1

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works?

I found this on login form where when I send user=\&pass=||1# as a payload I got successfully admin panel accessed.

This was the challenge. https://hack2learn.pw/mysql/login.php

  • WAIT` #` is an admin in MySQL? I thought it is a comment symbol. And what will be the use of 1 – Utkarsh Agrawal Aug 29 '18 at 7:14
  • 1
    @RobertHarvey || is logical OR 1 (true, match all rows) and then # starts a comment to discard/ignore trailing text from the query including the close quote from the password, preventing a syntax error from the injection. – Michael - sqlbot Aug 29 '18 at 9:49
  • Yup, that makes sense. Michael. – Utkarsh Agrawal Aug 29 '18 at 12:02
4

The query in question probably looks something like this:

SELECT * FROM users WHERE user = '$user' AND pass = '$pass'

The $user and $pass variables are likely sanitized by either removing or escaping " and/or '. That's why a standard attack of ' or '1'='1 or similar is not working.

With your injection, you will get the following query:

SELECT * FROM users WHERE user = '\' AND pass = '||1#'

As you are escaping the ' from the query, user is now compared to ' and pass = (which will likely evaluate to false, as no such user exists). # is a comment which cuts off the rest of the query, so ||1#' evaluates to OR true, which will be true. The authentication code will now likely fetch the first result of that query, or check if anything was returned, and thus authenticate you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.