SecurityFocus

Fwd: PHP Easter Eggs Nov 28 2004 01:21PM
Andi McLean (andi_mclean ntlworld com) (6 replies)

Re: PHP Easter Eggs Nov 30 2004 04:19AM
Serban Gh. Ghita (serban verasys ro)

Re: PHP Easter Eggs Nov 30 2004 04:12AM
Serban Gh. Ghita (serban verasys ro) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 02:40AM
Harrison Gladden (hgladden gmail com) (4 replies)

Re: PHP Easter Eggs Dec 06 2004 09:45PM
Antonio Varni (antonio varni gmail com)

RE: PHP Easter Eggs Nov 30 2004 07:39PM
V. Poddubnyy (vpoddubniy mail ru)

Re: PHP Easter Eggs Nov 30 2004 02:40AM
Harrison Gladden (hgladden gmail com) (4 replies)

Re: PHP Easter Eggs Dec 06 2004 09:45PM
Antonio Varni (antonio varni gmail com)

RE: PHP Easter Eggs Nov 30 2004 07:39PM
V. Poddubnyy (vpoddubniy mail ru)

Re: Fwd: PHP Easter Eggs Nov 29 2004 08:54PM
Alexander Klimov (alserkli inbox ru)

Re: Fwd: PHP Easter Eggs Nov 29 2004 04:17PM
Saqib N Ali seagate com (2 replies)

Re: Fwd: PHP Easter Eggs Nov 30 2004 08:53AM
exon (exon home se) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to
> all of you.

Don't be... I often use the CR/LF pairs to bypass filters
in SQL (against MS SQL). %0a%0d can sometimes work, but it
is better to send the 'raw' bytes as a post. Using a
textarea field works great for this.

The GO statement, (from memory and what ppl are saying)
will not work. But this method can be used to bypass
filters that remove spaces.

select
something
from
somewhere

is a valid statement.

Also to bypass filters that look explicitly for strings,
which is always a bad idea.
For example if a filter looked for
"select ","update " or any term with a space after it.
Things like "exec master" etc, can also be bypassed.

Brett Moore
Network Intrusion Specialist, CTO
Security-Assessment.com

-----Original Message-----
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]]
Sent: Thursday, 16 December 2004 5:50 a.m.
To: Olivier G. Gaumond
Cc: webappsec (at) securityfocus (dot) com [email concealed]
Subject: Re: SQL injection (no single quotes used)

on my!

you are right, this won't work with ADO for example,
my bad :(

Thanks and sorry for sending a not so tested POC to
all of you.

-JC

--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió:

> Juan Carlos Calderon wrote:
> > Here the MS Documentation for GO Keyword:
> > <snip>
> > SQL Server utilities interpret GO as a signal that
> > they should send the current batch of Transact-SQL
> > statements to SQL Server. The current batch of
> > statements is composed of all statements entered
> since
> > the last GO, or since the start of the ad hoc
> session
> > or script if this is the first GO
> > </snip>
>
> This may work in SQL Server utilities such as Query
> Analyzer, but the GO
> keyword is not part of the T-SQL language, so this
> would not work in a
> query sent by ADO. At least it doesn't work with
> the ADO.NET SqlClient
> provider.
>
> Olivier
>

> ATTACHMENT part 2 application/x-pkcs7-signature
name=smime.p7s

_________________________________________________________
Do You Yahoo!?
Información de Estados Unidos y América Latina, en Yahoo! Noticias.
Visítanos en http://noticias.espanol.yahoo.com

######################################################################
CONFIDENTIALITY NOTICE:

This message and any attachment(s) are confidential and proprietary.
They may also be privileged or otherwise protected from disclosure. If
you are not the intended recipient, advise the sender and delete this
message and any attachment from your system. If you are not the
intended recipient, you are not authorised to use or copy this message
or attachment or disclose the contents to any other person. Views
expressed are not necessarily endorsed by Security-Assessment.com
Limited. Please note that this communication does not designate an
information system for the purposes of the New Zealand Electronic
Transactions Act 2003.
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
 
