2

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.

Whenever I try very simple attacks containing SQL commands such as %27%20or%201=1%20 which is ' or 1=1 I get a 403 error page. I also get a 403 message whenever I try using an SQL command such as union, select, -- or /**/. The site is a php site with a MySQL database. Is this some sort of WAF (web application firewall) he has setup? If so do you have any advice on how to defeat it?

Trying a parameter like %0b%271%0bor%20%271%27=%271 returns the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1or '1'='1' and test = '0' and version = '1'' at line 1

4
  • Sounds like it could be a WAF. If you try a non attack request to the same endpoint, do you get something else than 403?
    – Anders
    Oct 24, 2019 at 7:18
  • It seems that at least some "sanitizing" takes place: The 1's from your injection are surrounded by ' (whihc shouldn't bother you) and seemingly your initial ' eats an already preent '. What happens with '1 or 1=1 -- or perhaps '1' or 1=1 -- ? Oct 24, 2019 at 9:45
  • @Anders yes, if I try just a single quote, then I get a webpage with a MySQL error message where the data should be Oct 24, 2019 at 10:42
  • @HagenvonEitzen anything with a space followed by 2 hyphens or anything with /* (the MySQL comment) return a 403 and the ‘1’ returns a MySQL error message Oct 24, 2019 at 15:11

1 Answer 1

2

If the website is returning an SQL syntax error to you, then you definitely have found an SQLi vulnerability. You're not dealing with a WAF (sometimes it can be hard to tell the difference). It also means that, conveniently for you, he has error printing turned on. That makes it much easier to tell what is going on. That's also a vulnerability he should fix.

That being said, onto the SQLi! Getting the payload syntax right can be tricky. However, the error message will help a lot. I'd look at this part:

'1or '1'='1' and test = '0' and version = '1''

Note that MySQL itself wraps single quotes around the part that it says is broken, so if we should remove the outer single quotes we can see what MySQL is actually trying to execute:

1or '1'='1' and test = '0' and version = '1'

Which is mildly confusing because it doesn't match your payload very well ('1 or 1=1). This likely means that he is doing additional translations behind the scenes to try to mitigate SQLi. Unfortunately (for him) his ad-hoc implementation definitely isn't foolproof (since you're producing MySQL errors). Most likely the actual query he is executing is:

WHERE column='?' and test = '0' and version = '1'

With the question mark standing in for the vulnerable parameter. This would normally be very easy to exploit, except that he seems to be doing some strange transformation to your data. In that sense, he may be doing something that is like a WAF in nature, so you'll have to do some playing around to build a successful PoC. I'd try something very different, like a SLEEP based injection:

1' and sleep(10)

Simply by virtue of having a different "form" of the payload, you may evade his "filter". If the server takes ~10 more seconds to return the response, then you know you have a successful payload! From there you can try to build different kinds of payloads for extracting information, etc...

8
  • The 1’ and SLEEP(10) gives me a 403 error, but just the 1’ and gives me the normal page with a MySQL error similar to the one mentioned in the yellow part of my question. Also the page seems to block my ip after 3-4 403 error pages, and the block seems permanent. So maybe it is a WAF Oct 24, 2019 at 23:22
  • @MohammadAli do you get a MySQL syntax error as well, like before? Oct 24, 2019 at 23:23
  • Standby I will copy paste it Oct 24, 2019 at 23:25
  • the 403 error page just has a single line of text on it saying I don’t have access. But only entering the 1’ and gives me the following error Oct 24, 2019 at 23:29
  • @MohammadAli Re-read your comment and understand now. Yes, it sounds like there might also be a WAF, but it isn't necessarily a great one. Moreover, a WAF is rarely a substitute for proper use of prepared queries (which isn't happening). So while the WAF makes this a bit more challenging, it's just a matter of finding the correct payload until you bypass things. Oct 24, 2019 at 23:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .