SQL Injection Attacks and Defense - 2009

234 Chapter 5 • Blind SQL Injection Exploitation
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 8=8-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 4=4-- (False)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 2=2-- (True)
status=Incubating' AND ASCII(SUBSTRING(SYSTEM_USER,1,1)) & 1=1-- (True)
Because True represents 1 and False represents 0, we have the bitstring 01110011, which
is 115 10
. Looking up 115 10
on an ASCII chart give us s which is the first character of the
username. Our focus then shifts to the next byte and the next after that, until all bytes have
been retrieved. When compared to the binary search method this bit-by-bit approach also
requires eight requests, so you may wonder what the point is of all this bit manipulation;
however, since each request is independent of all the others they can be trivially parallelized.
Eight requests appear to be inefficient in retrieving a single byte, but when the only
available option is blind SQL injection this is a small price to pay. It goes without saying that
although many SQL injection attacks can be implemented by hand, issuing eight custom
requests to extract a single byte would leave most people reaching for the painkillers.
Because all that differs between requests for different bits is a bunch of offsets, this task is
eminently automatable, and later in this chapter we will examine a number of tools that take
the pain out of crafting these inference attacks.
Tip
If you are ever in a situation where you need to have an integer value broken
up into a bitstring using SQL, SQL Server 2000 and 2005 support a userdefined
function, FN_REPLINTTOBITSTRING( ), which takes as its sole argument
an integer and returns a 32-character string representing the bitstring.
For example, FN_REPLINTTOBITSTRING(ASCII(‘s’)) returns 000000000000000000
00000001110011, which is a 32-bit representation of 115 10
or s.
Alternative Channel Techniques
The second category of methods for extracting data in blind SQL injection vulnerabilities
is by means of alternative channels, and what sets these methods apart from the inference
techniques is that although inference techniques rely on the response sent by the vulnerable
page, alternative channel techniques utilize transports apart from the page response. This
includes channels such as DNS, e-mail, and HTTP requests. A further attribute of alternative
channel techniques is that generally they enable you to retrieve chunks of data at a time
rather than inferring the value of individual bits or bytes, which makes alternative channels
a very attractive option to explore. Instead of using eight requests to retrieve a single byte,
you could possibly retrieve 200 bytes with a single request. However, most alternative
channel techniques require larger exploit strings than inference techniques.