SQL Injection Attacks and Defense - 2009

1. Is the byte greater than 127? No, because 14 < 127.
2. Is the byte greater than 63? No, because 14 < 63.
3. Is the byte greater than 31? No, because 14 < 31.
4. Is the byte greater than 15? No, because 14 < 15.
5. Is the byte greater than 7? Yes, because 14 > 7.
6. Is the byte greater than 11? Yes, because 14 > 11.
7. Is the byte greater than 13? Yes, because 14 > 13.
8. Is the byte greater than 14? No, because 14 = 14.
Blind SQL Injection Exploitation • Chapter 5 231
Since the byte is greater than 13 but not greater than 14, we can infer that the byte has
the value 14. This technique relies on a database function to provide the integer value of any
byte; under Microsoft SQL Server, MySQL, and Oracle, this is provided by the ASCII( )
function.
If we return to the original problem of finding the database username, but now we use
the binary search technique to find the first character of the username, we would like to
execute the following SQL statement:
SELECT COUNT(chick_id) FROM chickens WHERE status='Incubating' AND
ASCII(SUBSTRING(system_user,1,1))>127--'
We need to issue eight SQL statements to absolutely determine the character’s value.
Converting all these queries into a page requests produces the following:
status=Incubating' and ASCII(SUBSTRING(SYSTEM_USER,1,1))>127-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>63-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>95-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>111-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>119-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>115-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>113-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1))>114-- (True)
From this series of requests, we can infer that the byte value of the first character of
the username is 115, which, when converted to its ASCII table equivalent, is s. Using this
technique it is possible to extract a byte in exactly eight requests, which is a vast improvement
over comparing the full byte against an alphabet. If we add a third state to the request
(Error), it is possible to test for equality in our binary search, thereby reducing the best-case
number of requests to one request, with eight requests being a worst case.
This is great. We have a method by which we can efficiently extract the value of a given
byte in a fixed time in as many requests as there are bits. Unless we use compression or an
injection string that handles more than two states this is as good as it gets from an information