SQL Injection Attacks and Defense - 2009

Blind SQL Injection
Functions: Microsoft SQL Server
References • Chapter 10 427
Table 10.9 lists functions that are useful when performing blind SQL injection attacks.
Table 10.9 Blind SQL Injection Functions
Data
String length
Extract substring from a given string
String (‘ABC’) representation with
no single quotes
Trigger time delay
Query
LEN()
SUBSTRING(string,offset,length)
SELECT char(0x41) + char(0x42) +
char(0x43);
WAITFOR DELAY '0:0:9';-- triggers
9 second time delay
IF statement IF (1=1) SELECT 'A' ELSE SELECT 'B' --
returns 'A'
Microsoft SQL Server Privilege Escalation
This section covers some of the generic privilege escalation attacks that can be performed
against the Microsoft SQL Server platform. Over the years, a number of vulnerabilities have
been discovered and publicly disclosed that could be used to elevate privileges. However,
since Microsoft regularly patches vulnerabilities within the database platform, any list
produced here would be out of date by the time this book is published. To learn more about
the most recent vulnerabilities affecting the Microsoft SQL Server platform, search a popular
vulnerability database such as www.secunia.com or www.securityfocus.com. Table 10.10
maps the version number stored within the @@version variable to an actual release and
service pack number. See the following Microsoft Knowledge base article for further details:
http://support.microsoft.com/kb/937137/en-us.
Table 10.10 Microsoft SQL Server Version Numbers
Version Number
Service Pack
9.00.3042 Microsoft SQL Server 2005 SP2
9.00.2047 Microsoft SQL Server 2005 SP1
9.00.1399 Microsoft SQL Server 2005
Continued