SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 227
We want to extract the username that the page uses to connect to the database. Our
Microsoft SQL Server database has a function called SYSTEM_USER that will return the
login username in whose context the database session has been established. Normally, you
can view this with the SQL SELECT SYSTEM_USER, but in this case the results are not
visible. Figure 5.1 depicts an attempt to extract data using the verbose error message technique,
but the page returns a standard error page. Unfortunately, the developers followed bad
security advice, and rather than steering clear of dynamic SQL they chose to catch database
exceptions and display a generic error message.
Figure 5.1 Unsuccessful Attempt to Extract Data through Error Messages
When we submit status=Incubating the page executes the preceding SQL query and
returns the string shown in Figure 5.2.
Figure 5.2 Response When Counting Unhatched Eggs
We can alter the status parameter such that the SQL query returns an empty result set by
adding the “always false” clause and ‘1’= ‘2 to the legitimate query, yielding the following
SQL statement:
SELECT COUNT(chick_id) FROM chickens WHERE status='Incubating' and '1'='2'
Figure 5.3 shows the response to this query. From the message, we can infer that the
query returned an empty result set. Keep in mind that for two rows, status was Incubating, but
the trailing false clause ensured that no rows would match.