Waraxe IT Security Portal

piglet · Regular user

I've been messing with SQL lately & have noticed that all the MSSQL sites seem to have SQL locked down tight. They take only 1 imput field & no outpuf fields. All I can get is.

I put this in:
display.asp?category=14'

I get this back:
Microsoft VBScript runtime error '800a000d'

Type mismatch: '[string: "14'"]'

/display.asp, line 14

I've tried all the listed xp command-shell stuff, it doesn't matter what I put in. Only =1 to =14 gives me the page. Am I on a highway to nothing here, or what? The only exception is if I do something like =99999999999999999999999999 then I get:

Microsoft OLE DB Provider for SQL Server error '80040e57'

Arithmetic overflow error converting numeric to data type int.

/display.asp, line 26

So, what have I learnt? Well, it converts the input string into an int. Any int value bigger than the record size gives me:

ADODB.Recordset error '800a0bcd'

Either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current record.

/display.asp, line 84

So, it looks pretty secure from here.

My next attempt was to use fractions. I tried 14.1 to 14.5 & it just brought up the expected page. However, when I tried 14.6 it brought up the page, but with a little extra. At the top of the page, it said:

This catagory has not yet been activated (it was a graphic, not text).

Then I thought I would try =14.999999999999999999999999999999 which brought up yet another, useless error:

Microsoft OLE DB Provider for SQL Server error '80040e57'

The number '14.999999999999999999999999999999' is out of the range for numeric representation (maximum precision 2 Cool

.

/display.asp, line 26

So, with only 1 imput possible, I think I've tested all the alternatives. Anybody out there with any further ideas?

piglet · Regular user

I'm also looking into the email addresses connected to the site. Is there any way other than brute-force to get the list of mailboxes connected to a server?

piglet · Regular user

The only place on the site I can find to inject possibly 'interesting' data is into the order-form in checkout.asp. The form POSTs order details to hidden.asp. There are quite a number of fields. Look:

First Name:
Last Name:
Street Address:
City:
ZIP / Area Code:
State:
Country:
Email Address:
Telephone:
Additional Info:
Shipping Information:
Shipping Name:
Shipping Method:
Payment Information:
Payment Method:

Now, some of these fields are characters, some are numerical, some are a mixture.

The MOST interesting bit gleaned from the HTML is this:

<INPUT TYPE="hidden" NAME="finalTotal" VALUE="24">
<INPUT TYPE="hidden" NAME="orderTotal" VALUE="0">
<input type="hidden" name="subtotal" value="">
<input type="hidden" name="shippingCost" value="$24.00">
<INPUT TYPE="hidden" NAME="printShipment" VALUE="Regular">
<input type=hidden name=discount value="None">

Note the 'discount value' field. I'm not at all familiar with ASP, but I would love to know IF I can manipulate that 'discount value' field & if so, how do I format the POST command? What I really need is something that let's me edit the form before submitting it. Surely someone knows of such a utility/Firefox add-on?

piglet · Regular user

I've found the appropriate utility to modify hidden fields with Firefox. A useful user script called 'form help' which allows one to twiddle with all the values in hidden fields. I'm wondering if anyone can suggest ways to 'break it's brain' by disabling the javascript field-checkers & entering some massive values Smile

piglet · Regular user

Well, I applied the discound and was told that I owed the grand total of $0.00. Of course, I mailed them and told them about the weakness so that's 1 less hole. Hidden fields for discounts cannot be unique, so get looking for them, people!