Server returns 403 when I try SQL injection

Question

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.

Whenever I try very simple attacks containing SQL commands such as %27%20or%201=1%20 which is ' or 1=1 I get a 403 error page. I also get a 403 message whenever I try using an SQL command such as union, select, -- or /**/. The site is a php site with a MySQL database. Is this some sort of WAF (web application firewall) he has setup? If so do you have any advice on how to defeat it?

Trying a parameter like %0b%271%0bor%20%271%27=%271 returns the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1or '1'='1' and test = '0' and version = '1'' at line 1

Answer 1

If the website is returning an SQL syntax error to you, then you definitely have found an SQLi vulnerability. You're not dealing with a WAF (sometimes it can be hard to tell the difference). It also means that, conveniently for you, he has error printing turned on. That makes it much easier to tell what is going on. That's also a vulnerability he should fix.

That being said, onto the SQLi! Getting the payload syntax right can be tricky. However, the error message will help a lot. I'd look at this part:

'1or '1'='1' and test = '0' and version = '1''

Note that MySQL itself wraps single quotes around the part that it says is broken, so if we should remove the outer single quotes we can see what MySQL is actually trying to execute:

1or '1'='1' and test = '0' and version = '1'

Which is mildly confusing because it doesn't match your payload very well ('1 or 1=1). This likely means that he is doing additional translations behind the scenes to try to mitigate SQLi. Unfortunately (for him) his ad-hoc implementation definitely isn't foolproof (since you're producing MySQL errors). Most likely the actual query he is executing is:

WHERE column='?' and test = '0' and version = '1'

With the question mark standing in for the vulnerable parameter. This would normally be very easy to exploit, except that he seems to be doing some strange transformation to your data. In that sense, he may be doing something that is like a WAF in nature, so you'll have to do some playing around to build a successful PoC. I'd try something very different, like a SLEEP based injection:

1' and sleep(10)

Simply by virtue of having a different "form" of the payload, you may evade his "filter". If the server takes ~10 more seconds to return the response, then you know you have a successful payload! From there you can try to build different kinds of payloads for extracting information, etc...