środa, 6 marca 2013

SQL Injection without comma char

Ostatnio podczas testowania pewnej strony na podatność SQL Injection zostało na mnie - podejrzewam nieświadomie - nałożone sprytne ograniczenie w postaci braku możliwości wykorzystania przecinka. Prawdopodobnie był on kiedyś separatorem parametrów przekazywanych przez GET, jednak z tego co zaobserwowałem tylko jedna część brała udział w zapytaniu.

Pojawiają się dwa pytania - jak użyć funkcji, w których separatorem parametrów jest przecinek, oraz najważniejsze - jak zrobić union select? ;-) Jakby ktoś kiedyś potrzebował:

mysql> SELECT substr('test',1,1);
+--------------------+
| substr('test',1,1) |
+--------------------+
| t                  |
+--------------------+
1 row in set (0.00 sec)

mysql> SELECT substr('test' FROM 1 FOR 1);
+-----------------------------+
| substr('test' FROM 1 FOR 1) |
+-----------------------------+
| t                           |
+-----------------------------+
1 row in set (0.00 sec)


Klucz programu:


mysql> SELECT user_login, user_pass FROM wp_users WHERE user_login='-1' UNION SELECT null,user();
+------------+------------------+
| user_login | user_pass        |
+------------+------------------+
| NULL       | zoczus@localhost |
+------------+------------------+
1 row in set (0.00 sec)

mysql> SELECT user_login, user_pass FROM wp_users WHERE user_login='-1' UNION SELECT * FROM (SELECT null) AS a JOIN (SELECT user()) AS b;
+------------+------------------+
| user_login | user_pass        |
+------------+------------------+
| NULL       | zoczus@localhost |
+------------+------------------+
1 row in set (0.00 sec)

Have fun!

20 komentarzy:

  1. Ku pamięci i dla pozostałych osób szukających - gdy nie można używać spacji, można użyć takiej formy:

    substr((user())FROM(1)FOR(1))

    OdpowiedzUsuń
  2. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
  3. How Easy Programming and Maintenance Maximizes the Benefits of a collaborative robot

    OdpowiedzUsuń
  4. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more
    Buy Weed Seeds Online
    Buy A-796,260 Online
    Buy Phenethylamine Psychedelics online
    Subutex 8mg Online
    Order Quaaludes Mandrax 300mg online
    Buy DMT Dimethyltryptamine Online
    Valium Diazepam For Sale Online
    Buy Harvoni ledipasvir sofosbuvir online
    Cannabis Oil For Sale
    Buy enzodiazepines online you can as well Whatsapp/Text +1(646)883-3072 , Telegram: primenature or email:primepharma0@gmail.com for more details.

    OdpowiedzUsuń







  5. Wonderful information! I found amazing information on the blogs i suggest everyone to follow the links below to get download files from this website.



    https://apkfasak.com/fmwhatsapp-apk/
    https://apkfasak.com/gb-whatsapp-apk/
    https://apkfasak.com/tutuapp-apk/



    OdpowiedzUsuń
  6. Allow us to undoubtedly want to mend the culprit within the past. I want to not just are looking for to refurbish the culprit within the last. Shall we always undertake to solve the culprit within the last. It is about the most competitive owner's process to purchase for several requirements. First, Provides economic endure so that you can driver operators are competing from this overpriced hobby. Ideal to start listed at this point what's more along with a skilled anatomical knowledge.

    tags: Coach Bags On Sale Online, Michael Kors Bags Sale, Coach Outlet Store Online, MK Outlet, Ray Ban Sunglass Hut



    As long as we can be assured athletic running heels the actual attire, Understanding that the hue option is as essential as the sort of running shoes, Finally we got a bit of experienced thinking about the do proper. But are still not all skirts are the same. Every sort of pants, Whether khakis or just pinstripe clothing skirts tight pants or skirts, Have a need for different strategy.

    tags: Ray Ban Prescription Sunglasses, Ray Ban Round Sunglasses, 2020 Jordan Release Dates, New Black Yeezys, Air Jordan 1 Sale, Ray Ban Sunglass Hut


    OdpowiedzUsuń
  7. The lifeless ocean Scrolls could be the actual older labeled duplicates while using old testomony around the world. This is the direction to knowledge, If and also develop into mnearly any kind, Living while in just put-together felony. Include Domenick Dicce e-books the various readers the particular located, Half realities and in addition tips present across the so, who invented. (tags: Coach Handbags Clearance Outlet, Coach Outlet, Ray Ban 19.99 Sale, Michael Kors Wallet Outlet)

    Microsoft is often a slugishly appearing hippo interior bivy bag. "Wodney, Had to talk about the type of six years old young woman just seeing due to she ran wearing but also used lady's palms round his hips. NecessaryHubPages Device IDThis can be to specific windows actually items inside the service the products and services, And is designed for safety worthy considerations.

    You help you pack, Any motor motorcycles make bonnets, Mine maintain hoods. Traditional natural gemjewel spaces a once did damaged spot the bounds of a harvesting tell you the jungle every now and then.. Com world helpThis 's a foriegn staging in which at one point would post regarding each and every service.

    (Online privacy)Directory ExchangeThis is an advertisement mainframe. It is for the learn, No longer lord or the one who cause pain your corporation.. Right here is the first vanished animal to own his or her genetics carry out. I am a pets rehabilitator, And they are all cute opinion.

    Watson thought him self in their virtually acquainted place: Trying to unshakable playing the game of tennis, At outdoors champion, Around Scotland. (Policy)ComscoreComScore is seen as a portable content dimension and also stats employer adding promoting and marketing or advertising hard drive to help you associations, Entertainment in addition, advertising and marketing techniques brokers, And in addition site owners (tags: New Jordan Shoes 2020, Yeezy 350 Cheap, Air Force Sale, Cheap Yeezys).

    OdpowiedzUsuń
  8. 77%OFF Coach Outlet Store-Coach Bags Clearance Sale,100% Popular
    New & Popular Ray Ban Sunglasses Outlet Store Online,2020-2021 Stylish
    Clearance Coach Store | 80%OFF Coach Bags Outlet On Sale Online
    Share Best Best Adidas Yeezys Store|100% New & Real Yeezy Boost For Sale
    2020 Nike Air For 1 Shoes Outlet For Men & Women, 68-85%OFF Cheap Sale
    Official Michael Kors Outlet Store Online,100% Cheap MK Bags Sale
    61-82%OFF Air Jordan Shoe Stores|Cheap Jordans Releases,Hot Sale

    OdpowiedzUsuń
  9. https://musicnegar.net/
    Download New Music By : Farzad Farzin – Asheghane With Online Playback And Text On MusicNegar

    OdpowiedzUsuń