Recently discover someone doing the following seacrch queries on my website!

1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465--    2620    3
6212    1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465,0x6461726b35636f6465-    2620    5
6213    1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465,0x6461726b35636f6465,    2620    29
6208    1 AND 1=2 UNION SELECT 0x6461726b31636f6465--   1819    1
6209    1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465--  1819    1
6210    1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465--

Update: These are search queries, running these on my site do not show any output in my catalog resembling below actual SQL result. When running this same query in my database I get the followin return. Does this mean it worked?

6461726b31636f6465     6461726b32636f6465     6461726b33636f6465         
     6461726b34636f6465     6461726b35636f6465

I'm running Magento 1.9.2

Should I be worried?

Update: I read on a simillar thread that if the result of the SQL query is reflected in the response html page somewhere then the attacker can see that his injection is being reflected.

This is not the case. However results might be omited.

  • 1
    It looks like they have gone to a reasonable effort to execute this attack, masking their injection terms so as to bypass your filtering. It does, on the face of it look successful, though without detailed analysis, it's hard to say. Can you see any data in any tables that shouldn't be there? – iainpb Apr 12 '17 at 15:39
  • My server clerk told me not to be worried. This is an unsuccessful attempt into injecting using the site's search function. However. How can I know weither their attempts were really unssuccesful? – John Doe Apr 12 '17 at 15:44
  • 1
    I don't really feel i'm in a position to advise you, if your server admin has told you no data has been inserted and you trust their competence then they were unsuccessful. Because no data is inserted doesn't mean you are not at risk, they can also extract data by reflecting it into the page. You could see what happens if you attempt your own sql injection attempts trough the front end or use a tool like SQL Map !!Obtain permission before you do this!! – iainpb Apr 12 '17 at 16:18

Yes, this is an SQL injection attack but I noticed something.

In hexadecimal text:

6461726b31636f6465=dark1code, 6461726b32636f6465=dark2code, and so on.

I have also noticed the number 6461726b32636f6465 and 2121121121212.1 used together as 0x6461726b31636f6465--2121121121212.1 which is dark1code!!!!.

If you search for 0x6461726b31636f6465--2121121121212.1 you get many SQL injection attempts on other websites. I don't know what this is but it seems pretty weird. Maybe it's a software for SQLi that a bunch of script kiddies are using.

See Someone searching "0x6461726b33636f6465" - what kind of exploit is this?


The attacker does indeed appear to testing for sql injection vulnerabilities, specifically blind sql injection (https://www.owasp.org/index.php/Blind_SQL_Injection) vulnerabilities. He/she is attempting to see if the search functionality will allow him/her to read additional data out of the database. He/she does not appear to be attempting to write any data.

The attacker does not need to see an error message to determine if your application is vulnerable to sql injection. In your instance, he or she could also just be looking for the presence/lack of a generic error message being shown in your web application. If your application were vulnerable to SQL injection, the union statements would error out if the number of columns in the union statement does not match the number of columns in the table itself. Presumably, this will show some sort of error result on your website. The attacker will keep trying different numbers of columns to see if the error message goes away. If the error message goes away once the correct number of columns is used in the SQL statement, the attacker knows that your application is vulnerable to SQL injection, and the attacker will likely try to use that vulnerability to retrieve sensitive data, such as credit card information, username/password information, etc.

Does your application keep any logs of the queries that are executed against the database (versus just the logs of what the user typed into the search box)? If the queries that are being run against the database are properly escaped, then you do not appear to have anything to worry about.

  • Thank you so much for the explanation.Trying to replicate what he/she did results in a blank page. No output given. I believe the query is properly escaped. There is no log of database search queries only search queries. – John Doe Apr 13 '17 at 10:39
  • The way the query is written (AND 1=2), you will never get any results even if the injection does not error out. The best way to confirm this is to look at the logs. If logs are not available, try changing "AND 1=2" to "AND 1<2" and see if that returns any results. – user52472 Apr 17 '17 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.