SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 175
As you can see, we now know the names of the columns of the customers table. We can
guess that both login and passwords are of type string, and we can therefore return them with
yet another UNION SELECT, this time using both the Type and Description fields of the
original query. This is performed by the following URL:
http://www.victim.com/products.aspid=12+union+select+null,login,password,
null+from+e–shop..customers--
As you can see, this time we use two column names in our injected query. The result,
which finally contains the data we were looking for, is in the screenshot shown in Figure 4.14.
Figure 4.14 Finally Getting the Data: Username and Passwords, in This Case!
Bingo!! However, the result is not just a very long list of users. It seems that this application
likes to store user passwords in clear text instead of using a hashing algorithm. The same
attack sequence could be used to enumerate and retrieve any other table that the user has
access to, but having arrived at this point, you might just call the client, tell them they have a
huge problem (actually, more than just one), and call it a day.