ZAP and SQL Injection - Potential Issue

[ryerson...@gmail.com]

So every issue that ZAP has found under SQL injection seems to be time based by trying to inject some form of sleep with a timer of 5 seconds.

To me this is NOT a very useful test, especially considering that there might be some lag with network traffic. Is there any way to change the test to

SQL Injection - Hypersonic SQL - Time Based

SQL Injection - MySQL

SQL Injection - Oracle - Time Based

SQL Injection - PostgreSQL - Time Based

Even those that don't specifically list "Time Based", only try to do sleep (5)'s.  I have my thresh hold set to medium and my strength to medium.

1. Preferably, do something other than a sleep, try to retrieve actual data or
2. Have a much longer sleep, such as 20 seconds.

---

Similarly, do i just copy paste the attack into the form field on the browser to manually test when pressing submit or do i need to somehow modify the actual post request?

---

Re-sending the request to check doesn't perform authentication, isn't this an issue when trying to double check some issues that were found?

[Sarmad Butt]

I am also having same issue, only SQL injections pointed out by ZAP are time base. and when i copy those attacks and enters in the said field nothing happens application responds and work properly. 

[ryerson...@gmail.com]

Anyone able to comment on this?

[Simon Bennetts]

Yes, sorry - been on my todo list ;)

You're quite right about this problem, and we have a proposed solution.
The plan is to introduce 'rule level' configurations for things like this.
So we would have key/value pairs like timeout.default=5 which all rules which use time based attacks should change to use.
We would then allow the user to change these via the UI, command line and API.
Ideally I think we should also have another pair like timeout.validate=20 which all rules use to sanity check that the problem is real and not just a slow network issue.

We also should have some way of categorising rules that use timing checks so that users can easily disable them if they want to, eg to speed up a scan.

Any feedback on these proposals much appreciated.

Cheers,

Simon

[ryerson...@gmail.com]

Thank you for the reply! Only feedback i can suggest is that there are some injection attack's that aren't time based, as far as i can tell it always tries to sleep. If instead it tried to select a list or tables from the database that would be great.

[kingthorin+owaspzap]

Time based attacks are generally used for blind variants (Blind SQLi, Blind Command Injection, etc), so selecting a list of tables isn't an applicable test.

[ryerson...@gmail.com]

To give you more ideas of the bugs i found with SQL; here is the situation that i found.

https://my.domain.ca/myapp/choice.html?choiceid=90

What happens now is that the choiceid is stored as a session parameter (no sensitization), after which an SQL select query is uses that variable directly to retrieve information. There is nothing to check that this value is an integer, that it doesn't contain escape characters. I have manually confirmed to be able to modify the url to retrieve database data and obtain data related to a differed choiceid other than 90.

ZAP finds this in another manner, same but different but still same but still different (if you get the reference [1], a little light humor), back on track, so ZAP finds it as a Cross Site Scripting (Reflected) because it tries to inject javascript into the statement.

https://my.domain.ca/myapp/choice.html?choiceid=javascript%3Aalert%281%29%3B

I am glad that it found this (required me going to intense difficulty) but i am wondering why it didn't find the ONE intentional SQL Injection Oracle I left for it. If you have any questions, please feel free and i will try to clarify anything i can!

[1]https://www.youtube.com/watch?v=7tTfL-DtpXk

[Rajesh Bhadana]

Anyone have any idea , How to fix these issue Reported by ZAP

SQL Injection - Oracle - Time Based

Remote OS Command Injection

SQL Injection - PostgreSQL - Time Based

SQL Injection - MySQL - Time based.

Please share any information related to How these should be fix.

 

Thanks

[Simon Bennetts]

First of all you need to work out if they are real issues or false positives.
Try to reproduce the results manually and while doing that increase the number of seconds to see if the time the response increases accordingly.
The weekly ZAP release supports Rule Configurations and these allow you to increase the time used for timing attacks for all rules: https://groups.google.com/d/msg/zaproxy-develop/y-IJDZG5skk/hfS42b_VBAAJ so you could try that if you have problems reproducing them manually.

Cheers,

Simon