SQL Injection Attacks and Defense - 2009

Advanced Topics • Chapter 7 339
˛˛ Look for logic flaws in multistep filters, such as the failure to strip expressions
recursively, or unsafe truncation of input.
˛˛ If effective applicationwide filters are in place, look for non-standard entry points
which the filters may overlook, such as parameter names and HTTP request
headers.
Exploiting Second-Order SQL Injection
˛˛ Review the application’s functionality, looking for cases where user-supplied data is
stored and reused.
˛˛ Submit a single quotation mark in each item of data. If your input is blocked or
sanitized, use the filter evasion techniques described in this chapter to attempt to
defeat the filters.
˛˛ Walk through the relevant functionality where the data is used, looking for
anomalous behavior.
˛˛ For each anomaly detected, try to develop a proof-of-concept attack to prove that
the application is in fact vulnerable to SQL injection. If no error information is
returned, try using time delay strings to induce a noticeable delay in the relevant
responses.
Using Hybrid Attacks
˛˛ Anytime you discover an SQL injection vulnerability, think about how you can
combine it with other bugs and techniques to deliver a more sophisticated
compromise of the application.
˛˛ Always look for ways to use data retrieved via SQL injection, such as usernames
and passwords, to escalate your attack against the application.
˛˛ You can often use SQL injection to perform cross-site scripting attacks within an
application, most significantly persistent attacks which will compromise other users
who are accessing the application in the normal way.
˛˛ If you discover SQL injection vulnerabilities in privileged authenticated application
functions, examine whether you can use cross-site request forgery to deliver
a successful attack as a low-privileged user.