SQL Injection Attacks and Defense - 2009

244 Chapter 5 • Blind SQL Injection Exploitation
throughout this chapter: ASCII(SUBSTRING(CURRENT_USER( ),i,1))&2 j =2 j , which
implements the bit-by-bit inference method. If the condition is true (i.e., bit j is a 1-bit), the
query SELECT table_name FROM information_schema.columns WHERE table_name =
(SELECT table_name FROM information_schema.columns) is run, and this query has a subquery
that returns multiple rows in a comparison. Because this is forbidden, execution halts with
an error. On the other hand, if bit j was a 0-bit, the IF( ) statement returns the value 1.
The true branch on the IF( ) statement uses the built-in information_schema.columns table,
as this exists in all MySQL Version 5.0 and later databases.
I should point out that when using an application written in PHP with MySQL as
the data store, errors arising from the execution of database queries do not generate
exceptions that cause generic error pages. The calling page must check whether mysql_
query( ) returns FALSE, or whether mysql_error( ) returns a non-empty string; if either
condition exists, the page prints an application-specific error message. The result of this
is that MySQL errors do not produce HTTP 500 response codes, but rather the regular
200 response code.
SQL Server Response Techniques
Consider the following T-SQL that can infer one bit of information by asking whether a
vulnerable query returned rows with the statement:
SELECT COUNT(*) FROM reviews WHERE review_author='MadBob' and
SYSTEM_USER='sa'
If the query returned results the login in use was sa, and if no rows came back the login
was something else. You can integrate this quite easily with the binary search and bit-by-bit
inference methods to extract the actual login:
SELECT COUNT(*) FROM reviews WHERE review_author='MadBob' AND
ASCII(SUBSTRING(SYSTEM_USER,i,1))>k--
and
SELECT COUNT(*) FROM reviews WHERE review_author='MadBob' AND
ASCII(SUBSTRING(SYSTEM_USER,i,1))&2 j =2 j
The split and balance trick works nicely with response-based inference on SQL
Server. Combined with a conditional subquery that uses CASE, you can include a string
as part of the search depending on the state of a bit or value. Consider first a binary
search example:
SELECT COUNT(*) FROM reviews WHERE review_author='Mad'+(SELECT CASE WHEN
ASCII(SUBSTRING(SYSTEM_USER,i,1))>k THEN 'Bob' END) + ''