SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 229
Let’s now shift our attention to the second character and repeat the process, starting at
the letter a and moving through the alphabet. As each successive character is found, the
search moves on to the next character. The page queries that reveal the username on our
sample page are as follows:
status=Incubating' AND SUBSTRING(SYSTEM_USER,1,1)='s (True)
status=Incubating' AND SUBSTRING(SYSTEM_USER,2,1)='q (True)
status=Incubating' AND SUBSTRING(SYSTEM_USER,3,1)='l (True)
status=Incubating' AND SUBSTRING(SYSTEM_USER,4,1)='0 (True)
status=Incubating' AND SUBSTRING(SYSTEM_USER,5,1)='5 (True)
Simple, isn’t it? The username is sql05. Unfortunately, though, it’s actually not that simple,
and we have skipped over a pretty important question: How do we know when the end of the
username has been reached? If the portion of the username discovered so far is sql05, how can
we be sure that there is not a sixth, seventh, or eighth character? The SUBSTRING( ) function
will not generate an error if you ask it to provide characters past the end of the string; instead,
it returns the empty string “. Therefore, we can include the empty string in our search alphabet,
and if it is found we can conclude that the end of the username has been found.
status=Incubating' AND SUBSTRING(SYSTEM_USER,6,1)=' (True)
Hooray! Except that this is not very portable and depends on the explicit behavior of a
particular database function. A neater solution would be to determine the length of the
username before extracting it. The advantage of this approach, apart from being applicable
to a wider range of scenarios than the “SUBSTRING( ) returns empty string” approach, is
that it enables the attacker to estimate the maximum time that could possibly be spent
extracting the username. We can find the length of the username with the same technique
we employed to find each character, by testing whether the value is 1, 2, 3, and so on until
we find a match:
status=Incubating' AND LEN(SYSTEM_USER)=1-- (False)
status=Incubating' AND LEN(SYSTEM_USER)=2-- (False)
status=Incubating' AND LEN(SYSTEM_USER)=3-- (False)
status=Incubating' AND LEN(SYSTEM_USER)=4-- (False)
status=Incubating' AND LEN(SYSTEM_USER)=5-- (True)
From this sequence of requests it was possible to infer that the length of the username
was 5. Note as well the use of the SQL comment (--) that, although not required, makes the
exploit a little simpler.
It is worth reinforcing the point that the inference tool used to determine whether a given
question was TRUE or FALSE was the presence of either an egg count or a message stating
that no eggs matched the given status. The mechanism by which you make an inference
decision is highly dependent on the scenario that faces you and can often be substituted with
a number of differing techniques.