SQL Injection Attacks and Defense - 2009

242 Chapter 5 • Blind SQL Injection Exploitation
Using Response-Based Techniques
Just as we used request timing to infer information about a particular byte, we can also infer
state by carefully examining all data in the response, including content and headers. You can
infer state either by the text contained in the response or by forcing errors when particular
values are under examination. For example, the inference exploit could contain logic that
alters the query such that query results are returned when the examined bit is 1 and no
results if the bit is 0, or again, an error could be forced if a bit is 1 and no error generated
when the bit is 0.
Although we will delve into error-generating techniques shortly, it is worth mentioning
here that the types of errors we strive to generate are runtime errors rather than query
compilation errors. If the syntax in the query is wrong, it will always produce an error,
regardless of the inference question; the error should be generated only when the inference
question is either TRUE or FALSE, but never both.
Most blind SQL injection tools use response-based techniques for inferring information,
as the results are not influenced by uncontrolled variables such as load and line congestion;
however, this approach does rely on the injection point returning some modifiable response
to the attacker. You can use either the binary search approach or the bit-by-bit approach
when inferring information by poring over the response.
MySQL Response Techniques
Consider the case where the following SQL query is executed through a Web application
with input data MadBob, and returns one row from the reviews table that is contained in the
page response. The query is:
SELECT COUNT(*) FROM reviews WHERE review_author='MadBob'
The result of execution is a single row containing the number of reviews written by
MadBob, and this is displayed on the Web page in Figure 5.6.
Figure 5.6 Query for “MadBob” Returning a
Count of Two Reviews, Used As TRUE Inference