This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Comment Injection Attack"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
Injection of comments to bypass some security checks or execute commands.
+
{{Template:Attack}}
  
==Related Articles==
+
==Description==
* [[Interpreter Injection]]
+
Comments injected into an application through input can be used to compromise a system. as data is parsed, an injected/malformed comment may cause the process to take unexpected actions that result in an attack.
  
{{Template:Stub}}
+
==Examples==
  
[[Category:Attack]]
+
The attacker may conduct this kind of attack with different programming or scripting languages:
 +
 
 +
'''Database:'''
 +
 
 +
If the attacker has possibility to manipulate queries, which are sended to the database, then he's able to inject terminating
 +
character too. The aftermath is that the interpretation of the query will be stoped at the terminating character:
 +
<pre>
 +
SELECT body FROM items WHERE id = $ID limit 1;
 +
</pre>
 +
Lets assume that the attacker has sended via GET method the following data stored in variable $ID:
 +
<pre>
 +
"1 or 1=1; #"
 +
</pre>
 +
In the end the final query form is:
 +
<pre>
 +
SELECT body FROM items WHERE id = 1 or 1=1; # limit 1;
 +
</pre>
 +
After '''#''' character everything will be discarded by the database including "''limit 1''". That's why only the last column "body" with all its records will be recived as a query response.
 +
 
 +
Sequences that may be used to comment queries:
 +
* MySQL:''#'', ''--''
 +
* MS SQL: ''--''
 +
* MS Access: ''%00'' ('''hack!''')
 +
* Oracle: ''--''
 +
 
 +
'''Null byte:'''
 +
 
 +
To comment out some parts of the queries, the attacker may use the standard sequences, typical for a given language, or terminate
 +
the queries using his own methods being limited only by his imagination. An interesing example is a null byte method used to
 +
comment out everything after the current query in MS Access databases. More information about it can be found in [[Embedding_Null_Code]] .
 +
 
 +
'''Shell:'''
 +
 
 +
Shell (bash) also has its character '''#''', which terminates interpretation.
 +
 
 +
For example:
 +
 
 +
find.php
 +
<pre>
 +
<?
 +
$ =sth $_GET['what];
 +
system("/usr/bin/find -name '$sth' -type f");
 +
?>
 +
</pre>
 +
Using ''/find.php?what=*'%20%23'' the attacker will bypass limitation "''-type f''" and this command:
 +
<pre>
 +
/usr/bin/find -name '*' -type f
 +
</pre>
 +
will become:
 +
<pre>
 +
/usr/bin/find -name '*' #-type f
 +
</pre>
 +
So the final form of the command is:
 +
<pre>
 +
/usr/bin/find -name '*'
 +
</pre>
 +
 
 +
'''HTML (injection):'''
 +
 
 +
If there are no restrictions about who is able to insert comments,then using start comment tag:
 +
<pre>
 +
<!--
 +
</pre>
 +
it's possible to comment out the rest of displayed content on the website.
 +
 
 +
invisible.php
 +
<pre>
 +
<?php
 +
print "hello!: ";
 +
print $_GET['user'];
 +
print " Welcome to Hell!";
 +
?>
 +
</pre>
 +
After:
 +
<pre>
 +
GET /invisible.php?user=<!--
 +
</pre>
 +
There result will be:
 +
<pre>
 +
hello!:
 +
</pre>
 +
 
 +
References:
 +
 
 +
* http://dev.mysql.com/doc/refman/5.0/en/comments.html
 +
* http://www.webapptest.org/ms-access-sql-injection-cheat-sheet-EN.html
 +
 
 +
==Related Threats==
 +
 
 +
* [[:Category:Information Disclosure]]
 +
 
 +
==Related Attacks==
 +
 
 +
* [[Embedding_Null_Code]]
 +
* [[Unicode Encoding]]
 +
 
 +
==Related Vulnerabilities==
 +
 
 +
* [[:Category:Input Validation Vulnerability]]
 +
 
 +
==Related Countermeasures==
 +
 
 +
* [[:Category: Input Validation]]
 +
 
 +
Developers should anticipate that comments will be injected/removed/manipulated in the input vectors of their software
 +
system. Use an appropriate combination of black lists and white lists to ensure only valid, expected and appropriate input is processed by the system.
 +
 
 +
==Categories==
 +
 
 +
[[:Category:Resource Manipulation]]

Revision as of 20:44, 4 November 2007

This is an Attack. To view all attacks, please see the Attack Category page.


Description

Comments injected into an application through input can be used to compromise a system. as data is parsed, an injected/malformed comment may cause the process to take unexpected actions that result in an attack.

Examples

The attacker may conduct this kind of attack with different programming or scripting languages:

Database:

If the attacker has possibility to manipulate queries, which are sended to the database, then he's able to inject terminating character too. The aftermath is that the interpretation of the query will be stoped at the terminating character:

SELECT body FROM items WHERE id = $ID limit 1;

Lets assume that the attacker has sended via GET method the following data stored in variable $ID:

"1 or 1=1; #"

In the end the final query form is:

SELECT body FROM items WHERE id = 1 or 1=1; # limit 1;

After # character everything will be discarded by the database including "limit 1". That's why only the last column "body" with all its records will be recived as a query response.

Sequences that may be used to comment queries:

  • MySQL:#, --
  • MS SQL: --
  • MS Access: %00 (hack!)
  • Oracle: --

Null byte:

To comment out some parts of the queries, the attacker may use the standard sequences, typical for a given language, or terminate the queries using his own methods being limited only by his imagination. An interesing example is a null byte method used to comment out everything after the current query in MS Access databases. More information about it can be found in Embedding_Null_Code .

Shell:

Shell (bash) also has its character #, which terminates interpretation.

For example:

find.php

<?
$ =sth $_GET['what];
system("/usr/bin/find -name '$sth' -type f");
?>

Using /find.php?what=*'%20%23 the attacker will bypass limitation "-type f" and this command:

/usr/bin/find -name '*' -type f

will become:

/usr/bin/find -name '*' #-type f

So the final form of the command is:

/usr/bin/find -name '*'

HTML (injection):

If there are no restrictions about who is able to insert comments,then using start comment tag:

<!--

it's possible to comment out the rest of displayed content on the website.

invisible.php

<?php
print "hello!: ";
print $_GET['user'];
print " Welcome to Hell!";
?>

After:

GET /invisible.php?user=<!--

There result will be:

hello!:

References:

Related Threats

Related Attacks

Related Vulnerabilities

Related Countermeasures

Developers should anticipate that comments will be injected/removed/manipulated in the input vectors of their software system. Use an appropriate combination of black lists and white lists to ensure only valid, expected and appropriate input is processed by the system.

Categories

Category:Resource Manipulation