-----Original Message----- 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
name=smime.p7s 
 
_________________________________________________________ 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
 
######################################################################
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
 
-----Original Message----- 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
name=smime.p7s 
 
_________________________________________________________ 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
 
######################################################################&l
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
 
-----Original Message----- 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
name=smime.p7s 
 
_________________________________________________________ <
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
 
######################################################################&a
mp;l 
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
 
-----Original Message----- 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
name=smime.p7s 
 
_________________________________________________________ <
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
 
######################################################################&a
mp;a 
mp;l 
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 

 
-----Original Message----- 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
name=smime.p7s 
 
_________________________________________________________ <
 
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
 
######################################################################&a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 
textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
will not work. But this method can be used to bypass 
filters that remove spaces. 
 
select 
something 
from 
somewhere 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
 
 
-----Original Message----- 

From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: 
 
> Juan Carlos Calderon wrote: 
> > Here the MS Documentation for GO Keyword: 
> > <snip> 

> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 

> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
> > or script if this is the first GO 
> > </snip> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 
> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient 
> provider. 
> 
> Olivier 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
name=smime.p7s 
 
_________________________________________________________ <
 
 
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com 
/> 
 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to 
> all of you. 
 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it 
is better to send the 'raw' bytes as a post. Using a 

textarea field works great for this. 
 
The GO statement, (from memory and what ppl are saying) 
; 
will not work. But this method can be used to bypass 
 
filters that remove spaces. 
; 
 
select 
 
something <br/&
gt; 
from 
somewhere <br/&
gt; 
 
is a valid statement. 
 
Also to bypass filters that look explicitly for strings, <br/&g
t; 
which is always a bad idea. 
For example if a filter looked for 
"select ","update " or any term with a space after it. 
Things like "exec master" etc, can also be bypassed. <br/&
gt; 
 
Brett Moore 
Network Intrusion Specialist, CTO 
Security-Assessment.com 
r/> 
 
 
-----Original Message----- 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Thursday, 16 December 2004 5:50 a.m. 
To: Olivier G. Gaumond 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: Re: SQL injection (no single quotes used) 
 
on my! 
 
you are right, this won't work with ADO for example, <br/&g
t; 
my bad :( 
 
Thanks and sorry for sending a not so tested POC to 
all of you. 
 
-JC 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
lt; 
br/> 
 
> Juan Carlos Calderon wrote: 
 
> > Here the MS Documentation for GO Keyword: <br/&g
t; 
> > <snip> 
 
> > SQL Server utilities interpret GO as a signal that 
> > they should send the current batch of Transact-SQL 
 
> > statements to SQL Server. The current batch of 
> > statements is composed of all statements entered 
; 
> since 
> > the last GO, or since the start of the ad hoc 
> session 
; 
> > or script if this is the first GO 
> > </snip> <
br/ 
> 
> 
> This may work in SQL Server utilities such as Query 
> Analyzer, but the GO 
> keyword is not part of the T-SQL language, so this 
> would not work in a 

> query sent by ADO. At least it doesn't work with 
> the ADO.NET SqlClient <br/&
gt; 
> provider. <br/&
gt; 
> 
> Olivier 
; 
> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
name=smime.p7s <
;br 
/> 
 
_________________________________________________________ <
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
/> 
 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
CONFIDENTIALITY NOTICE: 
; 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: Fwd: PHP Easter Eggs Nov 30 2004 08:53AM
exon (exon home se) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
br/ 
> 
> all of you. &l
t;b 
r/> 
 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
textarea field works great for this. &
lt; 
br/> 
 
The GO statement, (from memory and what ppl are saying) 
; 
; 
will not work. But this method can be used to bypass 
 
 
filters that remove spaces. 
; 
; 
 
select 
 
 
something <br/&
amp; 
gt; 
from &l
t;b 
r/> 
somewhere <br/&
amp; 
gt; 
 
is a valid statement. <br/
 
> 
 
Also to bypass filters that look explicitly for strings, <br/&a
mp;g 
t; 
which is always a bad idea. &
lt; 
br/> 
For example if a filter looked for <
;br 
/> 
"select ","update " or any term with a space after it. <
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
gt; 
 
