0

A recent employment test prompted me to perform an SQL injection to gain access into their website.

Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable to SQL Injection attacks, but every time I tried to pass any payloads into the E-mail/username field

(eg: admin' or '1'='1)

it kept saying "Invalid email format".

Anyone know how to get around this? (I should mention the Company only allowed me to use manual methods and Burp, no other tools were allowed)

**Note: The website wasn't their main website, it was a web app created for the sole purpose of exploiting vulnerabilities. **

UPDATE: I'm still able to access the domain ( I thought they had taken it down after the test was over), but I won't be able to share the domain address because I'm unsure if it'll even be legal to publicize it. So, I'll add some screenshots of the issues. this is the error and adding @something.com gives me the same output:

this is the error and adding @something.com gives me the same output

This is the intercepted request: enter image description here

This is the error that's returned for certain inputs: enter image description here

and this is the SQL injection vulnerability that Burp identified: enter image description here

  • 2
    "I was able to find out the form is definitely vulnerable to SQL Injection attacks" - so you figured out that it is vulnerable but you have no input where it is actually vulnerable? Then how do you can be sure that it is vulnerable? – Steffen Ullrich Oct 21 '19 at 14:40
  • Inputting single quotations or other sql based commands returned errors. Also using burp I scanned the login page, it highlighted that a critical vulnerability was that the form was vulnerable to SQLi – s h a a n Oct 21 '19 at 14:42
  • 1
    "Inputting single quotations or other sql based commands returned errors" - since when "errors" mean vulnerable? An error might happen because your input was rejected, as in "invalid email format". "it highlighted that a critical vulnerability was that the form" - then why don't you just use the input burp used there? – Steffen Ullrich Oct 21 '19 at 14:46
  • @SteffenUllrich I feel I haven't explained myself clearly. The error was the type of error you get which ensures the webpage is vulnerable to SQLi, something along the lines of "You have an error in your SQL syntax", don't remember the whole thing. Also, the entire point of the login form was that it was vulnerable, that's why it was provided as a test. I didn't use Burp's input because Burp just shows an example and doesn't actually fuzz unless I send it to intruder and fuzz, which I did, but because of the invalid email format, it could never get through. – s h a a n Oct 21 '19 at 14:49
  • 2
    Agree with @SteffenUllrich It's impossible to both be certain there is an SQLi vulnerability and also not know a valid SQLi payload. I would suggest that you start with whatever payload it is that burp thinks shows a vulnerability. Also, just because burp thinks there is a vulnerability, doesn't mean there is one. – Conor Mancone Oct 21 '19 at 14:55
3

Since you're confident that the SQL vulnerability exists based on your Burp results, I'm going to assume that you got that error message from your web client.

Either your input has a type attribute set to email, either there's a JavaScript snippet which checks that your input matches an email address format.

The easiest way to bypass both of these checks is:

  • Open the network panel of your browser's development tools.
  • Submit the loin form with a valid email.
  • Search the request in the log, and perform a "Copy as cURL" command.
  • Open a terminal, paste your cURL command
  • Replace the valid email by your injection
  • Run the command!
  • This would also be my guess. But why go through the trouble of using curl and not send the request to the repeater? I find it a lot easier to use when manipulating requests again and again. – tim Oct 21 '19 at 15:41
  • @tim Since Burp has already confirmed that the field was vulnerable, I assumed the OP wanted to check Burp's result with another tool. – Benoit Esnard Oct 21 '19 at 15:43
  • Hi @BenoitEsnard, thanks for this answer, do you mean copy as URL from Burp? or is it available in the browser dev tools? For eg: let's say I was using firefox, Under network I can see the request I passed but I won't be able to cURL. Also when you mean open a terminal, which terminal are you referring to? – s h a a n Oct 21 '19 at 15:53
  • You could also use browser tools to manipulate the DOM of the form, e.g., remove the email attribute from the <input> tag, and happily submit – Hagen von Eitzen Oct 21 '19 at 16:11
  • Actually, the type attribute is "text" forgot to mention this, it's not "email". Anyway I've updated my original question with screenshots of the page (turns out the domain was still up), hope it can provide some info that I'm too noob to understand? – s h a a n Oct 21 '19 at 16:27
0

It depends on the confidence of the issue reported by burp, when the confidence is certain, a complete payload for you to reproduce it is provided, usually a sleep command.

If the confidence of burp is 'tentative' that usually means the original command and the same command with a ' return different responses, you can manually check what happens when you add a second ' for example:

  • input
  • input'
  • input''

If input'' doesn't return a error message but input' does then probably there is a sql injection there. Burp is really good but usually needs manual testing after to check and verify valid issues.

EDIT: the reason why admin' or '1'='1 and similar weren't working is because that is detected by some time of waf. To actually exploit it you will have to use the payload structure provided by burp suite that isn't blocked and similar payloads to get into the tables, columns, etc.

If you don't want manual testing you can try sqlmap... with a common payload like that it would take less than 15 min to download the whole databases of the website.

  • This doesn't really answer the question of "How do I perform exploitation if my input has to look a certain way?". – MechMK1 Oct 21 '19 at 15:24
  • agreed with @MechMK1, thanks for your answer though! I did perform some manual testing after, but my inputs simply returned errors regarding the e-mail format. – s h a a n Oct 21 '19 at 15:56
  • Updated my question, hope it provides some input that I'm too noob to understand – s h a a n Oct 21 '19 at 16:28
  • oh ok, nice for provinding the screenshot of burp, that's definetely vulnerable, there are plenty of wayts to exploit this, there you have the payload used that isn't blocked by the waf or security for manual explotation, apart from that you ca use sqlmap and you could probably get everything really easily – Mr. ToxicMan Oct 22 '19 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.