I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.

Whenever I try very simple attacks containing SQL commands such as %27%20or%201=1%20 which is ' or 1=1 I get a 403 error page. I also get a 403 message whenever I try using an SQL command such as union, select, -- or /**/. The site is a php site with a MySQL database. Is this some sort of WAF (web application firewall) he has setup? If so do you have any advice on how to defeat it?

Trying a parameter like %0b%271%0bor%20%271%27=%271 returns the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1or '1'='1' and test = '0' and version = '1'' at line 1

  • Sounds like it could be a WAF. If you try a non attack request to the same endpoint, do you get something else than 403? – Anders Oct 24 '19 at 7:18
  • It seems that at least some "sanitizing" takes place: The 1's from your injection are surrounded by ' (whihc shouldn't bother you) and seemingly your initial ' eats an already preent '. What happens with '1 or 1=1 -- or perhaps '1' or 1=1 -- ? – Hagen von Eitzen Oct 24 '19 at 9:45
  • @Anders yes, if I try just a single quote, then I get a webpage with a MySQL error message where the data should be – Mohammad Ali Oct 24 '19 at 10:42
  • @HagenvonEitzen anything with a space followed by 2 hyphens or anything with /* (the MySQL comment) return a 403 and the ‘1’ returns a MySQL error message – Mohammad Ali Oct 24 '19 at 15:11

If the website is returning an SQL syntax error to you, then you definitely have found an SQLi vulnerability. You're not dealing with a WAF (sometimes it can be hard to tell the difference). It also means that, conveniently for you, he has error printing turned on. That makes it much easier to tell what is going on. That's also a vulnerability he should fix.

That being said, onto the SQLi! Getting the payload syntax right can be tricky. However, the error message will help a lot. I'd look at this part:

'1or '1'='1' and test = '0' and version = '1''

Note that MySQL itself wraps single quotes around the part that it says is broken, so if we should remove the outer single quotes we can see what MySQL is actually trying to execute:

1or '1'='1' and test = '0' and version = '1'

Which is mildly confusing because it doesn't match your payload very well ('1 or 1=1). This likely means that he is doing additional translations behind the scenes to try to mitigate SQLi. Unfortunately (for him) his ad-hoc implementation definitely isn't foolproof (since you're producing MySQL errors). Most likely the actual query he is executing is:

WHERE column='?' and test = '0' and version = '1'

With the question mark standing in for the vulnerable parameter. This would normally be very easy to exploit, except that he seems to be doing some strange transformation to your data. In that sense, he may be doing something that is like a WAF in nature, so you'll have to do some playing around to build a successful PoC. I'd try something very different, like a SLEEP based injection:

1' and sleep(10)

Simply by virtue of having a different "form" of the payload, you may evade his "filter". If the server takes ~10 more seconds to return the response, then you know you have a successful payload! From there you can try to build different kinds of payloads for extracting information, etc...

| improve this answer | |
  • The 1’ and SLEEP(10) gives me a 403 error, but just the 1’ and gives me the normal page with a MySQL error similar to the one mentioned in the yellow part of my question. Also the page seems to block my ip after 3-4 403 error pages, and the block seems permanent. So maybe it is a WAF – Mohammad Ali Oct 24 '19 at 23:22
  • @MohammadAli do you get a MySQL syntax error as well, like before? – Conor Mancone Oct 24 '19 at 23:23
  • Standby I will copy paste it – Mohammad Ali Oct 24 '19 at 23:25
  • the 403 error page just has a single line of text on it saying I don’t have access. But only entering the 1’ and gives me the following error – Mohammad Ali Oct 24 '19 at 23:29
  • @MohammadAli Re-read your comment and understand now. Yes, it sounds like there might also be a WAF, but it isn't necessarily a great one. Moreover, a WAF is rarely a substitute for proper use of prepared queries (which isn't happening). So while the WAF makes this a bit more challenging, it's just a matter of finding the correct payload until you bypass things. – Conor Mancone Oct 24 '19 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.