SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 157
David Litchfield and Chris Anley have extensively researched and developed this concept,
and have authored several white papers on the topic. The general idea is to force the database
to behave in different ways and return a different result depending on the specified condition.
Such a condition could be the value of a specific bit of a specific byte of data (which we’ll
explore in more detail in Chapter 5), but in the initial attack stages it usually deals with the
configuration of the database. To begin with, however, let’s see how the same basic conditional
statement translates in the syntax of the different DBMS technologies in Table 4.6.
Table 4.6 Conditional Statements
Database Server
Query
Microsoft SQL Server IF ('a'='a') SELECT 1 ELSE SELECT 2
MySQL SELECT IF('a', 1, 2)
Oracle SELECT CASE WHEN 'a' = 'a' THEN 1 ELSE 2
END FROM DUAL
SELECT decode(substr(user,1,1),'A',1,2) FROM DUAL
Approach 1: Time-based
A first possible approach in exploiting an SQL injection using conditional statements is
based on different times that a Web application takes to respond, depending on the value of
some piece of information. On SQL Server, for instance, one of the first things you might
want to know is whether the user performing the queries is the system administrator
account, sa. This is obviously important, because depending on your privileges you will be
able to perform different actions on the remote database. Therefore, you can inject the
following query:
IF (system_user = 'sa') WAITFOR DELAY '0:0:5' --
which translates into the following URL:
http://www.victim.com/products.asp?id=12;if+(system_user='sa')+WAITFOR+DELAY
+'0:0:5'--
What happens here? system_user is simply a Transact-SQL (T-SQL) function that returns
the current login name (e.g., sa). Depending on the value of system_user, the query will execute
WAITFOR (and will wait five seconds). By measuring the time it takes for the application to
return the HTML page, you can determine whether you are sa. The two hyphens at the end of
the query are used to comment out any spurious SQL code that might be present from the
original query and that might interfere with your code.