Story of SQL Injections on One Program (Bugcrowd)

Hello, this is Ahmed Ismail. Today I’m sharing my first blog — it should’ve been published about 10 months ago, but sorry, I’m lazy :D

I’m going to share the story of SQL injection on a private program on Bugcrowd. It was fun because of the different DBMSs I dealt with — Informix and IBM DB2. Let’s get started.

Blind SQL Injection

Blind SQL injection is a type of SQLi attack that asks the database true/false questions and determines the answer based on the application’s response. It’s often used when the web app shows generic error messages but hasn’t mitigated the code that’s vulnerable to SQL injection.

The finding

Let’s begin with the Informix DB. After enumerating subdomains of the target (let’s call it “REDACTED”), I reached an endpoint — after gathering subdomains and spidering — that looked like a potential SQL injection point. I threw random single and double quotes, but nothing indicated a valid SQLi. So I threw 'OR'1='1 and watched the response — and there it was!

I passed the request to sqlmap, and my sense was right: it was SQL injection. But there was a WAF to bypass to get the table names. sqlmap said it was Informix DB, so I checked a cheat sheet for Informix SQL injection on PentestMonkey and tried it manually — but it was tiring, so I used a tamper script to defeat the WAF and get the database tables. After some manual work, I used the between tamper script:

sqlmap -u "https://www.REDACTED.com/bin/image.jpeg?id=3872539053001&key=FUZZ" \
  -p id --level 5 --risk 3 --fresh-queries --random-agent --batch \
  --banner --dbs --dbms="Informix" --tamper=between \
  --drop-set-cookie --time-sec=10 --no-cast --threads=9

sqlmap got it done using tamper scripts that worked with the DBMS. I can’t reveal more info as it could disclose the vendor.

So here we bypassed the WAF using a tamper script. If there were no tamper, I could write a Python script to do it — the idea is to know the syntax of the DBMS.

It ended up being about 5 SQL injections (with the help of tamper scripts) across IBM DB2 and Informix, on endpoints including one on the main domain (search).

That was the total bounties and SQL injections for this target — a nice program.

Thank you.

./bye