SQL Injection Attacks and Defense - 2009

References • Chapter 10 423
you are attacking. However, if your injected SQL doesn’t quite work out to plan, it may
be necessary to identify the database platform using a more scientific approach.
Identifying the Database
Platform via Time Delay Inference
Generating a time delay based on server-specific functionality is a long-standing method
of identifying the database platform. Table 10.4 lists the functions or procedures for generating
measurable time delays across the most popular database platforms.
Table 10.4 Generating a Time Delay
Platform
Microsoft SQL Server
Oracle
Time Delay
WAITFOR DELAY '0:0:10'
BEGIN DBMS_LOCK.SLEEP(5);END;--(PL/SQL
Injection only)
SELECT UTL_INADDR.get_host_name('192.168.0.1')
FROM dual
SELECT UTL_INADDR.get_host_address
('foo.nowhere999.zom') FROM dual
MySQL
Postgres 8.2 and later
SELECT UTL_HTTP.REQUEST('http://www.oracle.com')
FROM dual
BENCHMARK(1000000,MD5("HACK"))
SLEEP(10)
SELECT pg_sleep(10)
Another similar approach involves submitting “heavy queries” designed to consume the
processor for a measureable length of time. Since there are deviations within each vendor’s
implementation of SQL, it is possible to construct a heavy query that will execute successfully
on only one specific platform. Microsoft published an article on the subject in September
2007 which you can find at http://technet.microsoft.com/en-us/library/cc512676.aspx
Identifying the Database
Platform via SQL Dialect Inference
There are several deviations between each vendor’s SQL implementation that you could
use to help identify the database server. A common method for narrowing down the list of
potential database platforms is to assess how the target server deals with platform-specific