0

I just found in logs that someone try to exectue this SQL injection

/commands.php?id=-1+union+select+0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a,0x6c6f67696e70776e7a

anybody know what he/she wated to do? Is it valid? Anybody know how to decode those hex strings?

Improve this question

3 Answers 3

Reset to default
2

With so less information, it's hard to say if it worked and what it did.

You can try to execute this command and see what it does. It is harmless : The hex part is just 0x6c6f67696e70776e7a, repeated 10 times and it translate to ?loginpwnz

Improve this answer
4
  • I don't have vulnerable script, I don't even have commands.php file, so I will need to create it to test it. But if it's just loginpwnz text then It look like it will not work, since to test number of columns in Select you want to test with Union select you need to put contants (like numbers).
    – jcubic
    Commented Jul 11, 2012 at 8:53
  • That's not correct. You can put whatever you want in an union when testing the number of columns, as long as it isn't filtered.
    – Zzz
    Commented Jul 11, 2012 at 9:00
  • What is not correct?
    – Cyril N.
    Commented Jul 11, 2012 at 10:05
  • Sorry I was replying to @jcubic, there's nothing wrong with your answer.
    – Zzz
    Commented Jul 11, 2012 at 15:56
6

It's trying to see if that page is vulnerable to sql injection. It uses id=-1 to make the original query return no results so the union is executed (since usually only the first record is fetched). If the union is executed, the attacker will find 'loginpwnz' in the returned page (the hex is to avoid using quotes, which might be escaped).

Since the union select must return the same exact number of columns, the attacker is probably trying from 1 to n columns.

Improve this answer
3
  • So that hex is interpreted as string?
    – jcubic
    Commented Jul 11, 2012 at 10:32
  • I think you pretty much covered it all with this answer. Very good and explanatory answer!
    – Chris Dale
    Commented Jul 11, 2012 at 13:46
  • 1
    @jcubic, yes mysql can interpret hex literals as strings see Hexadecimal Literals
    – Zzz
    Commented Jul 11, 2012 at 15:55
3

Well, a few minutes of googling give pretty interesting results ;> Someone was scanning your website. To scan it, this: tool had been used.

I recommend you to use this tool again and check if the attacker found any flaw in your web application.

Improve this answer
1
  • Thanks, I try to search for that in google, but didn't search hard enough. And I don't use any query string, I have htaccess rule that return 403 for those.v And it is not actually and php just simple php script without any input from outside.
    – jcubic
    Commented Jul 11, 2012 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .