2

Recently spotted someone searching:

1 and 1 2 union select 0x6461726b31636f6465--

And a bunch of variations. What type of exploit is this and what does it attempt to do? I don't believe I'm at any particular risk, but it would be helpful to understand what the goal of the attacker is here so I can be sure since I've never seen this before.

Also, it's worth noting that searching "0x6461726b31636f6465" on google yields a ton of results. Why would google be crawling and indexing a search term that clearly appears to be a vulnerability exploit of some sort?

  • Seems like an SQL injection. Just converted 6461726b31636f6465 to ASCII, and it reads dark1code, not sure what exactly it means, though. – pri Feb 23 '17 at 6:24
7

It's an SQL injection and the "dark1code" is just a column value that the attacker intends to include into the result set. if the result of the SQL query is reflected in the response html page somewhere then the attacker can see that his injection is being reflected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.