SQL Injection Attacks and Defense - 2009

Time Delays
Testing for SQL Injection • Chapter 2 79
When testing applications for SQL injection vulnerabilities you will often find yourself with
a potential vulnerability that is difficult to confirm. This can be due to a number of reasons,
but mainly because the Web application is not showing any errors and because you cannot
retrieve any data.
In this kind of situation, it is useful to inject database time delays and check whether the
response from the server has also been delayed. Time delays are a very powerful technique as
the Web server can hide errors or data, but cannot avoid waiting for the database to return a
result, and therefore you can confirm the existence of SQL injection. This technique is
especially useful in blind injection scenarios.
Microsoft SQL servers have a built-in command to introduce delays to queries:
WAITFOR DELAY ‘hours:minutes:seconds’. For example, the following request to the Victim
Inc. Web server takes around five seconds:
http://www.victim.com/basket.aspx?uid=45; waitfor delay '0:0:5';--
The delay in the response from the server assures us that we are injecting SQL code into
the back-end database.
MySQL databases don’t have an equivalent to the WAITFOR DELAY command.
However, it is possible to introduce a delay using functions which take a long time to operate.
The BENCHMARK function is a good option. The MySQL BENCHMARK function
executes an expression a number of times. It is used to evaluate the speed of MySQL
executing expressions. The amount of time required by the database varies depending on
the workload of the server and the computing resources; however, provided the delay is
noticeable, this technique can be used for identification of vulnerabilities. Let’s have a look
at the following example:
mysql> SELECT BENCHMARK(10000000,ENCODE('hello','mom'));
+-----------------------------------------------+
| BENCHMARK(10000000,ENCODE('hello','mom')) |
+-----------------------------------------------+
| 0 |
+-----------------------------------------------+
1 row in set (3.65 sec)
It took 3.65 seconds to execute the query, and therefore if we inject this code into an
SQL injection vulnerability it will delay the response from the server. If we want to delay
the response further, we just need to increment the number of iterations. Here is an
example:
http://www.victim.com/display.php?id=32; SELECT
BENCHMARK(10000000,ENCODE('hello','mom'));--