Brett Moore &
lt; 
br/> 
Network Intrusion Specialist, CTO <
;br 
/> 
Security-Assessment.com 
 
r/> 
 
 
-----Original Message----- 
r/> 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &l
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
> 
Subject: Re: SQL injection (no single quotes used) &
lt; 
br/> 
 
on my! <
;br 
/> 
 
you are right, this won't work with ADO for example, <br/&a
mp;g 
t; 
my bad :( <
br/ 
> 
 
Thanks and sorry for sending a not so tested POC to <
br/ 
> 
all of you. &l
t;b 
r/> 
 
-JC <
;br 
/> 
 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
lt; 
br/> 
 
> Juan Carlos Calderon wrote: 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;g 
t; 
> > <snip> 
r/> 
 
> > SQL Server utilities interpret GO as a signal that &l
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
r/> 
 
> > statements to SQL Server. The current batch of <
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
> since &
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
;br 
/> 
> session 
; 
; 
> > or script if this is the first GO <
br/ 
> 
> > </snip> <
 
br/ 
> 
> &l
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
lt; 
br/> 
> Analyzer, but the GO <
br/ 
> 
> keyword is not part of the T-SQL language, so this &l
t;b 
r/> 
> would not work in a 
 
> query sent by ADO. At least it doesn't work with &l
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
gt; 
> provider. <br/&
amp; 
gt; 
> &l
t;b 
r/> 
> Olivier 
; 
; 
> &l
t;b 
r/> 
 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
name=smime.p7s <
; 
;br 
/> 
 
_________________________________________________________ <
 
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
/> 
 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
CONFIDENTIALITY NOTICE: 
; 
; 
 
This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003. &
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
br/ 
> 
> all of you. &a
mp;l 
t;b 
r/> 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
r/> 
 
textarea field works great for this. &
amp; 
lt; 
br/> 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
will not work. But this method can be used to bypass 
 
 
 
filters that remove spaces. 
; 
; 
; 
 
/> 
select 
 
 
 
something <br/&
amp; 
amp; 
gt; 
from &a
mp;l 
t;b 
r/> 
somewhere <br/&
amp; 
amp; 
gt; 
 
/> 
is a valid statement. <br/
 
 
> 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;g 
t; 
which is always a bad idea. &
amp; 
lt; 
br/> 
For example if a filter looked for <
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
gt; 
 
/> 
Brett Moore &
amp; 
lt; 
br/> 
Network Intrusion Specialist, CTO <
; 
;br 
/> 
Security-Assessment.com 
 
 
r/> 
 
 
/> 
-----Original Message----- 
 
r/> 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;l 
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
lt; 
br/> 
 
/> 
on my! <
; 
;br 
/> 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;g 
t; 
my bad :( <
 
br/ 
> 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
br/ 
> 
all of you. &a
mp;l 
t;b 
r/> 
 
/> 
-JC <
; 
;br 
/> 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
lt; 
br/> 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;g 
t; 
> > <snip> 
 
r/> 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;l 
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
 
r/> 
 
> > statements to SQL Server. The current batch of <
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
> since &
amp; 
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
; 
;br 
/> 
> session 
; 
; 
; 
> > or script if this is the first GO <
 
br/ 
> 
> > </snip> <
 
 
br/ 
> 
> &a
mp;l 
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
amp; 
lt; 
br/> 
> Analyzer, but the GO <
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;l 
t;b 
r/> 
> would not work in a 
r/> 
 
