SQL Injection Attacks and Defense - 2009

Summary
Blind SQL Injection Exploitation • Chapter 5 267
Understanding and exploiting blind SQL injection is what separates regular attackers from
the pros. In the face of a defense as trivial as disabling verbose error messages, most script
kiddies move on to the next target. However, blind SQL injection vulnerabilities provide
just as much possible ownage through a range of techniques that allow the attacker to
utilize timing, responses, and alternative channels such as DNS to extract the data. By asking
a simple question in the shape of an SQL query that returns either TRUE or FALSE and
repeating thousands of times, the keys to the database kingdom are ours.
Blind SQL injection vulnerabilities are often missed because they hide in the shadows.
Once you have discovered the vulnerabilities, a range of possible exploits are at your fingertips.
Know when to choose response-based exploits as opposed to timing exploits and when to
haul out the heavyweight alternative channel tools; this fine-grained knowledge will save
you time. Given how highly prone to automation most blind SQL injection vulnerabilities
are, a wide variety of tools are available for both the novice and expert covering graphical as
well as command-line tools with a wide spectrum of supported databases.
With the basics of SQL injection and blind SQL injection behind you, it is time to
move on to the business of further exploitation: What happens once a comfortable injection
point is identified and exploited? Can you move on to exploiting the underlying operating
system? Find out in Chapter 6!
Solutions Fast Track
Finding and Confirming Blind SQL Injection
˛˛ Invalid data returns a generic error message rather than a verbose error, so you can
confirm SQL injection by inducing side effects such as a timed delay. You can also
split and balance a parameter; if a numeric field contains 5, submit 2 + 3 or 6 – 1;
if a string parameter contains “MadBob” submit ‘Mad’||‘Bob’.
˛˛ Consider the attribute of the vulnerability: Can any errors be forced, and is any of
the content on a non-error page controllable?
˛˛ You can infer a single bit of information by asking in SQL whether the bit is 1 or
0. A number of inference techniques accomplish this.
Using Time-Based Techniques
˛˛ You can extract data through a bit-by-bit method or via a binary search method
with delays indicating the value. Delays are introduced either with explicit
SLEEP( )-type functions or through the use of long-running queries.