SQL Injection Attacks and Defense - 2009

Approach 3: Content-based
Exploiting SQL Injection • Chapter 4 161
A big advantage of the error-based approach, compared to WAITFOR, is speed: Each
request returns with a result immediately, independently from the value of the bit that you
are extracting, as there are no delays involved. One disadvantage, however, is that it triggers a
lot of errors, which might not always be desirable. Luckily, it is often possible to slightly
modify the same technique to avoid the generation of errors. Let’s take the last URL and
modify it slightly:
http://www.victim.com/products.asp?id=12%2B(case+when+(system_user+=+'sa')+
then+1+else+0+end)
The only difference is that we substituted the “/” character after the parameter with
%2B, which is the URL-encoded version of “+” (we can’t simply use a “+” in the URL, as
it would be interpreted as whitespace). The value of the id parameter is therefore given by
the following formula:
id = 12 + (case when (system_user = 'sa') then 1 else 0 end)
The result is pretty straightforward. If the user performing the queries is not sa, then
id=12, and the request will be equivalent to:
http://www.victim.com/products.asp?id=12
On the other hand, if the user performing the queries is sa, then id=13 and the request
will be equivalent to:
http://www.victim.com/products.asp?id=13
Because we are talking about a product catalog, the two URLs will likely return two
different items: The first URL will still return the Syngress book, but the second might
return, say, a microwave oven. So, depending on whether the returned HTML contains the
string Syngress or the string oven, we will know whether our user is sa or not.
This technique is still as fast as the error-based one, but with the additional advantage
that no errors are triggered, making this approach a lot more elegant.
Working with Strings
You might have noticed that in the previous examples the injectable parameter was always a
number, and that we used some algebraic trick to trigger the different responses (whether
error-based or content-based). However, a lot of parameters vulnerable to SQL injection are
strings, not numbers. Luckily, you can apply the same approach to a string parameter, with
just a minor twist. Let’s assume that our e-commerce Web site has a function that allows the