> query sent by ADO. At least it doesn't work with &a
mp;l 
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
gt; 
> provider. <br/&
amp; 
amp; 
gt; 
> &a
mp;l 
t;b 
r/> 
> Olivier 
; 
; 
; 
> &a
mp;l 
t;b 
r/> 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
name=smime.p7s <
; 
; 
;br 
/> 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
/> 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
/> 
They may also be privileged or otherwise protected from disclosure. If 
/> 
you are not the intended recipient, advise the sender and delete this 
/> 
message and any attachment from your system. If you are not the 
/> 
intended recipient, you are not authorised to use or copy this message 
/> 
or attachment or disclose the contents to any other person. Views 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
/> 
Limited. Please note that this communication does not designate an 
/> 
information system for the purposes of the New Zealand Electronic 
/> 
Transactions Act 2003. &
amp; 
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
br/ 
> 
> all of you. &a
mp;a 
mp;l 
t;b 
r/> 
 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
r/> 
 
textarea field works great for this. &
amp; 
amp; 
lt; 
br/> 
 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
will not work. But this method can be used to bypass 
 
 
 
 
filters that remove spaces. 
; 
; 
; 
; 
 
 
/> 
select 
 
 
 
 
something <br/&
amp; 
amp; 
amp; 
gt; 
from &a
mp;a 
mp;l 
t;b 
r/> 
somewhere <br/&
amp; 
amp; 
amp; 
gt; 
 
 
/> 
is a valid statement. <br/
 
 
 
> 
 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;g 
t; 
which is always a bad idea. &
amp; 
amp; 
lt; 
br/> 
For example if a filter looked for <
; 
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
gt; 
 
 
/> 
Brett Moore &
amp; 
amp; 
lt; 
br/> 
Network Intrusion Specialist, CTO <
; 
; 
;br 
/> 
Security-Assessment.com 
 
 
 
r/> 
 
 
 
/> 
-----Original Message----- 
 
 
r/> 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;l 
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
; 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
lt; 
br/> 
 
 
/> 
on my! <
; 
; 
;br 
/> 
 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;g 
t; 
my bad :( <
 
 
br/ 
> 
 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
 
br/ 
> 
all of you. &a
mp;a 
mp;l 
t;b 
r/> 
 
 
/> 
-JC <
; 
; 
;br 
/> 
 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;g 
t; 
> > <snip> 
 
 
r/> 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;l 
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
 
 
r/> 
 
> > statements to SQL Server. The current batch of <
 
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
> since &
amp; 
amp; 
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
; 
; 
;br 
/> 
> session 
; 
; 
; 
; 
> > or script if this is the first GO <
 
 
br/ 
> 
> > </snip> <
 
 
 
br/ 
> 
> &a
mp;a 
mp;l 
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
lt; 
br/> 
> Analyzer, but the GO <
 
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;l 
t;b 
r/> 
> would not work in a 
 
r/> 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;l 
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
gt; 
> provider. <br/&
amp; 
amp; 
amp; 
gt; 
> &a
mp;a 
mp;l 
t;b 
r/> 
> Olivier 
; 
; 
; 
; 
> &a
mp;a 
mp;l 
t;b 
r/> 
 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
name=smime.p7s <
; 
; 
; 
;br 
/> 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
/> 
 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l &l
t;b 
r/> 
t;b <
; 
;br 
/> 
r/> 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
 
/> 
They may also be privileged or otherwise protected from disclosure. If 
 
/> 
you are not the intended recipient, advise the sender and delete this 
 
/> 
message and any attachment from your system. If you are not the 
 
/> 
intended recipient, you are not authorised to use or copy this message 
 
/> 
or attachment or disclose the contents to any other person. Views 
 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
/> 
Limited. Please note that this communication does not designate an 
 
/> 
information system for the purposes of the New Zealand Electronic 
 
/> 
Transactions Act 2003. &
amp; 
amp; 
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
 
br/ 
> 
> all of you. &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
 
r/> 
 
textarea field works great for this. &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
; 
will not work. But this method can be used to bypass 
 
 
 
 
 
filters that remove spaces. 
; 
; 
; 
; 
; 
 
 
 
/> 
select 
 
 
 
 
 
something <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
from &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
somewhere <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
/> 
is a valid statement. <br/
 
 
 
 
> 
 
 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;a 
mp;g 
t; 
which is always a bad idea. &
amp; 
amp; 
amp; 
lt; 
br/> 
For example if a filter looked for <
; 
; 
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
; 
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
/> 
Brett Moore &
amp; 
amp; 
amp; 
lt; 
br/> 
Network Intrusion Specialist, CTO <
; 
; 
; 
;br 
/> 
Security-Assessment.com 
 
