Re: Simple to exploit SQL Injection ?

just a by-the-by...
although not a successful SQL injection attack, the error message you're
receiving as a public user already tell you a little about their database...
Probably not too much to go with, but a better exception message would have
been:
"Invalid credentials" or something equally generic and less revealing.
so probably also be on the lookout for other places where more information 
is displayed than usual..
other famous .Net parser and other jit compile errors tell u quite a bit 
about the filesystem :)


----- Original Message ----- 
From: "Jason binger" <cisspstudy@yahoo.com>
To: <webappsec@securityfocus.com>
Sent: Monday, November 28, 2005 2:49 AM
Subject: Simple to exploit SQL Injection ?


I am reviewing a .Net web application. When entering
xyz for a username and ' for a password into a form I
receive the following stack trace (extract):

System.Exception: Can't Load DataReader using SQL
string: 'SELECT * FROM users WHERE username = 'xyz'
AND password = '''' -- Unclosed quotation mark before
the character string '''. Line 1: Incorrect syntax
near '''.

Now I would have thought this would be easy to
exploit, but I can't bypass the logon page. xyz is a
valid username. Any ideas?

Cheers




__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com




--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.362 / Virus Database: 267.13.8/184 - Release Date: 27-Nov-05