How does it work?
lets suppose we have a page containing the registration form the server the code
PHP Code:
<?php
mssql_connect(..);
mssql_select_db(..);
$account = $_POST['acc']; // account field
$password = $_POST['pass']; // password field
// other vars bla bla..
// Now here is the base query
// First we check if this acc exists
$query = mssql_query("select count(*) from [memb_info] where [memb___id]='$account'"); // This is where the 'hacker" (lame kiddie) will hit you
//other code does not matter
?>
lets change the $account with
the code becomes
PHP Code:
<?php
mssql_connect(..);
mssql_select_db(..);
$account = $_POST['acc']; // account field
$password = $_POST['pass']; // password field
// other vars bla bla..
// Now here is the base query
// First we check if this acc exists
$query = mssql_query("select count(*) from [memb_info] where [memb___id]='[COLOR=Green]'; shutdown; --[/COLOR]'"); // This is where the 'hacker" (lame kiddie) will hit you
//other code does not matter
?>
defining the ';shutdown; --
' - ends the define of the acc name
; - ends the current query line
shutdown - our new query (shuts down mssql server)
; -- - completes our new query (in case there is further code after the if memb___id bit)
This way everyone can inject whatever query he likes into ur database. Really easy
Most people think that by limiting there fields to maxlength=10 they will avoid anything - nah totally wrong...the only thing that our NEWB hacker must do is to create the same form in his own html file and remove the maxlength...and KABOOOM..you get fucked up again
Solution: A way to avoid this w/o disabeling any symbols ?
PHP Code:
<?php
mssql_connect(..);
mssql_select_db(..);
$account = addslashes($_POST['acc']); // account field
$password = addslashes($_POST['pass']); // password field
// other vars bla bla..
// Now here is the base query
// First we check if this acc exists
$query = mssql_query("select count(*) from [memb_info] where [memb___id]='$account'"); // This is where the 'hacker" (lame kiddie) will hit you
//other code does not matter
?>
effective and easy
Injections can be done in $_POST, $_GET or $_REQUEST, $_COOKIE or every value that the user has access to, so i suggest you addslashes() to all (addslashes changes ' to \' and " to "\ - this way user cannot end ur current query)
Reply With Quote
Thanks
Re: [Guide] Blasts, Injections, and how to stop them