 
 
 
r/> 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
r/> 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
; 
; 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
on my! <
; 
; 
; 
;br 
/> 
 
 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;a 
mp;g 
t; 
my bad :( <
 
 
 
br/ 
> 
 
 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
 
 
br/ 
> 
all of you. &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
/> 
-JC <
; 
; 
; 
;br 
/> 
 
 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;g 
t; 
> > <snip> 
 
 
 
r/> 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
 
 
 
r/> 
 
> > statements to SQL Server. The current batch of <
 
 
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
; 
> since &
amp; 
amp; 
amp; 
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
; 
; 
; 
;br 
/> 
> session 
; 
; 
; 
; 
; 
> > or script if this is the first GO <
 
 
 
br/ 
> 
> > </snip> <
 
 
 
 
br/ 
> 
> &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
amp; 
lt; 
br/> 
> Analyzer, but the GO <
 
 
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> would not work in a 
 
 
r/> 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
> provider. <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
> &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> Olivier 
; 
; 
; 
; 
; 
> &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
; 

name=smime.p7s <
; 
; 
; 
; 
;br 
/> 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
 
/> 
 
 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a &l
t;b 
r/> 
mp;l &a
mp;l 
t;b 
r/> 
t;b <
; 
; 
;br 
/> 
r/> 
 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
; 
 
 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
 
 
/> 
They may also be privileged or otherwise protected from disclosure. If 
 
 
/> 
you are not the intended recipient, advise the sender and delete this 
 
 
/> 
message and any attachment from your system. If you are not the 
 
 
/> 
intended recipient, you are not authorised to use or copy this message 
 
 
/> 
or attachment or disclose the contents to any other person. Views 
 
 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
 
/> 
Limited. Please note that this communication does not designate an 
 
 
/> 
information system for the purposes of the New Zealand Electronic 
 
 
/> 
Transactions Act 2003. &
amp; 
amp; 
amp; 
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
 
 
br/ 
> 
> all of you. &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
; 
; 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
 
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
 
 
r/> 
 
textarea field works great for this. &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
; 
; 
will not work. But this method can be used to bypass 
 
 
 
 
 
 
filters that remove spaces. 
; 
; 
; 
; 
; 
; 
 
 
 
 
/> 
select 
 
 
 
 
 
 
something <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
from &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
somewhere <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
 
/> 
is a valid statement. <br/
 
 
 
 
 
> 
 
 
 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
which is always a bad idea. &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
For example if a filter looked for <
; 
; 
; 
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
; 
; 
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
 
/> 
Brett Moore &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
Network Intrusion Specialist, CTO <
; 
; 
; 
; 
;br 
/> 
Security-Assessment.com 
 
 
 
 
 
r/> 
 
 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
r/> 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
; 
; 
; 
; 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
on my! <
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
my bad :( <
 
 
 
 
br/ 
> 
 
 
 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
 
 
 
br/ 
> 
all of you. &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
/> 
-JC <
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
> > <snip> 
 
 
 
 
r/> 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
 
 
 
 
r/> 
 
> > statements to SQL Server. The current batch of <
 
 
 
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
; 
; 
> since &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
; 
; 
; 
; 
;br 
/> 
> session 
; 
; 
; 
; 
; 
; 
> > or script if this is the first GO <
 
 
 
 
br/ 
> 
> > </snip> <
 
 
 
 
 
br/ 
> 
> &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
> Analyzer, but the GO <
 
 
 
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> would not work in a 
 
 
 
r/> 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
> provider. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
> &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> Olivier 
; 
; 
; 
; 
; 
; 
> &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
; 

; 
 
name=smime.p7s <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
br/ <
; 
; 
;br 
/> 
> &a
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
 
 
/> &
lt; 
br/> 
 
 
 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a &l
t;b 
r/> 
mp;a &a
mp;l 
t;b 
r/> 
mp;l &a
mp;a 
mp;l 
t;b 
r/> 
t;b <
; 
; 
; 
;br 
/> 
r/> 
 
