SQL Injection Attacks and Defense - 2009

4. The application URL decodes the input as ‘/∗∗/ UNION…
Advanced Topics • Chapter 7 321
5. The application processes the input within an SQL query, and the attack is
successful.
A further variation on the URL-encoding technique is to use Unicode encodings of
blocked characters. As well as using the % character with a two-digit hexadecimal ASCII
code, URL encoding can employ various Unicode representations of characters. Further,
because of the complexity of the Unicode specification, decoders often tolerate illegal
encodings and decode them on a “closest fit” basis. If an application’s input validation checks
for certain literal and Unicode-encoded strings, it may be possible to submit illegal encodings
of blocked characters, which will be accepted by the input filter but which will decode
appropriately to deliver a successful attack.
Table 7.1 shows various standard and non-standard Unicode encodings of characters
that are often useful when performing SQL injection attacks.
Table 7.1 Standard and Non-Standard
Unicode Encodings of Some Useful Characters
Literal Character
Encoded Equivalent
' %u0027
%u02b9
%u02bc
%u02c8
%u2032
%uff07
%c0%27
%c0%a7
%e0%80%a7
- %u005f
%uff3f
%c0%2d
%c0%ad
%e0%80%ad
/ %u2215
%u2044
%uff0f
%c0%2f
%c0%af
%e0%80%af
Continued