SQL Injection Attacks and Defense - 2009

268 Chapter 5 • Blind SQL Injection Exploitation
˛˛
˛˛
Usually time is used as an inference method on SQL Server; Oracle and MySQL
are less reliable and the mechanisms are more prone to failure.
Time is inherently unreliable as an inference method, but you can improve that by
increasing the timeouts or with other tricks.
Using Response-Based Techniques
˛˛ You can extract data through a bit-by-bit method or via a binary search method
with response content indicating the value. Typically, existing queries have a clause
inserted that keeps the query as is or returns no results based on the inferred value.
˛˛ Response-Based Techniques can be used with great success on a wide variety of
databases.
˛˛ In some cases, it may be possible to return more than one bit of information
per request.
Using Alternative Channels
˛˛ Out-of-band communication has the advantage that data can be extracted in
chunks rather than in bits, providing a noticeable speed improvement.
˛˛ The most common channel is DNS, where an attacker persuades the database to
perform a name lookup containing a domain name controlled by the attacker and
prefixed by a piece of data that is to be extracted. When the request arrives at the
DNS name server, the attacker views that data. Other channels are HTTP and
SMTP.
˛˛ Support for alternative channels is highly database-specific, and the number of tools
that support alternative channels is significantly lower than those that support
inference.
Automating Blind SQL Injection Exploitation
˛˛ Absinthe’s strength is its support for database mapping and retrieval through errorand
response-based inference exploits against a number of popular databases, both
commercial and open source. The handy GUI is a nice touch, but the lack of
signature support limits its effectiveness.
˛˛ BSQL Hacker is another graphical tool that uses both time and response-based
inference techniques as well as classic errors to extract items from the database in
question. Although still in beta and therefore unstable, the tool has promise and
provides many opportunities for fiddling.