Comments injected into an application through input can be used to compromise a system. As data is parsed, an injected/malformed comment may cause the process to take unexpected actions that result in an attack.
Examples
The attacker may conduct this kind of attack with different programming or scripting languages:
Database:
If the attacker has the ability to manipulate queries which are sent to the database, then they’re able to inject a terminating character too. The aftermath is that the interpretation of the query will be stopped at the terminating character: SELECT body FROM items WHERE id = $ID limit 1;
Let’s assume that the attacker has sent via the GET method the following data stored in variable $ID: "1 or 1=1; #"
In the end the final query form is: SELECT body FROM items WHERE id = 1 or 1=1; # limit 1;
After the # character everything will be discarded by the database including limit 1, so only the last column body with all its records will be received as a query response.
Sequences that may be used to comment queries:
- MySQL:
#,-- - MS SQL:
-- - MS Access:
%00(hack!) - Oracle:
--
Null byte:
To comment out some parts of the queries, the attacker may use the standard sequences, typical for a given language, or terminate the queries using their own methods being limited only by their imagination. An interesting example is a null byte method used to comment out everything after the current query in MS Access databases. More information about this can be found in Embedding Null Code .
Shell:
Shell (bash) also has the character #, which terminates interpretation.
For example (find.php):
<?
$ =sth $_GET['what];
system("/usr/bin/find -name '$sth' -type f");
?>
Using /find.php?what=*'%20%23* the attacker will bypass limitation *-type f* and this command:
/usr/bin/find -name '*' -type f
will become:
/usr/bin/find -name '*' #-type f
So the final form of the command is:
/usr/bin/find -name '*'
HTML (injection):
If there are no restrictions about who is able to insert comments, then using the start comment tags:
<!--
it’s possible to comment out the rest of displayed content on the website (invisible.php)
<?php
print "hello!: ";
print $_GET['user'];
print " Welcome friend!";
?>
After:
GET /invisible.php?user=<!--
There result will be:
hello!:
