SQL Injection Attacks and Defense - 2009

152 Chapter 4 • Exploiting SQL Injection
Figure 4.4 Example of a Successful UNION-based SQL Injection
Success! As you can see, the table now contains a new row that contains the data you
were looking for! Also, you can easily generalize this attack to extract entire databases one
piece at a time, as you will see shortly. However, before moving on, another couple of tricks
need to illustrated that can be useful when using UNION to extract data. In the preceding
case, we have four different columns that we can play with: Two of them contain a string and
two of them contain an integer. In such a scenario, you could therefore use multiple columns
to extract data. For instance, the following URL would retrieve both the name of the current
user and the name of the current database:
http://www.victim.com/products.asp?id=12+union+select+NULL,system_user,
db_name(),NULL
However, you might not be so lucky, because you could have only one column that can
contain the data you are interested in, and several pieces of data to extract. Obviously, you
could simply perform one request for each piece of information, but luckily we have a better
(and faster) alternative. Take a look at the following query, which uses the concatenation
operator for SQL Server (refer to Table 4.2 earlier in the chapter for concatenation operators
for other DBMS platforms):
SELECT NULL, system_user + ' | ' + db_name(), NULL, NULL
This query concatenates the values of system_user and db_name() (with an extra “|” character
in between to improve readability) into one column, and translates into the following URL: