SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 141
DBMSs). To improve clarity, all our examples will be based on GET requests, which will
allow us to put all the injected payloads in the URL. However, you can apply the same
techniques for POST requests by including the injected code into the request body instead
of the URL.
Tip
Remember that when using all of the following exploitation techniques, you
might need to comment out the rest of the original query to obtain syntactically
correct SQL code (e.g., by adding two hyphens, or a # character in the
case of MySQL). See Chapter 2 for more information on how to terminate
SQL queries using comments.
Using Stacked Queries
One of the elements that have a considerable impact on the ability to exploit an SQL
injection vulnerability is whether stacked queries (a sequence of multiple queries executed
in a single connection to the database) are allowed. Here is an example of an injected
stacked query, in which we call the xp_cmdshell extended procedure to execute a command:
http://www.victim.com/products.asp=id=1;exec+master..xp_cmdshell+'dir'
Being able to close the original query and append a completely new one, and leveraging
the fact that the remote database server will execute both of them in sequence, provides far
more freedom and possibilities to the attacker compared to a situation where you can only
inject code in the original query.
Unfortunately, stacked queries are not available on all DBMS platforms. Whether this is
the case depends on the remote DBMS as well as on the technology framework in use. For
instance, Microsoft SQL Server allows stacked queries when it is accessed by ASP, .NET, and
PHP, but not when it is accessed by Java. PHP also allows stacked queries when used to
access PostgreSQL, but not when used to access MySQL.
Ferruh Mavituna, a security researcher and tool author, published a table that collects
this information on his SQL Injection Cheat Sheet; see http://ferruh.mavituna.com/
sql-injection-cheatsheet-oku/.