2

I'm on a website which have a program, there is a search input for keywords.

When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I input $ or ^ or .* I get all keywords at once, which seem like its relying on REGEXP function from MySQL to match.

Ok, so I have tried aaaaaaa' OR SLEEP(999) -- - but output was:

Unfortunately! aaaaaaa\' OR SLEEP(9999) -- - is out of stock

Ok,so ' is getting escaped and becomes \', then I tried with \' to see if only ' is getting escaped, but it seems that both of them gets escaped:

Unfortunately! aaaaaaa\\' OR SLEEP(9999) -- - is out of stock

3 \ not 2 like in blockquote

I've also tried url encoding and I got same output.

By the way the app is using PHP and MySQL

0

You can't invoke a command from a regex, so you can't do an SQL injection in this case.

However, you could enter a very long processing regex that would certainly cause issues with the web site. For example forward lookahead with multiple wildcards (see Mastering Lookahead and Lookbehind).

Here is an example (in Java regex):

\(([$_a-zA-Z][$_a-zA-Z0-9]*(?:\.[$_a-zA-Z][$_a-zA-Z0-9]*)*(?:,[$_a-zA-Z][$_a-zA-Z0-9]*(?:\.[$_a-zA-Z][$_a-zA-Z0-9]*)*)*)*\)

The syntax that your regex uses may be slightly different, but this is the general idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.