19

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g.

select * from user where id = 'smith'' AND 1=1;--  and birthdate = 1970;

or

select * from user where id = 'smith' and birthdate = 1970 AND 1=1;--;
33

The specific question is SQL injection with AND 1=1 and not OR 1=1. There is a big difference here in what the OP is asking about. If I were your teacher and you provided me with JonathanMueller's answer you would get a lousy grade as you dont understand the question.

AND 1=1 is usally used in blind SQL injections. This is when you have to determine between a true or false state from the result of the application to make out what the actual result is. You don't get data listed out in the result, the only thing returned is a state of change.

If you try to exploit a Blind SQL injection with OR 1=1 you will fail because the primary use of OR 1=1 is to create an always true statement in order to get the most data out of the database or to force a true statement in the case of a login script being exploited.

A practical blind SQL exploit example:

We use our example: http://www.site.com/news.php?id=7 Let’s test it: http://www.site.com/news.php?id=7 and 1=1 <--- this is always true and the page loads normally, that's ok.

http://www.site.com/news.php?id=7 and 1=2 <--- this is false, so if some text, picture or some content is missing on returned page then that site is vulnerable to blind sql injection.

Another example where you try to figure out MySQL version:

http://www.site.com/news.php?id=7 and substring(@@version,1,1)=4 This should return TRUE if the version of MySQL is 4. Replace 4 with 5, and if query return TRUE then the version is 5.

Examples taken from: http://www.exploit-db.com/download_pdf/14475

  • Is there any tutorial where I can learn how to make sql injection vulnerable page? My aim is to learn about it. – Abhijeet Rastogi Nov 11 '11 at 18:00
  • 1
    @shadyabhi I'd much rather just download a vulnerable solution such as DVWA (Damn Vulnerable Web App) or Mutilidae. – Chris Dale May 14 '13 at 20:21
  • I understand the 2nd example with version. I don't understand the 1st example. 1=1 will always return true and 1=2 will always return false. What is the point/meaning of the first example? – nanonerd Jul 19 '18 at 16:51
  • @nanonerd it is done like that to try force the solution into two states where one state represents a TRUE return from the SQL query while the other state represents FALSE. This way we can create blind SQL's which allows us to extract data. I also do it with AND 1=1 then AND 1=2 every time just to get a proper understanding of the SQL and the solution I am testing on. Some solutions can get quite complex, and it is absolutely important having a solid understand on of the problem before trying to solve it. – Chris Dale Jul 20 '18 at 16:23
15

Normally, you would see the phrase being "OR 1=1'". The reason is, if the programmer doesn't properly handle parameters (like user id), then an attacker could use an OR 1=1 to return all data in the table.

For example, say we want to get details about a user named smith. The query could be select * from user where id = '?', where the question mark gets replaced with a parameter from a user's input. If the attacker passed smith' OR 1=1--, the resulting SQL would be select * from user where id = 'smith' OR 1=1--'. In this case the second single quote from the original query is skipped because it is part of a comment, and the query would return all data in the user table.

0

To give a (somewhat trivial, off top of head) example of sql injection, imagine this query somewhere in your app code ...

select 1 from user where name='[NAME]' and password='[PASS]'

after Malicious Guy sets named parameters above to his choosing, you get:

select 1 from user where name='admin' --' and password='[PASS]'
using the following chosen, unsanitized values:
[NAME]=' --' and password='[PASS]'
value of [PASS] variable is unimportant

Thus, assuming the query is meant to return 1 for success and empty set for invalid user or pass, a 1 would be erroneously returned, allowing this evil user to log in as the "admin" account.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.