SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 147
Table 4.2 Inferring the DBMS Version from Strings
Database Server
Microsoft SQL Server
MySQL
Oracle
Query
SELECT 'some' + 'string'
SELECT 'some' 'string'
SELECT CONCAT('some','string')
SELECT 'some' || 'string'
SELECT CONCAT('some','string')
Therefore, if you have an injectable string parameter, you can try the different concatenation
syntaxes. Depending on which one of them returns the same result as the original
request, you can infer the remote database technology.
In case you don’t have a vulnerable string parameter available, you can perform a similar
technique for numeric parameters. More specifically, you need an SQL statement that, on a
specific technology, evaluates to a number. All of the expressions in Table 4.3 will evaluate to
an integer number on the correct database and will generate an error on all others.
Table 4.3 Inferring the DBMS Version from Numeric Functions
Database Server
Microsoft SQL Server
MySQL
Oracle
Query
@@pack_received
@@rowcount
connection_id()
last_insert_id()
row_count()
BITAND(1,1)
Finally, simply using some specific SQL construct that is peculiar to a particular dialect is
another effective technique that works very well in most situations. For instance, successfully
injecting a WAITFOR DELAY is a clear sign that Microsoft SQL Server is used on the
other side.
If you are dealing with MySQL, there is a very interesting trick that allows you to
determine its exact version. We know that comments on MySQL can be included in three
different ways: