Home page logo
/

webappsec logo WebApp Sec mailing list archives

RE: SQL Injection and MSSQL
From: "Mutallip Ablimit" <mutax () insi co jp>
Date: Mon, 28 Jun 2004 10:19:11 +0900

Hi Felipe,

Just google for the white paper named "SQL Injection Signatures Evasion".
Think you will find it helpful.

Regards,

Mutallip Ablimit

---
mutax () insi co jp


-----Original Message-----
From: lipe! [mailto:lipe () brturbo com]
Sent: Saturday, June 26, 2004 7:14 PM
To: webappsec () securityfocus com
Subject: SQL Injection and MSSQL


Hi all,

With filters like "if the parameter has substring 'SELECT'" a malicious user
can mask the 'select' from a request in ASP?

I mean something like (that i know witch works in MySQL)
"concat(char(1,2,3,4),char(5,6,7))"?

MS SQL Server has anyway to mascarade the querys, like some unicode feature
or string functions?

I just need to know if theres anyway that i can put a select in a query
without typing explicit "select". If there, why?

Many thanks!

------------------------------------------------------------
Felipe Santos Andrade <lipe () brturbo com>
Desenvolvedor TI/WEB Framework .NET
-----------------------------------------------------------




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]