2

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the user. I am attempting to load a sql injection with the following paramaters.

"INSERT INTO Uploads VALUES ('Name'); DROP TABLE Upload --"

This execution is being commmitted in ASP.net EF 6. My question is, when using this type of injection, it simply throws an error about incorrect syntax. Can someone tell me if this injection is formatted incorrectly to penetrate, or if this is an actual security measure of SQL server 2012?

Update: the actual error I am receiving is cmd.ExecuteNonQuery(); incorrect Syntax near ('Name')

Improve this question
3
  • The syntax seems fine, all I can see is the table name, Upload vs Uploads, double check on what the backend is doing, debug some and give some more info. And here's a tip: Before learning on how to pentest it is necessary first to learn query/programming/markup languages, networks, subneting, VPN, encryption, OSI model, Operating systems, FIleSystems, How memory works, TCP/IP, common ports, etc, etc, etc. Please consider getting a career in the area and some experience in the field.
    – Azteca
    Commented Jan 23, 2017 at 16:46
  • 1
    Deleting data is not a recommend approach to proving vulnerabilities exist. You could use an insert statement, select, exec or update over delete and not break the app or cause data loss.
    – wireghoul
    Commented Jan 23, 2017 at 19:36
  • @wireghoul Thank you for your response, that is a great point. I was doing this on a local machine test, and using an empty table to see if it could be done, but you make a good point, and I will keep that in mind.
    – Joshua
    Commented Jan 23, 2017 at 19:49

1 Answer 1

Reset to default
3

Without seeing the code it's impossible to say for sure what is going on. Based on my own experience I suspect the following is what is happening.

Lets say you have a vulnerable piece of code that defines a query to be executed in the db like follows:

string commandText = "SELECT id from users where name = '" + tb_Name.text + "';

If you then pass in your attack string, commandText will become:

SELECT id from users where name = 'INSERT INTO Uploads VALUES ('Name'); DROP TABLE Upload --'

If you look closely at this sql string you can see that the first string it interperpates is INSERT INTO Uploads VALUES ( it then encounters Name which is not a string which is most likely why you are seeing the error you see.

If you instead change your attack string to:

'; DROP TABLE Upload;--

The commandText (in this specific example) would become:

SELECT id from users where name = ''; DROP TABLE Upload;--'

Which would be a valid attack baring permissions being set correctly.

Anyway - hope this helps clarify things. The best way to become more familiar with this stuff is to spend a few years doing full stack web development. You can jump in midstream, but you will lack the depth of knowledge that is often required to be a good pen tester.

Improve this answer
1
  • Thank you very much for the response. I am a junior full stack developer, and this is my first shot at pen-testing. I appreciate your help very much. I will take that into consideration.
    – Joshua
    Commented Jan 23, 2017 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .