SQL Injection Attacks and Defense - 2009

Using Hybrid Attacks
Advanced Topics • Chapter 7 335
Hybrid attacks combine two or more exploits to attack an application, often resulting in a
compromise that is greater than the sum of its parts. You can combine SQL injection with
other techniques in numerous ways to achieve your objectives in attacking an application.
Leveraging Captured Data
First, of course, you can use SQL injection to retrieve sensitive data that you can use to
escalate your privileges within the application. For example, you may be able to read the
passwords for other users, and log in as them. If the passwords are hashed and you know the
algorithm, you can try to crack the captured hashes offline. Similarly, you may be able to
read tables of sensitive logging data, containing usernames, session tokens, or even the
parameters submitted in the requests of other users.
More elaborately, if the application contains an account recovery function which e-mails
a one-time recovery URL to users who have forgotten their password, you may be able to
read the values of the account recovery tokens issued to other users, and so initiate account
recovery for arbitrary users and thereby compromise their accounts.
Creating Cross-Site Scripting
SQL injection is a great bug to find in a Web application, but sometimes you may really
want a different bug, such as cross-site scripting (XSS). Often, you can use SQL injection
vulnerabilities to introduce different kinds of XSS into the application.
If the input which you supply to the application is not itself being echoed back, but
instead the application returns the output from an SQL query which you control, you can
usually exploit the vulnerability to achieve the same effects as a reflected XSS attack. For
example, if the application returns the results of the query as shown here:
SELECT orderNum, orderDesc, orderAmount FROM tblOrders WHERE orderType = 123
and the orderType field is vulnerable to SQL injection, you may be able to create a proofof-concept
XSS attack with a URL such as the following:
https://www.example.org/MyOrders.php?orderType=123+UNION+SELECT+1,'
alert(1)',1
Unlike conventional XSS, the application does not simply echo your attack payload in
its response. Rather, you modify the SQL query to append your payload to the query
results, which the application copies into its response. Provided that the application does
not perform any output encoding on the query results (if it assumes that the query results
are trustworthy), your attack will be successful.
In other situations, you may be able to leverage SQL injection vulnerabilities to perform
a persistent XSS attack within the application. This possibility usually arises when data that