2

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use sql injection to login. The login form is php script, the login page consists of 2 boxes: username and password. I tried adding the "'" sign at the end of password and i do get sql error, so it is probably injectable. Then I tried adding the "' OR 1=1" and "' OR 'a'=a'" at the end of the password, but with not much success. So now I need some help! Any ideas or suggestions will be helpful. The partial php login code is below:

// Sanitization is present

if (isset($_POST['user']))
{
$user = sanitizeString($_POST['user']);
$pass = sanitizeStringSQL1($_POST['pass']);

if ($user == "" || $pass == "")
$error = "Not all fields were entered<br>";

else
{
$result = queryMySQL("SELECT user,pass FROM members WHERE user='$user' AND pass='$pass'");
if ($result->num_rows == 0)
  • I get error Call to undefined function sanitizeString() what function are you using for sanitation? also you are missing some brackets in code after if ($user == "" || $pass == "") – Tim Jonas Jan 31 '15 at 4:22
  • @TimWilliams I don't know what function it is, and I don't know there those custom functions could be, maybe in www dir or somewhere else. However, I just managed with a help of sql injection dictionary to authenticate. Now the question is what is that custom function and where would one normally place them? – Gazel Jan 31 '15 at 4:39
  • @Gazel that is a good question. Usually people would include this code at the top of the php file include sanitize.php; however I can't see this in your code. If you are running linux you could run a command like this grep -rnw '/var/www' -e "sanitizeString" in your terminal. This will search and display all files that contain "sanitizeString" text in them. – Tim Jonas Jan 31 '15 at 8:27
  • I tried looking through DVWA however I was unable to find any file containing "sanitizeString" – Tim Jonas Jan 31 '15 at 11:12
  • 1
    @TimWilliams My guess it that it's not exactly DWWA, probably our course leader customized the vulnerable site to make it different from the default one. Also, I found all the sanitize functions in a separate php file. I will pot a new question regarding overcoming those sql injection sanitization functions. – Gazel Jan 31 '15 at 11:25
1

You're syntax is a little off in both of your attempts at this. Since you mention you're using DVWA I'll provide the source here (so that we can rule out PHP/DB errors on your side)

<?php     

if(isset($_GET['Submit'])){ 

// Retrieve data 

$id = $_GET['id']; 

$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'"; 
$result = mysql_query($getid) or die('<pre>' . mysql_error() . '</pre>' ); 

$num = mysql_numrows($result); 

$i = 0; 

while ($i < $num) { 

    $first = mysql_result($result,$i,"first_name"); 
    $last = mysql_result($result,$i,"last_name"); 

    echo '<pre>'; 
    echo 'ID: ' . $id . '<br>First name: ' . $first . '<br>Surname: ' . $last; 
    echo '</pre>'; 

    $i++; 
} 
} 
?>

The following line will trigger a successful injection:

foo' or '1' = '1

Notice that there is no tick at the beginning nor at the end of the payload. This is because (as you can see in the source) that the query itself is providing it (on both ends of $id).

In your examples of

' OR 1=1 and ' OR 'a'=a'

The first case is missing ticks all together, and the second case has an ending tick. Both will likely produce SQL syntax errors.

If you want to check your SQL syntax use an online resource such as this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.