SQL Injection Attacks and Defense - 2009

230 Chapter 5 • Blind SQL Injection Exploitation
Are You Owned?
Counting Eggs and Requests
If it is not already clear, the inference techniques described in this chapter are noisy
and resource-intensive; extracting one bit per request means that an attacker will
have to send thousands of requests at a minimum, running into the millions where
megabytes of data is retrieved. This helps in spotting such attacks using basic metrics:
Requests per minute, database queries per minute, tracking database connection pool
errors, and bandwidth utilization are all possible data points that you can monitor to
evaluate whether an inference attack is ongoing.
For large sites, many of these metrics could fall under the radar, as the attack may
not sufficiently spike the numbers; it may also help to track requests per page as the
inference attack will in all likelihood use a single injection point to complete the
attack.
Increasing the Complexity of Inference Techniques
It may have occurred to you that testing each character in the username against the entire
alphabet (plus digits and possibly non-alphanumeric characters) is a pretty inefficient method
for extracting data. To retrieve the username we had to request the page 112 times (five
times for the length and 19, 17, 12, 27, and 32 times for the characters s, q, l, 0, and 5,
respectively). A further consequence of this approach is that when retrieving binary data we
could potentially have an alphabet of 256 characters, which sharply increases the number of
requests and in any case is often not binary-safe. Two methods can improve the efficiency of
retrieval through inference: a bit-by-bit method and a binary search method. Both methods
are binary-safe.
The binary search method is mostly used to infer the value of single bytes without
having to search through an entire alphabet. It successively halves the search space until the
value of the byte is identified, by playing a game of eight questions. (Because a byte can have
one of 256 values, the value will always be determined in eight requests. This is intuitively
demonstrated by counting the number of times you can successively divide 256 in half
before you get a non-integer quotient.) Assume that the byte we are interested in has the
value 14. We ask questions and infer the answers through a convenient inference mechanism,
which will return Yes if the answer is true and No if the answer is false. The game then
proceeds like this: