SQL Injection Attacks and Defense - 2009

156 Chapter 4 • Exploiting SQL Injection
This query will remove the original row (the one containing the product details) with
the and 1 =0 clause, and return the first row containing a client with a userid value of more
than 1. This will result in the response shown in Figure 4.7.
Figure 4.7 Looping through the Rows of a Table with UNION SELECT
Further increasing the value of the userid parameter will allow you to loop through the
whole table, extracting the full list of the customers of victim.com.
Using Conditional Statements
Using UNION to inject arbitrary queries is a fast and efficient method of extracting data.
However, this is not always possible; Web applications, even when they are vulnerable, are not
always willing to give their data away so easily. Fortunately, several other techniques work
equally well, albeit not always as quickly and easily. And even the most successful and spectacular
“jackpot” of an SQL injection attack, usually consisting of dumping entire databases or
obtaining interactive access to the database server, often begins by extracting pieces of data
that are far smaller than what a UNION statement can achieve. In several cases, these pieces of
data comprise just one bit of information, because they are the outcome of queries that have
only two possible answers: “Yes” or “No”. Even if such queries allow such a minimal amount
of data extraction, they are extremely powerful and are one of the deadliest exploitation
vectors available. Such queries can always be expressed in the following form:
IF condition THEN do_something ELSE do_something_else