SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 159
Regarding Oracle, you can achieve the same effect (although less reliably) by generating
an HTTP request to a “dead” Internet Protocol (IP) address, using UTL_HTTP or
HTTPURITYPE. If you specify an IP address where no one is listening, the following
queries will wait for the connection attempt to time out:
select utl_http.request ('http://10.0.0.1/') from dual;
select HTTPURITYPE( 'http://10.0.0.1/').getclob() from dual;
An alternative to using the network timing approach is to use a simple Cartesian product.
A count(∗) on four tables takes much more time than returning a number. The following
query returns a number after counting all rows in a Cartesian product (which could become
really big and time-intensive) if the first character of the username is A:
SELECT decode(substr(user,1,1),'A',(select count(*) from
all_objects,all_objects,all_objects,all_objects),0)
Easy, isn’t it? Well, keep reading, because things are going to get even more interesting.
Approach 2: Error-based
The time-based approach is extremely flexible, and it is guaranteed to work in very
difficult scenarios because it uniquely relies on timing and not on the application output.
For this reason, it is very useful in pure-blind scenarios, which we will analyze in depth in
Chapter 5.
However, it is not suited to extracting more than a few bits of information. Assuming
that each bit has the same probability of being 1 or 0, and assuming that we used five
seconds as the parameter to WAITFOR, each query would take an average of 2.5 seconds
(plus any additional network delay) to return, making the process painstakingly slow. You could
reduce the parameter passed to WAITFOR, but that would likely introduce errors. Luckily,
we have in our bag other techniques that will trigger different responses depending on the
value of the bit that we are looking for. Take a look at the following query:
http://www.victim.com/products.asp?id=12/is_srvrolemember('sysadmin')
is_srvrolemember( ) is an SQL Server T-SQL function that returns the following values:
■■
■■
■■
1 if the user is part of the specified group
0 if it is not part of the group
NULL if the specified group does not exist
If our user belongs to the sysadmin group, the id parameter will be equal to 12/1, which
is equal to 12, and the application will therefore return the old page describing the Syngress
book. However, if the current user is not a member of sysadmin, the id parameter will have
the value 12/0, which is obviously not a number. This will make the query fail, and the
application will return an error. The exact error message can obviously vary a lot: It could be