SQL Injection Attacks and Defense - 2009

238 Chapter 5 • Blind SQL Injection Exploitation
Tip
As always with SQL injection, asking where in the original query your input ends
up is an important step toward understanding the effect of your exploit. For
example, the timing-based inference attacks on MySQL almost always introduce
a delay in the WHERE clause of the query. However, because the WHERE clause
is evaluated against each row, any delay is multiplied by the number of rows
against which the clause is compared. For example, using the exploit snippet
+ IF(ASCII(SUBSTRING((…),i,1))>k,SLEEP(5),1) on a table of 100 rows produces a
delay of 500 seconds. At first glance, this may seem contrary to what you would
like, but it does allow you to estimate the size of tables; moreover, since SLEEP( )
can pause for microseconds, you can still have the overall delay for the query
take just a few seconds even if the table has thousands or millions of rows.
SQL Server Delays
SQL Server provides an explicit facility for pausing the execution of any query. Using the
WAITFOR keyword it is possible to cause SQL Server to halt execution of a query until
some time period has passed, which can be either relative to the time at which the keyword
was encountered or an absolute time when execution should resume (such as 21:15).
You most often will use the relative option, which makes use of the DELAY keyword.
Thus, to pause execution for 1 minute, 53 seconds you would use WAITFOR DELAY
‘00:01:53’. The result is a query that indeed executes for 1 minute, 53 seconds, as Figure 5.5
shows—the time the query took to execute is shown in the status bar along the bottom
of the window. Note that this does not impose a maximum bound on the execution time;
you are not telling the database to only execute for 1:53; rather, you are adding 1:53 to the
query’s normal execution time, so the delay is a minimum bound.
Notes from the Underground…
Simulating BENCHMARK( ) on
Microsoft SQL Server and Other Databases
In mid-2007, Chema Alonso published a technique for duplicating MySQL’s
BENCHMARK( ) effect of prolonging queries through an extra processing load in SQL
Server, and this provided another mechanism for inferring data without the need for
Continued