-4

I am a student in computer security and I'm training for a certification.

I have this URL that I want to attack (in a training lab):

http://URL/search/blabla/1

I replaced "1" with letters, as the following:

http://URL/search/blabla/aaa

Which creates this Error Message (I removed some parts to make it clearer):

Fatal error: .... in query — SELECT * FROM Books WHERE 1 AND (LOWER(title) LIKE '%blabla%' OR LOWER(blurb) LIKE '%blabla%') AND (publish_date IS NULL OR publish_date <= '2016-08-23') ORDER BY date DESC LIMIT -5,5'

So, first tried to get out of the quote with %'), add a new request and cancel with #:

%'); SELECT * FROM Books;#

=>Bad Request, Your browser sent a request that this server could not understand.

Second try, this time I copy the rest of the request given in the error message and cancel it with a #:

%') AND (publish_date IS NULL OR publish_date <= '2016-08-23') ORDER BY date DESC LIMIT -5,5'#

=> Bad Request again !

Do you think a SQL injection is possible here?

closed as off-topic by SilverlightFox, Xander, rook, Rory Alsop Aug 24 '16 at 18:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – SilverlightFox, Xander, rook, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Looks susceptible to injection, because the bad request error indicate that the site didn't sanitize the input by parameterised query. Just remind you, there is two %blabla% that you need to take care. – mootmoot Aug 23 '16 at 15:21
  • @mootmoot I see, but they both come from the same Injection point so I don't think the second %blabla% is really relevant – mric750 Aug 23 '16 at 15:30
  • You've actually done what is required - in a sense - as you've injected your own query (part of) into the application. Even if you're getting an error, you've injected foreign query language that isn't allowed. What are you trying to achieve exactly? ie: bring back other records, dump the database to an OUTFILE, or cripple the database, or what....? – hd. Aug 23 '16 at 15:44
  • 1
    How is this question different from the other one you just posted? – Anders Aug 24 '16 at 7:13
  • 1
    Why are you using query stacking for your injection? Most database connection handlers will only let you run one query at a time. – rook Aug 24 '16 at 7:31
1

The bad request does not indicate anything about the application. Instead, it indicates that Apache could not parse the request before passing it to the web application. Consider for example the following link, which gives the same error:

http://www.apache.org/icons/%');%20SELECT%20*%20FROM%20Books;#

Bad request

This is because percent-sign has a special meaning in an URL. If you pass parameters in the URL, you should url-encode them:

%25%27)%3B%2520SELECT%2520*%2520FROM%2520Books%3B%23

One thing I notice is that although you get an SQL error, the injected value "aaa" is not present in the SQL query shown. This makes it hard to say whether this is vulnerable to SQL injection.

One tool that can help you with this is sqlmap. It is pretty good in automatically finding SQL injection on a given parameter.

  • "aaa" is present in the part of the error message that I did not put in my POST (here: sqlfetch(false) #1 /var/www/html/templates/routed/btx-dogwood-blog/search.php(12): BTXDogwood->getSearchPageOfPosts('"', 'aaa', 5)) – mric750 Aug 24 '16 at 10:48
  • But it's not relevant because it's not present in the SQL query – mric750 Aug 24 '16 at 10:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.