RE: SQL injection (no single quotes used)

["Brett Moore" <brett.moore () security-assessment com>]

> Thanks and sorry for sending a not so tested POC to
> all of you.

Don't be... I often use the CR/LF pairs to bypass filters
in SQL (against MS SQL). %0a%0d can sometimes work, but it
is better to send the 'raw' bytes as a post. Using a
textarea field works great for this.

The GO statement, (from memory and what ppl are saying)
will not work. But this method can be used to bypass
filters that remove spaces.

select
something
from
somewhere

is a valid statement.

Also to bypass filters that look explicitly for strings,
which is always a bad idea.
For example if a filter looked for
"select ","update " or any term with a space after it.
Things like "exec master" etc, can also be bypassed.

Brett Moore
Network Intrusion Specialist, CTO
Security-Assessment.com

-----Original Message-----
From: Juan Carlos [mailto:johnccr () yahoo com]
Sent: Thursday, 16 December 2004 5:50 a.m.
To: Olivier G. Gaumond
Cc: webappsec () securityfocus com
Subject: Re: SQL injection (no single quotes used)


on my!

you are right, this won't work with ADO for example,
my bad :(

Thanks and sorry for sending a not so tested POC to
all of you.

-JC

 --- "Olivier G. Gaumond" <olig () monimap com> escribió:

> Juan Carlos Calderon wrote:
> > Here the MS Documentation for GO Keyword:
> > <snip>
> > SQL Server utilities interpret GO as a signal that
> > they should send the current batch of Transact-SQL
> > statements to SQL Server. The current batch of
> > statements is composed of all statements entered
> since
> > the last GO, or since the start of the ad hoc
> session
> > or script if this is the first GO
> > </snip>
>
> This may work in SQL Server utilities such as Query
> Analyzer, but the GO
> keyword is not part of the T-SQL language, so this
> would not work in a
> query sent by ADO.  At least it doesn't work with
> the ADO.NET SqlClient
> provider.
>
> Olivier

> ATTACHMENT part 2 application/x-pkcs7-signature
name=smime.p7s


_________________________________________________________
Do You Yahoo!?
Información de Estados Unidos y América Latina, en Yahoo! Noticias.
Visítanos en http://noticias.espanol.yahoo.com


######################################################################
CONFIDENTIALITY NOTICE: 

This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003.
######################################################################