SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 151
5. Try with ORDER BY 13, which does not return an error. This is the correct
number of columns.
You therefore have used five requests instead of 13. For readers who like mathematical
expressions, a binary search to retrieve a value n from the database needs O(log(n)) connections.
A second good reason to use the ORDER BY method is the fact that it has a far smaller footprint,
because it will usually leave far fewer errors on the database logs.
Matching Data Types
Once you have identified the exact number of columns, it’s time to choose one or more of
them to visualize the data you are looking for. However, as was mentioned earlier, the data
types of the corresponding columns must be of a compatible type. Therefore, assuming that
you are interested in extracting a string value (e.g., the current database user), you need to
find at least one column that has a string as the data type, to use that column to store the data
you are looking for. This is simple to do with NULLs, as you only need to substitute, one
column at a time, one NULL with a sample string. So, for instance, if you found that the
original query has four columns, you should try the following URLs:
http://www.victim.com/products.asp?id=12+union+select+'test',NULL,NULL,NULL
http://www.victim.com/products.asp?id=12+union+select+NULL,'test',NULL,NULL
http://www.victim.com/products.asp?id=12+union+select+NULL,NULL,'test',NULL
http://www.victim.com/products.asp?id=12+union+select+NULL,NULL,NULL,'test'
Tip
For databases where using NULL is not possible (such as Oracle 8i), the only
way to derive this information is through brute-force guessing. This approach
can be very time-consuming, as each combination of possible data types must
be tried, and is therefore practical with only small numbers of columns. One
tool that can help automate this type of column guessing is Unibrute, which
is available at www.justinclarke.com/security/unibrute.py.
As soon as the application does not return an error, you will know that the column you
just used to store the test value can hold a string, and that it therefore can be used to display
your data. For instance, if the second column can contain a string field, and assuming that you
want to obtain the name of the current user, you can simply request the following URL:
http://www.victim.com/products.asp?id=12+union+select+NULL,system_user,NULL,
NULL
Such a query will result in a screenshot similar to the one in Figure 4.4.