search

intruxxer / zaproxy

Automatically exported from code.google.com/p/zaproxy
0 stars 0 forks source link

Fuzzer - Buffer Overflow stops because of java.sql.SQLDataException: data exception: string data, right truncation #550

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Select a request in the history
2. Highlight a parameter to fuzz (a one that you know it won't crash the target)
3. Select Fuzz / Buffer Overflow / long Strings of a
4. Fuzz

It sends requests containing more and more "a" and suddenly is stops becaus ZAP 
is unable to insert sur large header in the table "history":

141791 [AWT-EventQueue-0] ERROR 
org.zaproxy.zap.extension.fuzz.impl.http.HttpFuzzerContentPanel  - data 
exception: string data, right truncation
java.sql.SQLDataException: data exception: string data, right truncation
    at org.hsqldb.jdbc.Util.sqlException(Unknown Source)
    at org.hsqldb.jdbc.Util.sqlException(Unknown Source)
    at org.hsqldb.jdbc.JDBCPreparedStatement.fetchResult(Unknown Source)
    at org.hsqldb.jdbc.JDBCPreparedStatement.executeUpdate(Unknown Source)
    at org.parosproxy.paros.db.TableHistory.write(TableHistory.java:254)
    at org.parosproxy.paros.db.TableHistory.write(TableHistory.java:214)
    at org.parosproxy.paros.model.HistoryReference.<init>(HistoryReference.java:138)
    at org.zaproxy.zap.extension.fuzz.impl.http.HttpFuzzerContentPanel.addFuzzResultToView(HttpFuzzerContentPanel.java:179)
    at org.zaproxy.zap.extension.fuzz.impl.http.HttpFuzzerContentPanel.access$4(HttpFuzzerContentPanel.java:177)
    at org.zaproxy.zap.extension.fuzz.impl.http.HttpFuzzerContentPanel$3.run(HttpFuzzerContentPanel.java:169)
    at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:251)
    at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:727)
    at java.awt.EventQueue.access$200(EventQueue.java:103)
    at java.awt.EventQueue$3.run(EventQueue.java:688)
    at java.awt.EventQueue$3.run(EventQueue.java:686)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:76)
    at java.awt.EventQueue.dispatchEvent(EventQueue.java:697)
    at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:242)
    at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:161)
    at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:150)
    at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:146)
    at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:138)
    at java.awt.EventDispatchThread.run(EventDispatchThread.java:91)
Caused by: org.hsqldb.HsqlException: data exception: string data, right 
truncation
    at org.hsqldb.error.Error.error(Unknown Source)
    at org.hsqldb.error.Error.error(Unknown Source)
    at org.hsqldb.types.CharacterType.castOrConvertToType(Unknown Source)
    at org.hsqldb.types.CharacterType.convertToType(Unknown Source)
    at org.hsqldb.StatementDML.getInsertData(Unknown Source)
    at org.hsqldb.StatementInsert.getResult(Unknown Source)
    at org.hsqldb.StatementDMQL.execute(Unknown Source)
    at org.hsqldb.Session.executeCompiledStatement(Unknown Source)
    at org.hsqldb.Session.execute(Unknown Source)
    ... 22 more

We should be able to inject very long strings to the target system without 
being limited by the injection framework.

Found on ZAP 2.0

Original issue reported on code.google.com by patrick....@gmail.com on 7 Mar 2013 at 5:56

GoogleCodeExporter commented 9 years ago 
Thanks for reporting the issue.

Original comment by THC...@gmail.com on 7 Mar 2013 at 12:39

GoogleCodeExporter commented 9 years ago 
r2998

Original comment by THC...@gmail.com on 27 Mar 2013 at 7:40

GoogleCodeExporter commented 9 years ago

Original comment by psii...@gmail.com on 2 Apr 2013 at 9:47

GoogleCodeExporter commented 9 years ago 
Fixed in 2.1.0

Original comment by psii...@gmail.com on 18 Apr 2013 at 9:49