SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 155
One URL and you have the full listing of users! Although this is great, very often you will
have to deal with applications that, although vulnerable to UNION-based SQL injection, will
show only the first row of results. In other words, the UNION query is successfully injected
and successfully executed by the back-end database which dutifully sends back all the rows,
but then the Web application (the products.asp file, in this case) will parse and visualize only
the first row. How can you exploit the vulnerability in such a case? If you are trying to extract
only one row of information, such as for the current user’s name, you need to get rid of the
original row of results. As an example, here’s the URL we used a few pages back to retrieve
the name of the database user running the queries:
http://www.victim.com/products.asp?id=12+union+select+NULL,system_user,
NULL,NULL
This URL will probably make the remote database server execute a query such as the
following:
SELECT id,type,description,price FROM products WHERE id = 12
UNION SELECT NULL,system_user,NULL,NULL
To prevent the query from returning the first row of the result (the one containing the
item details) you need to add a condition that always makes the WHERE clause false, before
injecting the UNION query. For instance, you can inject the following:
http://www.victim.com/products.asp?id=12+and+1=0+union+select+NULL,
system_user, NULL, NULL
The resultant query that is passed at the database now becomes the following:
SELECT id,type,name,price FROM e–shops..products WHERE id = 12 AND
1 = 0 UNION SELECT NULL,system_user,NULL,NULL
Because the value 1 is never equal to the value 0, the first WHERE will always be false,
the data of the product with ID 12 will not be returned, and the only row the application
will return will contain the value system_user.
With an additional trick, you can use the same technique to extract the values of entire
tables, such as the customers table, one row at a time. The first row is retrieved with the following
URL, which will remove the original row using the “1=0” inequality:
http://www.victim.com/products.asp?id=12+and+1=0+union+select+userid,
first_name,second_name,NULL+from+customers
This URL will return one line of data that will contain the first and last names of the first
customer—Charles Smith, whose user ID equals 1. To proceed with the following customer
you just need to add another condition that removes from the results the customers whose
names have been already retrieved:
http://www.victim.com/products.asp?id=12+and+1=0+union+select+userid,
first_name,second_name,NULL+from+customers+WHERE+userid+>+1