1

I was testing efficacy of a paid Database security solution which has the ability to detect and block SQLi attack. For the testing purpose I have tried the following query against a PostgreSQL database through this tool which act as a proxy.

select * from test where id=1 or 1=1;

For this query the tool were able to detect and block. But then I tried another one

select * from test where id=1 or true;

But this time the query got infiltrated and got the full table data as result.

Isn't it a classical example of SQLi? What type of queries are actually considered as SQLi which I can test against the tool?

7
  • 1
    The typical SQL injection query contains at least four single quotes, because it works by interpolating a string between single quotes. I would be very wary of any tool that claims to recognize such queries. It will either miss some statements or report false positives or both. Dec 1, 2023 at 8:19
  • IMO, double hyphen -- somewhere in the middle of the query could be a sign of sql injection, especially if the part have been commented out contains something similar to sql, the semicolon ; could be a sign of sql injection as well. Dec 1, 2023 at 9:24
  • Why would you use statements like that and not filter/clean out user input ? If you really want to be sure then use only stored procedures for data access. Dec 1, 2023 at 13:01
  • If that is what you want to protect against, then you have already done the test and the tool failed. What more do you need to know?
    – jjanes
    Dec 1, 2023 at 22:42
  • 1
    @BasilTitus the task of proving that particular SQL query is malicious seems to be hard, for example, in your case or 1=1 looks suspicious from tool's perspective, however it fails on PostgreSQL grammar where or true is valid statement, the problem is there is a zillion of options to write "always true statement", does your tool recognise something like or exists (select * from pg_class) for example? IMO, the tool should have built-in SQL engine in order to be able to detect anomalies in SQL queries, that is definitely much simpler to develop PostgreSQL extension. Dec 6, 2023 at 3:17

1 Answer 1

0

This isn't a Sql Injection attack.
This is: (obligatory XKCD Reference) "Little Bobby Tables".

I'm not entirely sure what this is trying to protect against ...

... or 1 = 1 ...

I've seen several Management Information applications that build dynamic Sql where clauses using exactly this construct (and then appending other, 'and'ed conditions after it).

where 1 = 1 
and ... 
and ... 

Lazy coding, but quick and easy.

If Row-Based security is done properly, this wouldn't gain the attacker anyway because they would only gain access to all of the rows that they were allowed to see anyway - effectively, all SQL runs against an already-filtered dataset.

4
  • I bet the given example of sql injection query was based on SQL Injection from OWASP Dec 1, 2023 at 9:31
  • The 1 = 1; (notice the semicolon terminator) is a common pattern used with SQL injections (at least many moons ago, idk what's commonplace anymore) as a way to cleanly terminate the orginal valid SQL statement with a valid clause, so that then additional SQL statements could be injected directly after without breaking the original SQL statement from a bad syntax error, ensuring the injected commands ran successfully. I imagine whatever tool OP is using, is just blindly looking for that exact predicate, which is obviously a false positive in many cases.
    – J.D.
    Dec 1, 2023 at 13:42
  • You turn WHERE id=98356 into WHERE id=98356 or 1=1 and now you get back the entire table rather rather than the small part of it you were supposed to get back.
    – jjanes
    Dec 1, 2023 at 22:46
  • You can put 1=1 and AND together, no problem even if it's useless statement.But why would someone put or 1=1 at the end of a statement unless it's an attack, if i want full data i just query the table without where clause.
    – mediocre
    Dec 4, 2023 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.