[Boomslang]

Hello HC!
Today, I'll introduce you the SQL Column Truncation vulnerability in this thread.
I hope you enjoy it!

Introduction
This vulnerability is a variation of buffer overflow which is applied to SQL queries.
In MySQL, when you're creating a table you can also determine the size of each column.
When your input exceed its column size, your input will be cropped up to maximum size.

If your column length is (for example) 5 bytes, then this input;

Code:

abcdefghijkl

will be cut down into this;

Code:

abcde

Now lets see how it can be exploited.

Exploitation
Assume there is a registration form in a website and somehow you know the admin's user name (ex: admin) and the column size for user name is 16 bytes.
So lets try adding another user with the username: admin.

Code:

"admin "

This one won't work because MySQL don't do comparison in binary mode (by default).
Spaces at the end of the text is ignored, so "admin " and "admin" will be accepted as same by MySQL.
But with help of Column Truncation vulnerability, we can pass thru it.

Do you remember the Schrödinger's Cat from high school physics? The cat which is both dead and alive at the same time?
Well, we will send a Schrödinger's String to the server in this case.
A string which is both equal and not equal to "admin" at the same time (you said wuut o.O).
I know this sounds weird but let me explain.

Remember, the column size is 16 bytes. So lets try sending an input like this;

Code:

"admin Schrödingers_string"

When this string is compared with "admin", it will return not equal because spaces aren't at the end of the string (and its not equal to "admin", duh!).
After that, it will be cropped up to 16 bytes and guess what will left behind?

Code:

"admin "

Also spaces at the end of the string will be ignored so..

*drum roll*

Code:

"admin"

Voila! Here we got our second admin account

Protection
To protect from this vulnerability, you need to check the length of input at application level and be sure its sanitized before executed in a query.

I hope you liked this tutorial.

Au Revoir..

[Spirit]

Thank you for sharing this knowledge with us, @"RootTheSystem".
I really love your tutorials. They're very friendly, educational, and interactive too! You're doing a great job, so please do keep it up!

If you don't mind me asking, where did you find/hear about this vulnerability & exploitation method?

[dropzon3]

Thank you for sharing this knowledge with us, @"RootTheSystem".
I really love your tutorials. They're very friendly, educational, and interactive too! You're doing a great job, so please do keep it up!

If you don't mind me asking, where did you find/hear about this vulnerability & exploitation method?

I'm not RTS so I can't speak for where he heard about it. That said the vulnerability really came to light with CVE-2008-4106 (http://web.nvd.nist.gov/view/vuln/detail...-2008-4106) which was a Wordpress vuln involving creating a duplicate admin account.

http://www.securityfocus.com/archive/1/a...0/threaded Is a good writeup on that CVE.

You'll find better information googling about Column Truncation attacks. Its certainly an interesting vector and in this case simply setting the DB up appropriately (Username column flagged as 'unique') would have prevented the attack by letting the database do the work of ensuring uniqueness.

[Boomslang]

Thank you for sharing this knowledge with us, @"RootTheSystem".
I really love your tutorials. They're very friendly, educational, and interactive too! You're doing a great job, so please do keep it up!

If you don't mind me asking, where did you find/hear about this vulnerability & exploitation method?

I read it on a CEH document. I could give a link but its written in Turkish so that wouldn't help much I guess

@dropzon3 I didn't know its called Truncation I'll fix the title right away. Thanks for informing