 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
; 
; 
 
 
 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
 
 
 
/> 
They may also be privileged or otherwise protected from disclosure. If 
 
 
 
/> 
you are not the intended recipient, advise the sender and delete this 
 
 
 
/> 
message and any attachment from your system. If you are not the 
 
 
 
/> 
intended recipient, you are not authorised to use or copy this message 
 
 
 
/> 
or attachment or disclose the contents to any other person. Views 
 
 
 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
 
 
/> 
Limited. Please note that this communication does not designate an 
 
 
 
/> 
information system for the purposes of the New Zealand Electronic 
 
 
 
/> 
Transactions Act 2003. &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
br/ 
> 
> all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
; 
; 
; 

in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
 
 
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
 
 
 
r/> 
 
textarea field works great for this. &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
; 
; 
; 

will not work. But this method can be used to bypass 
 
 
 
 
 
 
 
filters that remove spaces. 
; 
; 
; 
; 
; 
; 
; 

 
 
 
 
 
/> 
select 
 
 
 
 
 
 
 
something <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
from &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
somewhere <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
 
 
/> 
is a valid statement. <br/
 
 
 
 
 
 
> 
 
 
 
 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
which is always a bad idea. &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
For example if a filter looked for <
; 
; 
; 
; 
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
; 
; 
; 
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
 
 
 
 
 
/> 
Brett Moore &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
Network Intrusion Specialist, CTO <
; 
; 
; 
; 
; 
;br 
/> 
Security-Assessment.com 
 
 
 
 
 
 
r/> 
 
 
 
 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
 
r/> 
 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
To: Olivier G. Gaumond 
; 
; 
; 
; 
; 
; 
; 

Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
on my! <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
my bad :( <
 
 
 
 
 
br/ 
> 
 
 
 
 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
br/ 
> 
all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
/> 
-JC <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
> > <snip> 
 
 
 
 
 
r/> 
 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> > they should send the current batch of Transact-SQL 
 
 
 
 
 
r/> 
 
 
> > statements to SQL Server. The current batch of <
 
 
 
 
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
; 
; 
; 

> since &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
> > the last GO, or since the start of the ad hoc <
; 
; 
; 
; 
; 
;br 
/> 
> session 
; 
; 
; 
; 
; 
; 
; 

> > or script if this is the first GO <
 
 
 
 
 
br/ 
> 
> > </snip> <
 
 
 
 
 
 
br/ 
> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
> Analyzer, but the GO <
 
 
 
 
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> would not work in a 
 
 
 
 
r/> 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
> provider. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
> Olivier 
; 
; 
; 
; 
; 
; 
; 

> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
name=smime.p7s <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
br/ <
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
 
 
 
/> &
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a &l
t;b 
r/> 
mp;a &a
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;l 
t;b 
r/> 
mp;l &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
t;b <
; 
; 
; 
; 
;br 
/> 
r/> 
 
 
 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
; 
; 
; 

 
 
 
 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
 
 
 
 
/> 
They may also be privileged or otherwise protected from disclosure. If 
 
 
 
 
/> 
you are not the intended recipient, advise the sender and delete this 
 
 
 
 
/> 
message and any attachment from your system. If you are not the 
 
 
 
 
/> 
intended recipient, you are not authorised to use or copy this message 
 
 
 
 
/> 
or attachment or disclose the contents to any other person. Views 
 
 
 
 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
 
 
 
/> 
Limited. Please note that this communication does not designate an 
 
 
 
 
/> 
information system for the purposes of the New Zealand Electronic 
 
 
 
 
/> 
Transactions Act 2003. &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
 
br/ 
> 
> all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
; 
; 
; 

; 
 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
 
 
 
 
br/ 
> 
is better to send the 'raw' bytes as a post. Using a 
 
 
 
 
 
r/> 
 
 
textarea field works great for this. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
 
/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
; 
; 
; 

; 
 
will not work. But this method can be used to bypass 
 
 
 
