2KKUU7ita

288
Part V: Hacking Applications
The web application might respond in a way that gives attackers more information
than they want, such as detailed errors or access into data fields
they’re not authorized to access. The invalid input might also cause the
application or the server to hang. Similar to the case study earlier in the
chapter, hackers can use this information to determine more about the web
application and its inner workings, which can ultimately lead to a serious
system compromise.
If HTTP variables are passed in the URL and are easily accessible, it’s only a
matter of time before someone exploits your web application.
I once used a web application to manage some personal information that did
just this. Because a “name” parameter was part of the URL, anyone could
gain access to other people’s personal information by changing the “name”
value. For example, if the URL included “name=kbeaver”, a simple change
to “name=jsmith” would bring up J. Smith’s home address, Social Security
number, and so on. Ouch. I alerted the system administrator to this vulnerability.
After a few minutes of denial, he agreed that it was indeed a problem
and proceeded to work with the developers to fix it.
Code injection can also be carried out against back-end SQL databases — an
attack known as SQL injection. Malicious attackers insert SQL statements,
such as CONNECT, SELECT, and UNION, into URL requests to attempt to connect
and extract information from the SQL database that the web application
interacts with. SQL injection is made possible by applications not properly
validating input combined with informative errors returned from database
servers and web servers.
Two general types of SQL injection are standard (also called error-based)
and blind. Error-based SQL injection is exploited based on error messages
returned from the application when invalid information is input into the
system. Blind SQL injection happens when error messages are disabled,
requiring the hacker or automated tool to guess what the database is returning
and how it’s responding to injection attacks.
There’s a quick, fairly reliable way to determine whether your web application
is vulnerable to SQL injection. Simply enter a single apostrophe (’) in
your web form fields or at the end of the URL. If a SQL error is returned, odds
are good that SQL injection is present. You’re definitely going to get what you
pay for when it comes to scanning for and uncovering SQL injection with a
web vulnerability scanner. As with URL manipulation, you’re much better off
running a web vulnerability scanner to check for SQL injection. Figure 14-4
shows numerous SQL injection vulnerabilities discovered by the WebInspect
vulnerability scanner.