WebApp Sec mailing list archives
RE: SQL Injection and MSSQL
From: "Amichai Shulman" <shulman () imperva com>
Date: Mon, 28 Jun 2004 08:31:04 +0200
There are many evasion techniques. Some of them as you mentioned are related to URL encoding and redundant UTF-8 representation. However there are more advanced techniques that are derived from the SQL language capabilities. I'd refer you to a WP we wrote on the subject recently: http://www.imperva.com/application_defense_center/white_papers/sql_injec tion_signatures_evasion.html -----Original Message----- From: lipe! [mailto:lipe () brturbo com] Sent: Saturday, June 26, 2004 12:14 PM To: webappsec () securityfocus com Subject: SQL Injection and MSSQL Hi all, With filters like "if the parameter has substring 'SELECT'" a malicious user can mask the 'select' from a request in ASP? I mean something like (that i know witch works in MySQL) "concat(char(1,2,3,4),char(5,6,7))"? MS SQL Server has anyway to mascarade the querys, like some unicode feature or string functions? I just need to know if theres anyway that i can put a select in a query without typing explicit "select". If there, why? Many thanks! ------------------------------------------------------------ Felipe Santos Andrade <lipe () brturbo com> Desenvolvedor TI/WEB Framework .NET -----------------------------------------------------------
Current thread:
- SQL Injection and MSSQL lipe! (Jun 26)
- RE: SQL Injection and MSSQL Mutallip Ablimit (Jun 28)
- <Possible follow-ups>
- RE: SQL Injection and MSSQL Amichai Shulman (Jun 28)