SQL Injection Attacks and Defense - 2009

222 Chapter 5 • Blind SQL Injection Exploitation
Injecting Queries with Side Effects
Stepping toward confirmation of the vulnerability, it is generally possible to submit queries
that have side effects the attacker can observe. The oldest technique uses a timing attack to
confirm that execution of the attacker’s SQL has occurred, and it is also sometimes possible
to execute operating system commands whose output is observed by the attacker. For example,
in Microsoft SQL Server it is possible to generate a five-second pause with the following
SQL snippet:
WAITFOR DELAY '0:0:5'
Likewise, MySQL users could use the SLEEP( ) function which performs the same task
in MySQL 5.0.12 and later.
Finally, the observed output can also be in-channel. For instance, if the injected string
' AND '1'='2
is inserted into a search field and produces a different response from
' OR '1'='1
then SQL injection appears very likely. The first string introduces an always false clause
into the search query, which will return nothing, and the second string ensures that the
search query matches every row.
We covered this in more detail in Chapter 2.
Splitting and Balancing
Where generic errors or side effects are not useful, you can also try the “parameter splitting
and balancing” technique (as named by David Litchfield), which is a staple of many blind
SQL injection exploits. Splitting occurs when the legitimate input is broken up, and balancing
ensures that the resultant query does not have trailing single quotes that are unbalanced.
The basic idea is to gather legitimate request parameters and then modify them with
SQL keywords so that they are different from the original data, although functionally
equivalent when parsed by the database. By way of example, imagine that in the URL
http://www.victim.com/view_review.aspx?id=5 the value of the id parameter is inserted
into an SQL statement to form the following query:
SELECT review_content, review_author FROM reviews WHERE id=5
If you substitute 2+3 in place of 5, the input to the application will be different from the
original request, but the SQL will be functionally equivalent:
SELECT review_content, review_author FROM reviews WHERE id=2+3
This is not limited to numeric data. Assume that the URL http://www.victim.com/
count_reviews.jsp?author=MadBob returns information relating to a particular