I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this:
sql="SELECT * FROM USERS_TABLE WHERE USER='" & user & "' AND PASS='" & pass & "'"
There is a simple "security" mechanism on ASP doing a replacement for single quote char. Single quote is replaced by nothing. Something like:
user = Replace(Request.Form("username"), "'", "") pass = Replace(Request.Form("password"), "'", "")
As you can see both parameters are inside single quotes, CHAR(39) is not working because it is not interpreted as a command if put on any parameter, it is inside the string. So first step is to be able to "break" the single quote. Unicode seems to be not working.
I'd like to know if there is any known technique to be able to inject SQL here.