Question

I know a little about SQL injections and URL decode, but can someone who’s more of an expert than me on this matter take a look at the following string and tell me what exactly it’s trying to do?

Some kid from Beijing a couple weeks ago tried a number of injections like the one below.

%27%20and%20char(124)%2Buser%2Bchar(124)=0%20and%20%27%27=%27

Answer 1

It’s making a guess about the sort of SQL statement that the form data is being substituted into, and assuming that it will be poorly sanitised at some step along the road. Consider a program talking to an SQL server (Cish code purely for example):

fprintf(sql_connection, "SELECT foo,bar FROM users WHERE user='%s';");

However, with the above string, the SQL server sees:

SELECT foo,bar FROM users WHERE user='' and char(124)+user+char(124)=0 and ''='';

Whoops! That wasn’t what you intended. What happens next depends on the database back-end and whether or not you’ve got verbose error reporting turned on.

It’s quite common for lazy web developers to enable verbose error reporting unconditionally for all clients and to not turn it off. (Moral: only enable detailed error reporting for a very tight trusted network, if at all.) Such an error report typically contains some useful information about the structure of the database which the attacker can use to figure out where to go next.

Now consider the username '; DESCRIBE TABLE users; SELECT 1 FROM users WHERE 'a'='. And so it goes on… There are a few different strategies here depending on exactly how the data comes out. SQL injection toolkits exist which can automate this process and attempt to automatically dump out the entire contents of a database via an unsecured web interface. Rafal Los’s blog post contains a little more technical insight.

You’re not limited to the theft of data, either; if you can insert arbitrary SQL, well, the obligatory xkcd reference illustrates it better than I can.