 
 
 
 
 
filters that remove spaces. 
; 
; 
; 
; 
; 
; 
; 

; 
 
 
 
 
 
 
 
/> 
select 
 
 
 
 
 
 
 
 
something <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
from &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
somewhere <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
 
 
 
 
 
 
/> 
is a valid statement. <br/
 
 
 
 
 
 
 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; <
br/ 
> 
which is always a bad idea. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
For example if a filter looked for <
; 
; 
; 
; 
; 
; 
;br 
/> 
"select ","update " or any term with a space after it. <
; 
; 
; 
; 
; 
; 
;br 
/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
 
 
 
 
 
 
/> 
Brett Moore &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
Network Intrusion Specialist, CTO <
; 
; 
; 
; 
; 
; 
;br 
/> 
Security-Assessment.com 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
 
 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
 
 
r/> 
 
 
 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
 
/> &
lt; 
br/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
To: Olivier G. Gaumond 
; 
; 
; 
; 
; 
; 
; 

; 
 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
 
> &l
t;b 
r/> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
 
/> 
on my! <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
 
/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; <
br/ 
> 
my bad :( <
 
 
 
 
 
 
br/ 
> 
 
 
 
 
 
 
/> 
Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
 
br/ 
> 
all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> 
-JC <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
 
/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
 
 
 
 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; <
br/ 
> 
> > <snip> 
 
 
 
 
 
 
r/> 
 
 
 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
> > they should send the current batch of Transact-SQL 
 
 
 
 
 
 
r/> 
 
 
 
> > statements to SQL Server. The current batch of <
 
 
 
 
 
 
br/ 
> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
; 
; 
; 

; 
 
> since &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
> > the last GO, or since the start of the ad hoc <
; 
; 
; 
; 
; 
; 
;br 
/> 
> session 
; 
; 
; 
; 
; 
; 
; 

; 
 
> > or script if this is the first GO <
 
 
 
 
 
 
br/ 
> 
> > </snip> <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
> Analyzer, but the GO <
 
 
 
 
 
 
br/ 
> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
> would not work in a 
 
 
 
 
 
r/> 
 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
> provider. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
> Olivier 
; 
; 
; 
; 
; 
; 
; 

; 
 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
; 
 
r/> 
 
name=smime.p7s <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
 
 
 
/> 
br/ <
; 
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

; 
 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
 
 
 
 
/> 
/> &
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
 
/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a &l
t;b 
r/> 
mp;a &a
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
mp;l &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
t;b <
; 
; 
; 
; 
; 
;br 
/> 
r/> 
 
 
 
 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
; 
; 
; 

; 
 
 
 
 
 
 
 
/> 
This message and any attachment(s) are confidential and proprietary. 
 
 
 
 
 
/> 
They may also be privileged or otherwise protected from disclosure. If 
 
 
 
 
 
/> 
you are not the intended recipient, advise the sender and delete this 
 
 
 
 
 
/> 
message and any attachment from your system. If you are not the 
 
 
 
 
 
/> 
intended recipient, you are not authorised to use or copy this message 
 
 
 
 
 
/> 
or attachment or disclose the contents to any other person. Views 
 
 
 
 
 
/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
 
 
 
 
/> 
Limited. Please note that this communication does not designate an 
 
 
 
 
 
/> 
information system for the purposes of the New Zealand Electronic 
 
 
 
 
 
/> 
Transactions Act 2003. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (5 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

> Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
> all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Don't be... I often use the CR/LF pairs to bypass filters 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
in SQL (against MS SQL). %0a%0d can sometimes work, but it <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
is better to send the 'raw' bytes as a post. Using a 
 
 
 
 
 
 
r/> 
 
 
 
textarea field works great for this. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
The GO statement, (from memory and what ppl are saying) 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
will not work. But this method can be used to bypass 
 
 
 
 
 
 
 
 
 
/> 
filters that remove spaces. 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
select 
 
 
 
 
 
 
 
 
 
/> 
something <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
from &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
somewhere <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
is a valid statement. <br/
 
 
 
 
 
 
 
