5

Suppose this is the only mitigation used on a server:

Dim IDPerson
IDPerson = Request.Querystring("id")
If IsNumeric(IDPerson) = True Then
IDPerson = IDPerson
Else
IDPerson = 0
End If

IDPerson is then used to write the query. The "id" is the GET variable.

I know IsNumeric will accept Hex as numeric.

Could a whole query be constructed in hex and pass the IsNumeric function?

  • always wanted to know about that. i also do some stuff all the time to make sure the db isn't even touched. – user24408 May 29 '13 at 22:34
1

I'm gonna say that it depends on what you do later with the ID variable. If your code later converts the hex to a string and then builds queries with it, then the answer becomes 'yes'

Example:

I build an e-commerce website that looks looks up your purchase history based on your customer ID... Being a noob, I came up with a clever idea of using your email address to generate your ID by simply converting it to hexadecimal.

  • my email = customer@example.com
  • my ID would then be = 637573746f6d6572406578616d706c652e636f6d

That looks like a "pretty secure" and unique ID, so I feel really good about what I've done.

Now the injection:

Someone figures out that the user ID is simply the hex equivalent of the email address and guesses that I may be converting it back into text and using that result in a query

http://mysite.com/orderhistory?userid=637573746f6d6572406578616d706c652e636f6d

  • injected ID = 31272064726f70207461626c652075736572733b202d2d

  • ascii equivalent = 1' drop table users; --

If I, the developer, check to make sure the ID is numeric... then hex-to-text the ID... then use it in a query.... I've just allowed a sql injection

References:

Here's a similar question regarding SQL injections using only alpha-numeric characters: https://stackoverflow.com/questions/8086906/keeping-clear-of-sql-injections

Here's another thread discussing sql injection via hex: http://arstechnica.com/civis/viewtopic.php?f=20&t=107657

... Of course the right solution is to use 'real' prevention mechanisms such as parameterized queries, but this is certainly an interesting question.

  • I'm still not seeing an example anywhere of a complete query in Hex. It seems people only splash Hex in. – k to the z May 31 '13 at 17:36
  • I added an example of how a developer gone wrong could allow the injection – Brian Adkins May 31 '13 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.