4

I am doing a black-box test on a website. It has a form and i was testing it with different inputs. When i enter some specific inputs, it returns internal error.

Some inputs that give internal error:

  • ';--'
  • ';---'

Some inputs that doesn't give error:

  • ';--
  • ';-f-'
  • ";--"
  • ;--'

As you can see it's not a normal SQL injection flaw. If it was a normal SQL injection, results for ';-- and ';--' and ';-- ' should not differ.

If you have any insights in the way that this input is tested or the flaw that i am dealing with. Btw I can test more inputs if necessary.

8
  • 4
    This seems a bit like 'do my pentest for me'? Aug 9, 2016 at 10:37
  • 3
    i am doing my pentest. i just needed a simple help. isn't here about this?
    – Moradnejad
    Aug 10, 2016 at 3:17
  • @ananda I would check if there is not a replace to swap ' for " in the code.
    – T. Sar
    Aug 11, 2016 at 11:46
  • @ThalesPereira No, there isn't.
    – Moradnejad
    Aug 11, 2016 at 14:08
  • It sounds like the script expects to receive a closing single-quote, and that there may also be some other string processing. Please try a) a two 2000-character long string of letters, followed by a single quote then semicolon b) ' AND 1=1; Aug 14, 2016 at 23:46

2 Answers 2

3
+50

I tried to explain it in similar lines of SilverlightFox answer using some spaces in sql query construction.

But, with that approach i am unable to explain why ';-f-' and ' AND nonsense=1 didn't produce an Internal error.

So, I guess the Internal error is not actually caused by a DB Sql error.

Its caused by a sanitising function applied on userinput. Php Example using preg-match below.

function inputSanitiser($userinput)
{
$string1=$userinput;
$semicolonExist=preg_match("/';--/",$string1); //search for location(int) of ';-- in $string 1

$string2 =substr ( $string1 , stripos ( $string1 , "';--")+3); //substring from $string1 after the location  ';-- to end of $string1
$commentCloseExist=preg_match("/'/",$string2); //search for location(int) of ' in $string2


    if($commentCloseExist&&$semicolonExist)
    {
        produceInternalError();
    }
    else
    {
        runDbQuery($string1); //runDbQuery will not through Internal error and will silently fail
    }

}

Simply put, the inputSanitiser function is checking for few patterns like

';-- followed by '

and may be ' UNION ' anywhere in the string

and few others.So, I guess ';--somethinghere--' and ';--somethinghere-' should also produce a Internal error.

1
  • 1
    This is a very great answer.';--somethinghere--' did produce the internal error but the second one didn't.
    – Moradnejad
    Aug 18, 2016 at 9:30
3

From the samples given it appears to be a normal SQL injection with a string.

For argument sake, say the query was

select * from users where username='<user data>' ;

It is correct that the first two do cause an error as they produce invalid SQL:

select * from users where username='';--'' ;
select * from users where username='';---'' ;

Because with regards to MySQL comments:

the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)

Try ';-- '

Trailing single quote probably not needed.

The remaining produce either incomplete (i.e. no closing single quote) or valid SQL so don't produce any error:

select * from users where username='';--' ;
select * from users where username='";--"' ;
select * from users where username=';--'' ;

Note that

select * from users where username='';-f-'' ;

should error. I would confirm whether the result of this test case is correct.

2
  • thanks for the response. ';-- ' and ';-f-' doesn't give any error. and by my understanding, shouldn't ';-- and ';--' result similar outputs?
    – Moradnejad
    Aug 10, 2016 at 3:23
  • If it was a normal SQL injection, ';-- should've also produced an error. Aug 11, 2016 at 7:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .