We could confirm this by injection something like:įrom there we would see if we can see a Select error. We could gather that maybe the Word Select is being filtered out and replaced with white space. When breaking the SQL syntax you use the errors to guide you on just needs to be done for instance if we were injecting the broken syntax(Removed union to stop Forbidden errors): For instance, if union select is giving you a Forbidden or a Internal Server Error, try removing Union and seeing what happens with just Select and vice-versa To find out exactly what’s filtered you need to break your own SQL syntax and check for keywords being filtered, seeing if the keyword is filtered alone or in the presence of other SQL keywords. Most WAF’s will decode and filter an applications input, but some WAFs only decode the input once so double encoding can bypass certain filters as the WAF will decode the input once then filter while the Application will keep decoding the SQL statement executing our code. We could bypass that filter like so:Īs you can see once union select has been removed our capital UNION SELECT takes its place successfully injecting our query: For instance, let’s say we have a filter that replaces union select with whitespace. Sometimes and application will remove all of a keyword. I myself just used this against a Web site recently.ĥ)Replaced keywords(preg_replace and/or WAF’s with the same action): Here is a WAF that does it’s job correctly, but when given a large amount of Data allows the malicious request and response. #SPACE BYPASS SQL INJECTION CODE#The above code should bypass the Union select filters even where common inline comments didn’t work itselfĪ lot of WAFS are written in the C language making them prone to overflow or or act differently when loaded with a bunch of data. Notice we can use “like” instead of “=”Īnother way to use inline comemnts, when everything seems to fail you can try to through the application Firewall off by crafting a SQL statement using variables: These are 3 statements we need to inject our target. For example, let’s pretend a site filters union,where, table_name, table_schema, =, and information_schema. Inline comments can be used throughout the SQL statement so if table_name or information_schema are filtered we can add more inline comments. Take notice of the exclamation point /*!code*/ The exclamation point executes our SQL statement. Some WAF’s filter key words like /union\sselect/ig We can bypass this filter by using inline comments most of the time, More complex examples will require more advanced approach like adding SQL keywords that will further separate the two words: Id=1 UnIoN/**/SeLeCT, or with XSS -> alert(1) Some WAF’s will filter only lowercase attacks As we can see we can easily evade this by case changing: They allow us to bypass a lot of the restrictions of Web application firewalls and to kill certain SQL statements to execute the attackers commands while commenting out the actual legitimate query. SQL comments are a blessing to us SQL injectors.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |