0

There is a website I am assessing for security breaches. It has Joomla 1.5.x with MySQL 5.5.24 and PHP 5.3.2.

I am doing a penetration test, that exploits SQL injection. The thing is that WAF filters many injections. that have table name prefix: ...UNION SELECT * FROM **prefix__**tablename?

Worked:

.../*!UNION*/ SELECT * FROM information_schema.columns

Didn't work or was filtered:

...UNION SELECT...`
.../*!UNION*/ UNION SELECT * FROM prefix_tablename`
.../*!UNION*/ UNION SELECT * FROM prefi/**/x_tablename`
  • Can you access the INFORMATION_SCHEMA? – Matthew Jan 15 at 13:57
  • @Matthew, yes, I can get the list of table names and table columns. But I cannot access themselves, because firewall filters all requests with them. – soshial Jan 15 at 14:10
  • What exactly does the WAF filter? Just the prefix__ part? The full UNION SELECT... query fragment? – Anders Jan 15 at 14:14
  • @Anders, WAF filters also UNION, but I was able to mitigate it with /*!UNION*/ expression. What I cannot bypass is whenever I execute a SELECT FROM that mentions any table that starts with Joomla DB prefix (e.g. jos_), it returns 403: Access Forbidden and Attempted SQL injection in REQUEST_URI – soshial Jan 15 at 14:24
  • Do you have access to the firewall rules? If so, post them. If not, post a list of things that does pass and things that doesn't pass. Having that will make it much more easier to guess what is going on. – Anders Jan 15 at 15:11
1

TL;DR, no.

If the WAF is configured correctly and doing its job, you have no way of injecting that info. Javascript allows variation of "script" for XSS etc onclick=alert(XSS pwn'd!) instead of <script>alert(pwn'd!)</script> etc), but SQL does not. SQL injections are, by and large, very fickle and require very precise queries with very precise order. If the WAF is blocking union or select, you're probably dead in the water. You might be able to find a fancy way around it, but unless the client is paying big bucks and you're ready to spend a week on it, it's probably best to move on to another vulnerability.

It's unfortunate - I've done many penetration tests where compensating controls are used in place of secure coding. However, frustrations and bad practice aside, it is what it is.

PLEASE NOTE this doesn't mean joomla, PHP and whatever else doesn't have other vulnerabilities that can be exploited. Exploit-db.com is your friend here. Joomla 1.5 has 86 results in exploit-db.com, and PHP 5 has undoubtedly hundreds if not thousands. Please remember: penetration testing and vulnerability scanning is all about ENUMERATION!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.