dstergiou

dstergiou

Hello,

first of all i apologize if this is a very basic question, but i only started playing with Elixir last week, and my knowledge of Elixir and Phoenix is minimal.

I am creating a webapp based on Elixir / Phoenix that is on purpose vulnerable to several web attacks. What i am trying to achieve now is a basic SQL Injection, but it seems that Phoenix is using parameterized queries which makes it impossible to have an SQL injection.

The code so far looks like this:

content = Ecto.Adapters.SQL.query!(
          MyApp.Repo, "SELECT name,data from contents WHERE name=$1", [params["name"]]
       )

If i execute the code with a typical SQL injection string like ' OR '1' = ‘1then Phoenix replies with:

SELECT name,data from contents WHERE name=$1 [“’ OR ‘1’ = ‘1”]

If i execute the code with some valid name, then i see this:

SELECT name,data from contents WHERE name=$1 [“Per”]
[[“Per”, “This is a test”]]

Which is what i would expect from this query.
So, my question is, is there a way to write the query code to make this SQL injection viable?

In Python, it was as simple as:

if request.method == 'POST':
        input = request.POST.get('input')
        query = "SELECT * from levels_content WHERE name = '%s'" % input
        result = Content.objects.raw(query)

Again apologies if this is a very basic question, and thanks in advance for the help

Showing Posts 1 to 4

darkmarmot

darkmarmot

You probably want to drop down to a lower level library like :postgrex so that you can create injectable queries by hand?

dstergiou

dstergiou OP

Hey,

i checked here: Postgrex — Postgrex v0.22.2 for query/4 and it seems that passing attributes as parameters is mandatory - at least this is what i understand from this example:

Postgrex.query(conn, "SELECT id FROM posts WHERE title like $1", ["%my%"])

Ideally i would like to do some string interpolation, and end up with something like:
Postgrex.query(conn, "SELECT id FROM posts WHERE title like #{input}")

input being what i received from the HTML form

hauleth

hauleth

You can do the same using Ecto itself:

MyApp.Repo.query("SELECT id FROM posts WHERE title like #{input}", [])
dstergiou

dstergiou OP

Thanks, that did the trick, here is the final line:

    name = params["name"]
    content = Ecto.Adapters.SQL.query!(
      ElixirTrustlyctf.Repo, "SELECT name,data from contents WHERE name=\'#{name}\'", []
    )

Cheers

— All posts loaded —

Where Next? Top

Trending in Questions Top

stjefim
Hello! Suppose you are building workflow (order / task / payment) processing system with the following requirements: Each workflow con...
New
Blokh
Hey guys, I’ve got a huge CSV ( around 10 GB ) that needs to be processed hourly Do you guys have any suggestions what is the best prac...
New
roeland
Kia ora, We have been using elixir-google-api to connect to Google Drive. However, with the updates to Tesla due to CVEs this is now bro...
New
kszambelanczyk
Hello! Could someone please give me a help/sample code, how to delete a file from s3 using waffle/waffle_ecto from Phoenix app. I creat...
New
Onor.io
I have what I’ve heard referred to as a “lookup table” in my database. This is a way of assigning codes to common values. One common lo...
New
jaybe78
Hello, I’m developing a online persistent chat system (what’s app) like using elixir/dynamodb/aws for a mobile app(flutter). The diffic...
New
Trolleger
What approach to take when sending live updates to “random” users Hi! I have a question, I have a little chat app, and when I create a DM...
New

Other Trending Topics Top

garrison
Hobbes is a low-level distributed database for the Elixir programming language. Hobbes provides a simple, safe, and scalable storage lay...
New
mcass19
ExRatatui lets you cook up rich terminal UIs in Elixir, powered by Rust’s ratatui via Rustler NIFs. Build interactive terminal applicatio...
New
Damirados
Hello everyone. After busy few months I am happy to announce v0.1.0 of Emerge & Solve. They are GUI (Emerge) and State management (S...
New
netoum
Corex is an accessible, unstyled UI component library for Phoenix that integrates Zag.js state machines using Vanilla JavaScript and Live...
New
wintermeyer
There are three potential reasons for members of this forum to have a look at https://vutuv.de You are tired or annoyed of LinkedIn. Yo...
New
aseigo
ICal is a library for interacting with iCalendar data. It parses iCalendars into typed Elixir structs via ICal.from_ics, and can prepare ...
New

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews