2

I have been trying to find SQL injection against a site in bug bounty. I tried a few parameters via SQLmap. One such query was shown to be injectible.

Parameter: query (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: query=-8014' OR 6594=6594-- iygp&locale=en-US

The WAF used by the website is KONA (akamai). Sqlmap could not retrieve any data.

NOTE: whenever I inject it, it gives back a 403 error generated by the WAF.

HTTP/1.1 403 Forbidden
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 294
Expires: Thu, 17 Jan 2019 12:04:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 17 Jan 2019 12:04:34 GMT
Connection: close
Cipher: ECDHE-RSA-AES256-GCM-SHA384
Source-Country: IN
Strict-Transport-Security: max-age=157680000; preload

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
 
You don't have permission to access "http&#58...;;" on this server.<P>
Reference&#32;&#35;18&#46;e0a21ab8&#46;1547726674&#46;14c0c2e8
</BODY>
</HTML>

So my questions are:

  1. Is it a false positive?

  2. If it isn't, should I not automate it and try and probe manually?

Improve this question

2 Answers 2

Reset to default
1

There is a potential for automated tools to provide false positives in case of blind SQL injection even if there is a slight difference in responses. This may also be the case where WAF's are involved.

I would normally consider that anyone putting their site up for a bug bounty program have done their homework and secured their site reasonably to make it resilient to automated tools. If you get even a slight indication that the site may be vulnerable through automated tools, this must be followed by manual investigation to see if the site is actually vulnerable and what will be the impact if the vulnerability can be exploited.

The following SQLi resources may be useful for further manual investigation: http://pentestmonkey.net/category/cheat-sheet/sql-injection
https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/

Also, be wary of extracting data from the database once you know the SQL injection is exploitable and may result in data extraction. If the website stored sensitive information, the site owner might not want you to exploit the vulnerability to extract any potentially sensitive data. Always good to review the terms & conditions of the Bug Bounty program before hand.

Improve this answer
0
0

Is the above query returned by SQLMap detected by the WAF and returns 403? if that is the case then its most likely a false positive. Such queries tend to be blocked by most WAFs but i have not played with the one you mention so I am not sure how it behaves

However for bug bounty program to accept the issue, you can either demonstrate that a time-delay can be caused, or that you can extract some simple data as the DB version. As Vishal mentioned above, better avoid dumping all the database content cause then you might end up with the program having to investigate and compain.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .