Looking for an explanation of this attempted SQL injection query

user_2453542 0
Viewed 66

Looking through my logs I found the following query string as an attempt to perform a SQL injection, probably from an automated tool:

(select*from(select+sleep(10)union/**/select+1)a)

From what I can tell, it’s attempting a timing based attack to see if any of the tables in my database start with “a” - the sleep function will only run if the union query matches something? But I am a bit confused about other parts of the attack:

  • Why are there plus signs between parts of the query?
  • Why is there a comment as part of the query string?

Would be interested in any answers - I’m fairly certain my site hasn’t been compromised as I haven’t scanned further activity on that query and can’t get it to execute myself, so just wondering if my intuition was correct. Cheers!

sql-injection postgresql sql
3 Answers

I don't know what the point of this is, nor what the point is of trying to figure out the point. Injections are easier to block than to reverse engineer, and the latter doesn't contribute much to the former.

The point of the + and the /**/ are probably pretty much the same, they separate tokens without the use of whitespace. Presumably someone thinks whitespace is going to trigger some kind of alarm or blockage.

The 'a' is just an alias, and is probably there to avoid the error 'ERROR: subquery in FROM must have an alias'

This won't work in stock PostgreSQL because there is no function spelled sleep. They might be targeting a different DBMS, or maybe PostgreSQL with a specific app/framework in use which creates its own sleep function.

The sleep is probably there in case the system doesn't return meaningful messages to the end user. If it takes 10 seconds to get a response, then you know the sleep got executed. If it immediately returns, you know it didn't execute, but don't know why it didn't.

user_17212390

This is meant to detect a SQL injection (probably through an HTML parameter) via a timing attack. The inserted comments (as other people have mentioned) are meant to remove whitespace while still allowing the query to parse in an attempt to fool custom (badly designed) sanitization. The "+" is likely meant to be decoded into a space after passing through HTML decoding.

If you replace the whitespace and add indentation it's easier to see what's going on:

select *           <-- match any number of columns on the original query
from               
(select            <-- nested sub-query in the from clause
 sleep(10)         <-- timing attack meant to detect whether the SQL ran 
 union             <-- not sure why the union is needed 
 select 1) a       <-- alias the subquery to "a"
)                  <-- close off matching parens in injected SQL?
user_71840010

I don't think this is attempting to look for tables that start with a, simply run a sleep on a possible recursive query, which could cause your database trouble, if a bunch of them execute.

The + signs are likely an attempt to do some string concatenation... That would be my guess

Regardless I would strongly look at tracing back where this originated from and sanitizing your inputs on your site so raw inputs ( potential sql ) is not being dropped into queries.

user_7829380
Related