SQL Injection Attacks and Defense - 2009

Advanced Topics • Chapter 7 327
within a database. To prevent attackers from leveraging the server to access the powerful
procedures that are built into the Oracle database, the server implements an exclusion list,
and blocks access to packages such as SYS and OWA.
Blacklist-based filters of this kind are, of course, notoriously susceptible to bypasses,
and Oracle’s exclusion list is no exception. In the early 2000s, David Litchfield discovered
a series of defects in the filter, each involving ways of representing blocked packages that
appear benign to the front-end filter but are still processed as intended by the back-end
database.
For instance, whitespace can be placed before the package name:
https://www.example.com/pls/dad/%0ASYS.package.procedure
The Y character in SYS can be replaced with a URL-encoded ÿ character:
https://www.example.com/pls/dad/S%FFS.package.procedure
The package name can be placed within quotation marks:
https://www.example.com/pls/dad/"SYS".package.procedure
A programming goto label can be placed before the package name:
https://www.example.com/pls/dad/SYS.package.procedure
Although these examples are specific to a particular product, they illustrate the kinds of
issues that can arise with custom input filters, and the techniques that you need to try
when attempting to circumvent them.
Using Non-Standard Entry Points
Sometimes you will encounter situations where application-wide defenses are in place
(such as WAFs) which implement effective input filters and prevent the usual means of
exploiting vulnerable code. In this situation, you should look for non-standard entry
points into the application, which may be vulnerable to SQL injection and which the
applicationwide filters may have overlooked.
Many WAFs inspect the values of every request parameter, but do not validate the
parameter names. You can, of course, add arbitrary parameter names to any request. If the
application incorporates arbitrary parameter names into dynamic SQL queries, you may be
able to perform SQL injection despite the presence of the filter.
Consider an application function which saves user preferences. The preferences page has
a large number of input fields, which are submitted to a URL such as the following:
https://www.example.org/Preferences.aspx?lang=en&region=uk&currency=gbp...