SQL Injection Attacks and Defense - 2009

148 Chapter 4 • Exploiting SQL Injection
1. A # character at the end of the line
2. A “-- ” sequence at the end of the line (don’t forget the space after the second
hyphen)
3. A “/*” sequence followed by a “*/” sequence, with the characters in between being
the comment
The third syntax allows further tweaking: If you add an exclamation mark followed by a
version number at the beginning of the comment, the comment will be parsed as code and
will be executed only if the version installed is greater than or equal to the version indicated
in the comment. Sounds complicated? Take a look at the following MySQL query:
SELECT 1 /*!40119 + 1*/
This query will return the following results:
■■
■■
2 if the version of MySQL is 4.01.19 or later
1 otherwise
Don’t forget that some SQL injection tools provide some level of help in terms of identifying
the remote DBMS. One of them is sqlmap (http://sqlmap.sourceforge.net), which has an
extensive database of signatures to help you in the fingerprinting task. We will cover sqlmap in
more detail at the end of this chapter.
Extracting Data
through UNION Statements
By this point, you should have a clear idea of the DBMS technology you are dealing with.
We will continue our journey across all possible SQL injection techniques with the UNION
operator which is one of the most useful tools that a database administrator has at his
disposal: You use it to combine the results of two or more SELECT statements. Its basic
syntax is as follows:
SELECT column-1,column-2,…,column-N FROM table-1
UNION
SELECT column-1,column-2,…,column-N FROM table-2
This query, once executed, will do exactly what you think: It will return a table that
includes the results returned by both SELECT statements. By default, this will include only
distinct values. If you want to include duplicate values in the resultant table, you need to
slightly modify the syntax:
SELECT column-1,column-2,…,column-N FROM table-1
UNION ALL
SELECT column-1,column-2,…,column-N FROM table-2