SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 163
Depending on whether the current user is sa or not, the argument of char( ) will be 109
or 108, respectively, returning therefore m or l. In the former case, the string resulting from
the first concatenation will be acme, whereas in the second it will be acle. Therefore, if the
user is sa the last URL is equivalent to the following:
http://www.victim.com/search.asp?brand=acme
Otherwise, the URL will be equivalent to the following:
http://www.victim.com/search.asp?brand=acle
Because the two pages return different results, here we have a safe method for extracting
data using conditional statements for string parameters as well.
Extending the Attack
The examples we’ve covered so far are focused on retrieving pieces of information that can
have only two possible values—for example, whether the user is the database administrator
or not. However, you can easily extend this technique to arbitrary data. Obviously, because
conditional statements by definition can retrieve only one bit of information (as they can
infer only whether a condition is true or false), you will need as many connections as the
number of bits composing the data in which you are interested. As an example let’s return to
the user who performs the queries. Instead of limiting ourselves to check whether the user is
sa, let’s retrieve the user’s whole name. The first thing to do is to discover the length of the
username. You can do that using the following query:
select len(system_user)
Assuming that the username is appdbuser, this query will return the value 9. To extract
this value using conditional statements, you need to perform a binary search. Assuming that
you use the error-based method that was illustrated a few pages ago, the following URLs
will be sent:
http://www.victim.com/products.asp?id=10/(case+when+(len(system_user)+>+8)+
then+1+else+0+end)
Because our username is longer than 8 characters, this URL will not generate an error.
We continue with our binary search with the following queries:
http://www.victim.com/products.asp?id=12/(case+when+(len(system_user)+>+16)+
then+1+else+0+end) ---> Error
http://www.victim.com/products.asp?id=12/(case+when+(len(system_user)+>+12)+
then+1+else+0+end) ---> Error
http://www.victim.com/products.asp?id=12/(case+when+(len(system_user)+>+10)+
then+1+else+0+end) ---> Error
http://www.victim.com/products.asp?id=12/(case+when+(len(system_user)+>+9)+
then+1+else+0+end) ---> Error