34

Recently my site was hacked via SQL injection. The hacker used the following query to get my DB name. I cannot understand this query they wrote.

Query:

=-999.9%20UNION%20ALL%20SELECT%20concat(0x7e,0x27,Hex(cast(database()%20as%20char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536--

After the query was ran it showed an integer result, something like "74545883".

Can you explain how the query works?

4
  • 7
    please dont sign your queries, we know who you are
    – sethvargo
    Jan 5, 2011 at 5:01
  • 1
    is that the only entry you have in your log? Jan 5, 2011 at 5:05
  • 7
    please dont sign your queries - for a moment, I was wondering what does signing a mysql query mean :)
    – JP19
    Jan 5, 2011 at 5:52
  • 1
    query as in question ha... ill edit that since its ambiguous
    – sethvargo
    Jan 5, 2011 at 5:55

7 Answers 7

19

It looks like an overflow attack. They UNION-ed with your existing query. replacing all your %20 with (space) since its url-encoded yields:

=-999.9 UNION ALL SELECT CONCAT(0x7e,0x27,Hex(cast(database() as char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536-

break it down:

  1. the =-999.9 is just ending your current query
  2. 0x31303235343830303536 is NULL - they are just matching the number of columns in your existing query. If you had SELECT * FROM users and users had 4 columns, the UNION must also have 4 columns. As a result, they just used `NULL values to populate those columns.
  3. the real confusion is in the CONCAT(). They are combining 126, 39, database name as hex value, 39, and 126
  4. -- is a mysql comment - it ignores the rest of your query after

Judging from this attack, i suspect that you are not wrapping input in mysql_real_escape_string(), which allowed to attacked to jump out of your query and execute their own.

See owasp.org for more information.

4
  • 1
    unhex(0x31303235343830303536) gave '%H V'. A calling card maybe? Its a mighty big number - between 2^78 and 2^79.
    – nate c
    Jan 5, 2011 at 5:31
  • it may be mysqls max_int - an attempt at overflow?
    – sethvargo
    Jan 5, 2011 at 5:33
  • As a side note, the ASCII representation of 31303235343830303536 is "1025480056" -- in ASCII, 0x3n is the number n.
    – cdhowie
    Jan 6, 2011 at 19:10
  • 5
    Somewhat of a necro, but I figured I might as well inform you that 0x31303235343830303536 is the calling card of Havij, an automated SQL injection tool.
    – Polynomial
    Oct 11, 2011 at 16:15
5

This is not the complete query, actually the person entered this string in your web app.

Now, first replace %20 with blank space in the union part, you get:

SELECT concat(0x7e,0x27,Hex(cast(database() as char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536--

Seems like the user put the string in some place where you were expecting an number. So, you see that first there is a number (999.9) to complete the original condition of the query. Then, an UNION part is added. Finally, after the UNION part, the comment characters are added (-- ) so that, the rest of the query (which might be being added by your system) is bypassed.

We can format the code for better understanding:

SELECT 
    concat
    (
        0x7e,
        0x27,
        Hex(cast(database() as char)),
        0x27,
        0x7e
    ),
    0x31303235343830303536,
    0x31303235343830303536,
    0x31303235343830303536

Now, substring of the first column of the result will contain the hex encoded form of your datbase name. Actually, it should be surrounded by single quotes (0x27), then again surrounded by ~ (0x7e)

3

The query returned the Database name using DATABASE() , it then converted this to a hex value using HEx() function.

Once they had this they could use UNHEX function

Have a look at the UNHEX examples

mysql> SELECT UNHEX('4D7953514C');
        -> 'MySQL'
mysql> SELECT 0x4D7953514C;
        -> 'MySQL'
mysql> SELECT UNHEX(HEX('string'));
        -> 'string'
mysql> SELECT HEX(UNHEX('1267'));
        -> '1267'

It is good to know how they got in, but all in all, you need to fix up your code to avoid SQL Injection.

2
  • @astander - he asked how the query worked. i interpreted that as "how did they bypass my (lack of) prevention", not "what does each of these functions inside here do". I feel that a person should be able to perform a google query for "mysql HEX", but a novice may not be attuned to escaping queries and common mysql injection attempts, yes?
    – sethvargo
    Jan 5, 2011 at 5:36
  • googling "mysql HEX" will tell him what the function does (like you've linked), but googling "mysql injection" isn't going to tell him why HIS particular query was hacked...
    – sethvargo
    Jan 5, 2011 at 5:40
1
-999.9 UNION ALL SELECT 
CONCAT('Hex(cast(database() as char))'),
0x31303235343830303536,
0x31303235343830303536,
0x31303235343830303536

I think you must have other entries in your log, if not he knew before hand that you have 3 columns.

1

This is an exemple of injection using Havij The 0x7e and 0x27 correspond to ~ and ' wich will be used to frame the HTML display such as id=999999.9+union+all+select+0x31303235343830303536,(select+concat(0x7e,0x27,unhex(Hex(cast(sample_tbl.name+as+char))),0x27,0x7e)+from+test.sample_tbl+Order+by+id+limit+0,1)+-- This query will render ~'Alfred'~ which is the field value of the column name, from the table sample_tbl in the table test

~'r3dm0v3_hvj_injection'~ is the Havij signature code unhex 0x7233646D3076335F68766A5F696E6A656374696F6E according to http://www.string-functions.com/hex-string.aspx

1
  • They tried the same MySQL injection on my web, but they tried on page without any database queries, everything is based on files :-) Mar 3, 2014 at 21:54
0

First off, the query looks like it's HTML encoded. Replace the %20s with spaces and it will become a little more readable. Also they are converting part of the query into a hex representation of something. Try hexadecimal decoding that part of the statement as well.

A SQL injection risk is created when you try to create a SQL dynamically as a string, and then send it to the DBMS. Imagine a string like this stored in your system for use in a search bar, etc:

SELECT * FROM SOME_TABLE WHERE SOME_COLUMN=

To complete the query and let the attack in, they would need to make their input like this:

'x' or 1=1

In that instance the query will become:

SELECT * FROM SOME_TABLE WHERE SOME_COLUMN='x' or 1=1

SOME_COLUMN could be any variable, it doesn't matter where it fails, the thing that matters is that 1=1 is ALWAYS true, thereby potentially giving the attacker access to every row in that table.

Now that you know about it, go through your code and replace every dynamically created query with a Prepared Statements. The OWASP site has a lot of resources for defensive coding as well:

www.owasp.org

-1

Yes he has got the hex form of your database name which you say is '74545883'. By Unhexing it he would have got the real database name.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.