0

I am testing a website and I found an endpoint that accepts an e-mail address and returns a HTTP 200 response if that e-mail is registered, or 401 if that e-mail is not registered. But I also noticed that it is possible to use wildcards like * or ? in the email parameter. For example if I type myregisteredemail@*.com, I will get a HTTP 200 response, but if I type nonexistingemail@*.com, I will get a 401 response. The wildcards can be used anywhere in the email.

I know that this behavior could easily be used for e-mail enumeration, but I'm trying to figure out if there is maybe any other injection that would be more critical.

I have tested lots of SQLi payloads, but without success, and as far as I know, all SQL product use % as wildcard character and not * (% does not work in this example as wildcard). Is anybody aware of a SQL or noSQL product that uses * as wildcard character?

  • 2
    Are you sure it's a SQL/NoSQL database? What if it's LDAP for instance? * is indeed a wildcard character in LDAP. – Gabor Lengyel Nov 4 '16 at 17:46
  • No, I don't now what kind of database it is. I will try also some LDAP payloads. Thanks! – stanko Nov 4 '16 at 17:47
4

If * appears to be a wildcard, it could be LDAP, probably a query to Windows ActiveDirectory.

The good thing in AD is that the LDAP structure is known, so you can get an idea how to bypass authentication. This for example is a reference for the attributes of a user in AD. It could of course be a custom LDAP structure too.

OWASP has a few ideas for LDAP injection.

1

No, both those SQL databases do not.

The asterisk is used in statements to select all columns opposed to specifying particular columns.

It's usage is: SELECT * FROM Accounts WHERE Email = 'user@domain.com'

This would return the full table row(s) where the Email column is equal to user@domain.com.

The closest to wildcards would be when using the LIKE operator. But the symbols used are the percentage sign and underscore.

It's usage is: SELECT * FROM Accounts WHERE Email LIKE 'user@%.com'

This would return the full table rows where the Email column begins with user@ and ends with .com. If using the underscore it will search for only one wildcard character instead of all possible wildcards. These can also accept regular expressions as well to target specific wildcard information.

Microsoft Access and Bash among others on the other hand uses the wildcards you are referring to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.