SQL Injection Attacks and Defense - 2009

232 Chapter 5 • Blind SQL Injection Exploitation
theory perspective. However, there is still a performance issue with the binary search
technique, since each request is dependent on the result of the previous request; we cannot
make the second request before the answer to the first is known, since our second request
might be to test the byte against 63 or 191. Thus, requests for a single byte cannot be run in
parallel, and this violates our good sense.
No t e
Although it is true that bytes could be requested in parallel, there is no
good reason to stop there without attempting to parallelize bit requests.
We’ll look into this further shortly.
This dependence is not intrinsic to the data, since the values of the bytes are not finalized
by our requests; they remain constant in the database (constant in the sense that we are not
changing them—of course, any application accessing the data could make alterations; if that
is the case, all bets are off and all inference techniques become unreliable). The binary search
technique grouped eight bits into a byte and inferred the value of all eight bits through eight
requests. Could we not instead attempt to infer the value of a single specific bit per request
(say, the second bit of the byte)? If that were possible, we could issue eight parallel requests
for all bits in a byte and retrieve its value in less time than the binary search method would
take to retrieve the same byte, since requests would be made side by side rather than one
after the other.
Massaging bits requires sufficiently helpful mechanisms within the SQL variant
supported by the database under attack. Toward that end, Table 5.2 lists the bit functions
supported by MySQL, SQL Server, and Oracle on two integers, i and j. Because Oracle
does not provide an easily accessible native OR and XOR function we can roll our own.
Table 5.2 Bitwise Operations in Three Databases
Database Bitwise AND Bitwise OR Bitwise XOR
MySQL i & j i | j i ^ j
SQL Server i & j i | j i ^ j
Oracle BITAND(i,j) i–
BITAND(i,j)+j
i–
2*BITAND(i,j)+j