Re: Magic Quotes question

I posted this earlier to webappsec@xxxxxxxxxxxxxxxxx with no luck ,
does anyone know how to bypass magic quotes? a proven working way .

example is, in such a simple SQL like
"SELECT * from USERS WHERE id =$id";

Magic quotes, as well as the correct db-specific escaping functions
(like mysql_real_escape_string() for MySQL) will not work if the query
itself is written badly, as in your example. Here is the correct
syntax, which cannot be exploited if the input was escaped, or if
magic quotes are enabled:

SELECT * from USERS WHERE id='$id'

I am looking for ways to by pass magic quotes to inject this
INTO OUTFILE '/home/z.php'

That said, INTO OUTFILE will only work with a literal string (at least
in MySQL, not sure of others), which means you have to use ' or ",
which are escaped by magic quotes.

In other situations where a value is unquoted in the query, you use
CHAR(39,....,39) to represent quotes. To use the above vulnerability
you can try $id=id, $id=1 or 1, $id>4, unions with another table, etc.
and see if any of the selected data is displayed. If not, you'll have
to do with blind sql injection techniques.

Mordred


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: [PHP] How do I get PHP to save a backslash in a Mysql table?
    ... First, if Magic Quotes are ON, then you probably want to stripslashesto ... Magic Quotes ON = extra slashes.. ... How do I get PHP to save a backslash in a Mysql table? ... The backslashes mysteriously are stripped. ...
    (php.general)
  • Re: after moving to new server, variables in query string not instantiated?
    ... if you're escaping and mysql is escaping, ... too, magic quotes is on the brain, though I may be wrong but you could ... I meant mySQL real escape string, just didn't recall the command, for ...
    (comp.lang.php)
  • Re: Injected, whats next
    ... Tried that, and it looked promising, however got stuck with the magic quotes. ... Does anyone know a way to upload a file to a server through MySQL! ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... Why wouldnt you just put the escape function inside of the database ... many modern db engines can use *any* delimiter, for any language, ... "magic quotes" was simply the wrong level to apply data filtering at. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Magic Quotes question
    ... in php6? ... for server admins and developers alike since there is no setting you ... And I experienced some configurations where Magic Quotes creates more ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)