RE: SQL injection (no single quotes used)

["Mike Andrews" <mike () se fit edu>]

Exactly.  Not all SQL attacks are on strings - integers used (maybe ids?)
are also susceptible.  For example, at http://crash.se.fit.edu/hackerland/

http://crash.se.fit.edu/hackerland/showdetails.php?type=flowers&id=2 uses a
string and an integer to retrieve the description.  Both are vulnerable, but
if I just change the id number to...

http://crash.se.fit.edu/hackerland/showdetails.php?type=flowers&id=2 or 2>1

...there's no escaping of quotes needed, or the usual comment trick - it
just works with the SQL that is generated.

What should be happening is checking that the parameters are what the code
is expecting - type should either be "flowers" or "arrangements" and the id
should be a number > 0.  These are both very easy to check using regexes and
if they don’t fit (even if they have been encoded somehow) the request
should be thrown out (but still logged somewhere so you know what requests
are failing and perhaps uncover attack strategies).

Cheers,
Mike.

====================================================================
Mike Andrews  (mike () se fit edu)
http://www.bug-box.net              Florida Institute of Technology.
====================================================================


> -----Original Message-----
> From: Michael Howard [mailto:mikehow () microsoft com]
> Sent: Wednesday, December 15, 2004 10:01 PM
> To: Adam Tuliper; Juan Carlos Calderon; webappsec () securityfocus com
> Subject: RE: SQL injection (no single quotes used)
>
> From my experience, escaping is often never enough, because there a number
> of attacks that don't use quotes (etc)
>
> I'm not saying escaping quotes is bad, it's just not good enough on its
> own.
>
> [Writing Secure Code] http://www.microsoft.com/mspress/books/5957.asp
> [Protect Your PC] http://www.microsoft.com/protect
> [Blog] http://blogs.msdn.com/michael_howard
>
> [On-line Security Training]
> http://mste/training/offerings.asp?TrainingID=53074
>
>
> -----Original Message-----
> From: Adam Tuliper [mailto:amt () gecko-software com]
> Sent: Tuesday, December 14, 2004 11:30 AM
> To: Juan Carlos Calderon; webappsec () securityfocus com
> Subject: Re: SQL injection (no single quotes used)
>
> Michael Howard (and David LeBlanc) has a nice section in
> "writing secure code" about encoding characters. In some
> cases using char(0x27) as well as using entire words
> encoded via 0xXXXXXXXXXX can be used. Watching for "'" is
> not enough.
> I think Michael is on this list.. any words Michael?
>
>
>
> On Thu, 9 Dec 2004 09:53:03 -0600 (CST)
>  Juan Carlos Calderon <johnccr () yahoo com> wrote:
> > Hi all
> >
> > While in Oracle escaping apostrophe (') character
> > seems to be enough protection for Sql Injection (I
> > think is not), this is not true for Sql Server. Here a
> > little example I think many of you will find useful.
> >
> > For an on-the-fly query like:
> > Query = "select field1, field2... from table where id
> > = '" + FixSQL (FieldValue) + "'"
> >
> > Where FixSQL will escape single quotes AKA apostrophe,
> > the following value for "FieldValue" will be
> > effective:
> >
> > FieldValue = "(NewLine)GO(NewLine)Desired Sql
> > Sentence(NewLine)GO"
> >
> > Final result is:
> > select field1, field2... from table where id = '
> > GO
> > Desired Sql Sentence
> > GO
> > '
> >
> > Here the MS Documentation for GO Keyword:
> > <snip>
> > SQL Server utilities interpret GO as a signal that
> > they should send the current batch of Transact-SQL
> > statements to SQL Server. The current batch of
> > statements is composed of all statements entered since
> > the last GO, or since the start of the ad hoc session
> > or script if this is the first GO
> > </snip>
> >
> > So one sentence become three, sentences one and three
> > will fail, but sentence two (the one of our interest)
> > will execute successfully.
> >
> > Hope you find this interesting
> >
> > Cheers,
> > -JC
> >
> > _________________________________________________________
> > Do You Yahoo!?
> > Información de Estados Unidos y América Latina, en Yahoo!
> > Noticias.
> > Visítanos en http://noticias.espanol.yahoo.com
>
> ---------------------------------------------------------------------
> Web mail provided by NuNet, Inc. The Premier National provider.
> http://www.nni.com/