SQL Injection Attacks and Defense - 2009

92 Chapter 2 • Testing for SQL Injection
vulnerability. However, blind SQL injection is something that can also be exploited,
even if the application doesn’t return an obvious error.
Confirming SQL Injection
˛˛ To confirm an SQL injection vulnerability and in prevision for later exploitation
you need to craft a request that injects SQL code such that the application creates a
syntactically correct SQL statement that is in turn executed by the database server
without returning any errors.
˛˛ When creating a syntactically correct statement you may be able to terminate it
and comment out the rest of the query. In these scenarios, and provided that the
back-end database supports multiple statements, you usually can chain arbitrary
SQL code with no restrictions, providing you with the ability to conduct attacks
such as privilege escalation.
˛˛ Sometimes the application will not reply with any visual sign of the injection
attempts. In such cases, you can confirm the injection by introducing a delay in the
reply from the database. The application server will wait for the database to reply
and you will be able to verify whether a vulnerability exists. In this scenario, you
need to be aware that network and server workloads might interfere slightly with
your delays.
Automating SQL Injection Discovery
˛˛ The processes involved in finding SQL injection vulnerabilities can be automated
to a certain extent. Automation can be very beneficial when you need to test large
Web sites; however, you need to be aware that automatic discovery tools may not
identify some of the existing vulnerabilities. Don’t rely fully on automated tools.
˛˛ Several commercial tools provide a full security assessment of a Web site, including
testing for SQL injection vulnerabilities.
˛˛ The free and open source tools offer a good alternative to aid you in the process of
finding SQL injection vulnerabilities in large sites.