • It sounds like the script expects to receive a closing single-quote, and that there may also be some other string processing. Please try a) a two 2000-character long string of letters, followed by a single quote then semicolon b) ' AND 1=1; – Jonah Benton Aug 14 '16 at 23:46
3
+50

I tried to explain it in similar lines of SilverlightFox answer using some spaces in sql query construction.

But, with that approach i am unable to explain why ';-f-' and ' AND nonsense=1 didn't produce an Internal error.

So, I guess the Internal error is not actually caused by a DB Sql error.

Its caused by a sanitising function applied on userinput. Php Example using preg-match below.

function inputSanitiser($userinput)
{
$string1=$userinput;
$semicolonExist=preg_match("/';--/",$string1); //search for location(int) of ';-- in $string 1

$string2 =substr ( $string1 , stripos ( $string1 , "';--")+3); //substring from $string1 after the location  ';-- to end of $string1
$commentCloseExist=preg_match("/'/",$string2); //search for location(int) of ' in $string2


    if($commentCloseExist&&$semicolonExist)
    {
        produceInternalError();
    }
    else
    {
        runDbQuery($string1); //runDbQuery will not through Internal error and will silently fail
    }

}

Simply put, the inputSanitiser function is checking for few patterns like

';-- followed by '

and may be ' UNION ' anywhere in the string

and few others.So, I guess ';--somethinghere--' and ';--somethinghere-' should also produce a Internal error.

  • 1
    This is a very great answer.';--somethinghere--' did produce the internal error but the second one didn't. – Moradnejad Aug 18 '16 at 9:30
3

From the samples given it appears to be a normal SQL injection with a string.

For argument sake, say the query was

select * from users where username='<user data>' ;

It is correct that the first two do cause an error as they produce invalid SQL:

select * from users where username='';--'' ;
select * from users where username='';---'' ;

Because with regards to MySQL comments:

the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)

Try ';-- '

Trailing single quote probably not needed.

The remaining produce either incomplete (i.e. no closing single quote) or valid SQL so don't produce any error:

select * from users where username='';--' ;
select * from users where username='";--"' ;
select * from users where username=';--'' ;

Note that

select * from users where username='';-f-'' ;

should error. I would confirm whether the result of this test case is correct.

  • thanks for the response. ';-- ' and ';-f-' doesn't give any error. and by my understanding, shouldn't ';-- and ';--' result similar outputs? – Moradnejad Aug 10 '16 at 3:23
  • If it was a normal SQL injection, ';-- should've also produced an error. – Neda Sharifi Aug 11 '16 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.