1

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this:

sql="SELECT * FROM USERS_TABLE WHERE USER='" & user & "' AND PASS='" & pass & "'"

There is a simple "security" mechanism on ASP doing a replacement for single quote char. Single quote is replaced by nothing. Something like:

user = Replace(Request.Form("username"), "'", "")
pass = Replace(Request.Form("password"), "'", "")

As you can see both parameters are inside single quotes, CHAR(39) is not working because it is not interpreted as a command if put on any parameter, it is inside the string. So first step is to be able to "break" the single quote. Unicode seems to be not working.

I'd like to know if there is any known technique to be able to inject SQL here.

  • Not a serious comment: any change the admin's password is '? – Conor Mancone Nov 5 '19 at 21:44
  • Not sure to understand what you mean. If you set ' as a password on the http form field, it is replaced by nothing and there is no sqli there. – OscarAkaElvis Nov 5 '19 at 21:47
  • Yeah, but they'll end up with no password! – Conor Mancone Nov 5 '19 at 21:48
  • 2
    Don't mind me, I was partly being silly and partly pointing out the danger of simple filtering like that (beyond the risk of SQLi). Removing characters from passwords is a dangerous idea because it reduces the password length. Imagine a user who tried to enter a password of '''''''''''''''. It would be a silly password, and in such a system it would be worse because while the input verification would probably see a long password and allow it, but what actually gets stored is an empty password. I realize this isn't your code, but wanted to point out the other dangerous side effects. – Conor Mancone Nov 5 '19 at 21:57
2

I would try injecting a backslash at the end of the username. Depending on how the language/system works (I'm not familiar with ASP) you may need to inject a double-backslash. Also don't forget that your payload will probably need to be URL encoded. i.e.:

http://example.com?username=admin%5C

You'll end up with this fragment in your query:

WHERE USER='admin\'

In most systems this will turn the single quote that was supposed to end the string into a single quote inside the string. This would break the query, except that the opening single quote around the password parameter will end the user search string, and then whatever your password is will be injected directly into the query. So you would use a payload like:

http://example.com?username=admin%5C&password=%20OR%201%3D1--

You'll then end up with this query:

WHERE USER='admin\' AND PASS=' OR 1=1--'

Just to be clear, AND PASS= has now become part of the search term on the USER column and there is no longer a search on the PASS column. The comment is needed to make the final closing single quote disappear and avoid an SQL error. The search on the USER column won't match anything but the OR 1=1 obviously will, and you'll (potentially) end up logged in as the first user in the system (probably an admin). You could also try to target someone by replacing OR 1=1 with OR ID=SOMENUMBER to try to login as a particular user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.