-4

I am a student in computer security and I'm training for a certification.

I have this URL that I want to attack (in a training lab):

http://URL/search/blabla/1

I replaced "1" with letters, as the following:

http://URL/search/blabla/aaa

Which creates this Error Message (I removed some parts to make it clearer):

Fatal error: .... in query — SELECT * FROM Books WHERE 1 AND (LOWER(title) LIKE '%blabla%' OR LOWER(blurb) LIKE '%blabla%') AND (publish_date IS NULL OR publish_date <= '2016-08-23') ORDER BY date DESC LIMIT -5,5'

So, first tried to get out of the quote with %'), add a new request and cancel with #:

%'); SELECT * FROM Books;#

=>Bad Request, Your browser sent a request that this server could not understand.

Second try, this time I copy the rest of the request given in the error message and cancel it with a #:

%') AND (publish_date IS NULL OR publish_date <= '2016-08-23') ORDER BY date DESC LIMIT -5,5'#

=> Bad Request again !

Do you think a SQL injection is possible here?

8
  • 1
    Looks susceptible to injection, because the bad request error indicate that the site didn't sanitize the input by parameterised query. Just remind you, there is two %blabla% that you need to take care.
    – mootmoot
    Aug 23, 2016 at 15:21
  • @mootmoot I see, but they both come from the same Injection point so I don't think the second %blabla% is really relevant
    – mric750
    Aug 23, 2016 at 15:30
  • You've actually done what is required - in a sense - as you've injected your own query (part of) into the application. Even if you're getting an error, you've injected foreign query language that isn't allowed. What are you trying to achieve exactly? ie: bring back other records, dump the database to an OUTFILE, or cripple the database, or what....?
    – hd.
    Aug 23, 2016 at 15:44
  • 1
    How is this question different from the other one you just posted?
    – Anders
    Aug 24, 2016 at 7:13
  • 1
    Why are you using query stacking for your injection? Most database connection handlers will only let you run one query at a time.
    – rook
    Aug 24, 2016 at 7:31

1 Answer 1

2

The bad request does not indicate anything about the application. Instead, it indicates that Apache could not parse the request before passing it to the web application. Consider for example the following link, which gives the same error:

http://www.apache.org/icons/%');%20SELECT%20*%20FROM%20Books;#

Bad request

This is because percent-sign has a special meaning in an URL. If you pass parameters in the URL, you should url-encode them:

%25%27)%3B%2520SELECT%2520*%2520FROM%2520Books%3B%23

One thing I notice is that although you get an SQL error, the injected value "aaa" is not present in the SQL query shown. This makes it hard to say whether this is vulnerable to SQL injection.

One tool that can help you with this is sqlmap. It is pretty good in automatically finding SQL injection on a given parameter.

2
  • "aaa" is present in the part of the error message that I did not put in my POST (here: sqlfetch(false) #1 /var/www/html/templates/routed/btx-dogwood-blog/search.php(12): BTXDogwood->getSearchPageOfPosts('"', 'aaa', 5))
    – mric750
    Aug 24, 2016 at 10:48
  • But it's not relevant because it's not present in the SQL query
    – mric750
    Aug 24, 2016 at 10:49

Not the answer you're looking for? Browse other questions tagged .