 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Also to bypass filters that look explicitly for strings, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g &l
t;b 
r/> 
t; <
 
br/ 
> 
which is always a bad idea. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
For example if a filter looked for <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
"select ","update " or any term with a space after it. <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
Things like "exec master" etc, can also be bypassed. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Brett Moore &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
Network Intrusion Specialist, CTO <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
Security-Assessment.com 
 
 
 
 
 
 
 
 
/> 
r/> 
 
 
 
 
 
 
/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
-----Original Message----- 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
From: Juan Carlos [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
 
 
/> &
amp; 
lt; 
br/> 
Sent: Thursday, 16 December 2004 5:50 a.m. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
To: Olivier G. Gaumond 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
Cc: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
 
 
> &a
mp;l 
t;b 
r/> 
Subject: Re: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
on my! <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
you are right, this won't work with ADO for example, <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g &l
t;b 
r/> 
t; <
 
br/ 
> 
my bad :( <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Thanks and sorry for sending a not so tested POC to <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
all of you. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
-JC <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
--- "Olivier G. Gaumond" <olig (at) monimap (dot) com [email concealed]> escribió: &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
lt; <
; 
;br 
/> 
br/> 
; 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
> Juan Carlos Calderon wrote: 
 
 
 
 
 
 
 
 
 
/> 
> > Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g &l
t;b 
r/> 
t; <
 
br/ 
> 
> > <snip> 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
> > SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
> > they should send the current batch of Transact-SQL 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
> > statements to SQL Server. The current batch of <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
> > statements is composed of all statements entered 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
> since &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
> > the last GO, or since the start of the ad hoc <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
> session 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
> > or script if this is the first GO <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
> > </snip> <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
> This may work in SQL Server utilities such as Query &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
> Analyzer, but the GO <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
> keyword is not part of the T-SQL language, so this &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
> would not work in a 
 
 
 
 
 
 
r/> 
 
 
 
> query sent by ADO. At least it doesn't work with &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
> the ADO.NET SqlClient <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
> provider. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
> Olivier 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
> ATTACHMENT part 2 application/x-pkcs7-signature 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
; 
 
r/> 
 
; 
 
 
r/> 
 
name=smime.p7s <
; 
; 
; 
; 
; 
; 
; 

; 
 
;br <
; 
;br 
/> 
/> &
amp; 
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
 
 
 
/> 
 
 
 
 
/> 
br/ <
; 
; 
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
Visítanos en http://noticias.espanol.yahoo.com 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
/> &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
######################################################################&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a &l
t;b 
r/> 
mp;a &a
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
mp;a &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
mp;l &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
t;b <
; 
; 
; 
; 
; 
; 
;br 
/> 
r/> 
 
 
 
 
 
 
 
 
CONFIDENTIALITY NOTICE: 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
This message and any attachment(s) are confidential and proprietary. 
 
 
 
 
 
 
/> &
lt; 
br/> 
They may also be privileged or otherwise protected from disclosure. If 
 
 
 
 
 
 
/> &
lt; 
br/> 
you are not the intended recipient, advise the sender and delete this 
 
 
 
 
 
 
/> &
lt; 
br/> 
message and any attachment from your system. If you are not the 
 
 
 
 
 
 
/> &
lt; 
br/> 
intended recipient, you are not authorised to use or copy this message 
 
 
 
 
 
 
/> &
lt; 
br/> 
or attachment or disclose the contents to any other person. Views 
 
 
 
 
 
 
/> &
lt; 
br/> 
expressed are not necessarily endorsed by Security-Assessment.com 
 
 
 
 
 
 
/> &
lt; 
br/> 
Limited. Please note that this communication does not designate an 
 
 
 
 
 
 
/> &
lt; 
br/> 
information system for the purposes of the New Zealand Electronic 
 
 
 
 
 
 
/> &
lt; 
br/> 
Transactions Act 2003. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
######################################################################

[ reply ]

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 29 2004 04:04PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: Fwd: PHP Easter Eggs Nov 29 2004 03:43PM
Astarna (mailing astarna com)