SQL Injection Attacks and Defense - 2009

162 Chapter 4 • Exploiting SQL Injection
user to retrieve all the products that are produced by a certain brand, and that this function
is called via the following URL:
http://www.victim.com/search.asp?brand=acme
This URL, when called, performs the following query in the back-end database:
SELECT * FROM products WHERE brand = 'acme'
What happens if we slightly modify the brand parameter? Let’s say we substitute the m
with an l. The resultant URL will be the following:
http://www.victim.com/search.asp?brand=acle
This URL will likely return something very different; probably an empty result set, or in
any case a very different one.
Whatever the exact result of the second URL is, if the brand parameter is injectable, it is
easy to extract data by playing a bit with string concatenation. Let’s analyze the process step
by step. The string to be passed as a parameter can obviously be split into two parts:
http://www.victim.com/search.asp?brand=acm'%2B'e
Because %2B is the URL-encoded version of the plus sign, the resultant query
(for Microsoft SQL Server) will be the following:
SELECT * FROM products WHERE brand = 'acm'+'e'
This query is obviously equivalent to the previous one, and therefore the resultant
HTML page will not vary. We can push this one step further, and split the parameter into
three parts instead of two:
http://www.victim.com/search.asp?brand=ac'%2B'm'%2B'e
Now, the character m in T-SQL can be expressed with the char() function, which takes a
number as a parameter and returns the corresponding ASCII character. Because the ASCII
value of m is 109 (or 0x6D in hexadecimal), we can further modify the URL as follows:
http://www.victim.com/search.asp?brand=ac'%2Bchar(109)%2B'e
The resultant query will therefore become:
SELECT * FROM products WHERE brand = 'ac'+char(109)+'e'
Again, the query will still return the same results, but this time we have a numeric
parameter that we can play with, so we can easily replicate what we saw in the previous
section by submitting the following request:
http://www.victim.com/search.asp?brand=ac'%2Bchar(108%2B(case+when+
(system_user+=+'sa')+then+1+else+0+end)%2B'e
It looks a bit complicated now, but let’s see what is going on in the resultant query:
SELECT * FROM products WHERE brand = 'ac'+char(108+(case
when+(system_user='sa') then 1 else 0 end) + 'e'