SQL Injection Attacks and Defense - 2009

164 Chapter 4 • Exploiting SQL Injection
Done! Because the (len(system_user) > 8) condition is true and the (len(system_user) > 9)
condition is false, we know that our username is nine characters long.
Now that we know the length of the username, we need to extract the characters that
compose the username. To perform this task we will cycle through the various characters,
and for each of them we will perform a binary search on the ASCII value of the letter itself.
On SQL Server, to extract a specific character and calculate its ASCII value you can use the
following expression:
ascii(substring((select system_user),1,1))
This expression retrieves the value of system_user, extracts a substring that starts from the
first character and that is exactly one character long, and calculates its decimal ASCII value.
Therefore, the following URLs will be used:
http://www.victim.com/products.asp?id=12/(case+when+(ascii(substring(select+
system_user),1,1))+>+64)+then+1+else+0+end) ---> Ok
http://www.victim.com/products.asp?id=12/(case+when+(ascii(substring(select+
system_user),1,1))+>+128)+then+1+else+0+end) ---> Error
http://www.victim.com/products.asp?id=12/(case+when+(ascii(substring(select+
system_user),1,1))+>+96)+then+1+else+0+end) ---> Ok
The binary search will continue until the character a (ASCII: 97 or 0x61) is found.
At that point, the procedure will be repeated for the second character, and so on. You can use
the same approach to extract arbitrary data from the database, but it is very easy to see that
this technique requires a large number of requests in order to extract any reasonable amount
of information. Several free tools can automate this process, but nevertheless this approach is
not recommended for extracting large amounts of data such as entire databases.
Using Errors for SQL Injection
You have already seen that in a non-blind SQL injection scenario database errors are very
helpful in providing the attacker with the information necessary to craft correct arbitrary queries.
You also discovered that, once you know how to craft correct queries, you can leverage
error messages to retrieve information from the database, by using conditional statements that
allow you to extract one bit of data at a time. However, in some cases error messages can also
be used for much faster data extraction. Earlier in the chapter, we used an error message to
disclose the SQL Server version by injecting the string @@version where a numeric value was
expected, generating an error message with the value of the @@version variable. This works
because SQL Server produces far more verbose error messages compared to other databases.
Well, this feature can be abused to extract arbitrary information from the database, and not