SQL Injection Attacks and Defense - 2009

146 Chapter 4 • Exploiting SQL Injection
Such a URL will probably be used in a query that will look something like the
following:
SELECT name,phone,email FROM people WHERE name LIKE '%smith%'
The resultant page will contain a message similar to this:
100 results founds for smith
To retrieve the database version, you can inject on the name parameter as follows:
http://www.victim.com/searchpeople.asp?name='%2B@@version%2B'
The resultant query will therefore become:
SELECT name,phone,email FROM people WHERE name LIKE '%'+@@version+'%'
This query will look for names that contain the string stored in @@version, which will
probably be zero; however, the resultant page will have all the information you are looking for:
0 results found for Microsoft SQL Server 2000 – 8.00.194 (Intel X86) Aug 6
2000 00:57:48 Copyright (c) 1988–2000 Microsoft Corporation Standard Edition
on Windows NT 5.0 (Build 2195: Service Pack 4)
You can repeat these techniques for other pieces of information that can be useful for
obtaining a more accurate fingerprint. Here are some of the most useful Microsoft SQL
Server built-in variables:
■ ■ @@version DBMS version
■ ■ @@servername Name of the server where SQL Server is installed
■ ■ @@language Name of the language that is currently used
■ ■ @@spid Process ID of the current user
Blind Fingerprint
If the application does not return the desired information directly in the response, you need
an indirect approach in order to understand the technology that is used in the back end.
Such an indirect approach is based on the subtle differences in the SQL dialects the different
DBMSs use. The most common technique leverages the differences in how the various
products concatenate strings. Let’s take the following simple query as an example:
SELECT 'somestring'
This query is valid for all major DBMSs, but if you want to split the string into two
substrings, the differences start to appear. More specifically, you can use the differences noted
in Table 4.2.