full-disclosure - Antitoxin for "SQL Injection" (?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon Jan  2 12:45:25 2006
From: asen-public at sage.de (Sen, Adem)
Subject: Antitoxin for "SQL Injection" (?)

Hi @all!

I have invested some time to think about detecting & preventing SQL
Injection attacks to web-applications.
Like many of us know, there are several methods to filter dangerous
input in web-applications, e.g. searching for specific RegEx Pattern and
so on.

I have built following (primitive) RegEx Pattern to filter input to my
private used web-apps:

RegEx Start
/SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX
EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i";
/RegEx End

But it sucks, that I have to validate all incoming input on every
request. This is time consuming and makes it not easier to write
well-apps, even with general routines to proof all incoming Data from
GET / POST and so on.

But what would happen, if a web-app injects some code / chars in a
specific scheme into an incoming input, to DESTROY a possible SQL
Injection attack - Like an antitoxin, that neutralizes a virus? I know,
this is very abstract, let's try an example to show what I mean:

Example, incoming SQL Injection Code before "injecting antitoxin":  
Code start 
Select * from Customer where customeriID = ''; DROP DATABASE CustomerDB
--
/Code End

NOTE: SQL Injection Code starts with '; DROP ....

Now, if I inject my so called antitoxin in form of a CHAR (e.g. ASCII
255) that is placed between every second CHAR in the input String, my
SQL-Server doesn't execute any arbitrary SQL Code - so now "SQL
Injection" will NOT be possible:

Example, incoming SQL Injection Code after "injecting antitoxin", using
ASCII 255 (Looks like Space but isn't one) - I will use "#" for
indicating ASCII 255 inthis example, to differ from SPACE ASCII 20:

Code start 
Select * from Customer where customeriID = '#'#;#D#R#O#P D#A#T#A#B#A#S#E
C#u#s#t#o#m#e#rD#B# -#-
/Code End

With this method; I was not able to inject any arbitrary SQL-Code, that
was actually executed, the worst case ends in getting some SQL-Errors,
which will be caught by my Exception handlers! :-)

So, if you have to output the "antitoxed string", you just have to
automatically remove ASCII 255 from all you output, to get well formed
text, and voila! 

This helped me a lot and I want to know, what you think about this?

Thanks!

Regards,

Adem Sen

IT-Security Specialist
Sage Software GmbH & Co. KG
________________________________________________________
Sage Software GmbH & Co. KG, Berner Str. 23, 60437 Frankfurt - Germany
E-Mail: asen-public@...#OVETHIS.de
Internet: www.sage.de
________________________________________________________