0

A recent employment test prompted me to perform an SQL injection to gain access into their website.

Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable to SQL Injection attacks, but every time I tried to pass any payloads into the E-mail/username field

(eg: admin' or '1'='1)

it kept saying "Invalid email format".

Anyone know how to get around this? (I should mention the Company only allowed me to use manual methods and Burp, no other tools were allowed)

**Note: The website wasn't their main website, it was a web app created for the sole purpose of exploiting vulnerabilities. **

UPDATE: I'm still able to access the domain ( I thought they had taken it down after the test was over), but I won't be able to share the domain address because I'm unsure if it'll even be legal to publicize it. So, I'll add some screenshots of the issues. this is the error and adding @something.com gives me the same output:

this is the error and adding @something.com gives me the same output

This is the intercepted request: enter image description here

This is the error that's returned for certain inputs: enter image description here

and this is the SQL injection vulnerability that Burp identified: enter image description here

Improve this question
12
  • 2
    "I was able to find out the form is definitely vulnerable to SQL Injection attacks" - so you figured out that it is vulnerable but you have no input where it is actually vulnerable? Then how do you can be sure that it is vulnerable?
    – Steffen Ullrich
    Oct 21, 2019 at 14:40
  • Inputting single quotations or other sql based commands returned errors. Also using burp I scanned the login page, it highlighted that a critical vulnerability was that the form was vulnerable to SQLi
    – s h a a n
    Oct 21, 2019 at 14:42
  • 1
    "Inputting single quotations or other sql based commands returned errors" - since when "errors" mean vulnerable? An error might happen because your input was rejected, as in "invalid email format". "it highlighted that a critical vulnerability was that the form" - then why don't you just use the input burp used there?
    – Steffen Ullrich
    Oct 21, 2019 at 14:46
  • @SteffenUllrich I feel I haven't explained myself clearly. The error was the type of error you get which ensures the webpage is vulnerable to SQLi, something along the lines of "You have an error in your SQL syntax", don't remember the whole thing. Also, the entire point of the login form was that it was vulnerable, that's why it was provided as a test. I didn't use Burp's input because Burp just shows an example and doesn't actually fuzz unless I send it to intruder and fuzz, which I did, but because of the invalid email format, it could never get through.
    – s h a a n
    Oct 21, 2019 at 14:49
  • 2
    Agree with @SteffenUllrich It's impossible to both be certain there is an SQLi vulnerability and also not know a valid SQLi payload. I would suggest that you start with whatever payload it is that burp thinks shows a vulnerability. Also, just because burp thinks there is a vulnerability, doesn't mean there is one.
    – Conor Mancone
    Oct 21, 2019 at 14:55

2 Answers 2

Reset to default
3

Since you're confident that the SQL vulnerability exists based on your Burp results, I'm going to assume that you got that error message from your web client.

Either your input has a type attribute set to email, either there's a JavaScript snippet which checks that your input matches an email address format.

The easiest way to bypass both of these checks is:

  • Open the network panel of your browser's development tools.
  • Submit the loin form with a valid email.
  • Search the request in the log, and perform a "Copy as cURL" command.
  • Open a terminal, paste your cURL command
  • Replace the valid email by your injection
  • Run the command!
Improve this answer
5
  • This would also be my guess. But why go through the trouble of using curl and not send the request to the repeater? I find it a lot easier to use when manipulating requests again and again.
    – tim
    Oct 21, 2019 at 15:41
  • @tim Since Burp has already confirmed that the field was vulnerable, I assumed the OP wanted to check Burp's result with another tool.
    – Benoit Esnard
    Oct 21, 2019 at 15:43
  • Hi @BenoitEsnard, thanks for this answer, do you mean copy as URL from Burp? or is it available in the browser dev tools? For eg: let's say I was using firefox, Under network I can see the request I passed but I won't be able to cURL. Also when you mean open a terminal, which terminal are you referring to?
    – s h a a n
    Oct 21, 2019 at 15:53
  • You could also use browser tools to manipulate the DOM of the form, e.g., remove the email attribute from the <input> tag, and happily submit
    – Hagen von Eitzen
    Oct 21, 2019 at 16:11
  • Actually, the type attribute is "text" forgot to mention this, it's not "email". Anyway I've updated my original question with screenshots of the page (turns out the domain was still up), hope it can provide some info that I'm too noob to understand?
    – s h a a n
    Oct 21, 2019 at 16:27
0

It depends on the confidence of the issue reported by burp, when the confidence is certain, a complete payload for you to reproduce it is provided, usually a sleep command.

If the confidence of burp is 'tentative' that usually means the original command and the same command with a ' return different responses, you can manually check what happens when you add a second ' for example:

  • input
  • input'
  • input''

If input'' doesn't return a error message but input' does then probably there is a sql injection there. Burp is really good but usually needs manual testing after to check and verify valid issues.

EDIT: the reason why admin' or '1'='1 and similar weren't working is because that is detected by some time of waf. To actually exploit it you will have to use the payload structure provided by burp suite that isn't blocked and similar payloads to get into the tables, columns, etc.

If you don't want manual testing you can try sqlmap... with a common payload like that it would take less than 15 min to download the whole databases of the website.

Improve this answer
4
  • This doesn't really answer the question of "How do I perform exploitation if my input has to look a certain way?".
    – user163495
    Oct 21, 2019 at 15:24
  • agreed with @MechMK1, thanks for your answer though! I did perform some manual testing after, but my inputs simply returned errors regarding the e-mail format.
    – s h a a n
    Oct 21, 2019 at 15:56
  • Updated my question, hope it provides some input that I'm too noob to understand
    – s h a a n
    Oct 21, 2019 at 16:28
  • oh ok, nice for provinding the screenshot of burp, that's definetely vulnerable, there are plenty of wayts to exploit this, there you have the payload used that isn't blocked by the waf or security for manual explotation, apart from that you ca use sqlmap and you could probably get everything really easily
    – Mr. ToxicMan
    Oct 22, 2019 at 4:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .