SQL Injection Attacks and Defense - 2009

Summary
Testing for SQL Injection • Chapter 2 91
The first step for successful SQL injection exploitation is to find the vulnerable piece of code
which will allow you to perform the injection. In this chapter, I covered the process of finding
SQL injection vulnerabilities from a black-box perspective, explaining the steps that you need
to take.
Web applications are an example of client/server architecture where the browser is the
client and the Web application is the server. You learned how you can manipulate the data
sent from the browser to the server in order to trigger SQL errors and identify vulnerabilities.
Depending on the Web application and the amount of information leaked, the process of
identifying a vulnerability varies in complexity. In some scenarios, the application responds to
the Web request with the error returned from the database. However, there are scenarios
where you will need to pay attention to details to identify the vulnerability.
Once you trigger a vulnerability and you have evidence that you can inject SQL code
using the Web application input, you need to craft an SQL snippet that will become a syntactically
correct statement. There are several techniques for doing this, including injecting the
code inline where all of the code of the original statement is executed, and commenting parts
of the query to avoid execution of the full statement. The success of this phase will prepare
you for further exploitation.
A number of commercial and free tools automate the process of finding SQL injection
vulnerabilities. Although they are all able to detect simple vulnerabilities where the application
returns a standard SQL error, they provide varying degrees of accuracy when it comes to
other scenarios such as custom errors. Additionally, the free tools generally focus on testing
only GET requests, leaving the remaining POST requests untested.
Solutions Fast Track
Finding SQL Injection
˛˛ There are three key aspects for finding SQL injection vulnerabilities: 1) identifying
the data entry accepted by the application, 2) modifying the value of the entry
including hazardous strings, and 3) detecting the anomalies returned by the server.
˛˛ Manipulation tools acting as a Web proxy help to bypass client-side restrictions,
providing full control of the requests sent to servers. Additionally, they offer greater
visibility of the response from the server, providing greater chances of detecting
subtle vulnerabilities that could remain undetected if visualized in the Web browser.
˛˛ A response of the server which includes a database error or that is an HTTP error
code usually eases the identification of the existence of an SQL injection