SQL Injection Attacks and Defense - 2009

456 Chapter 10 • References
Solutions Fast Track
Structured Query Language (SQL) Primer
˛˛ SQL comprises a feature-rich set of statements, operators, and clauses designed to
interact with a database server. The most common SQL statements are SELECT,
INSERT, UPDATE, DELETE, and DROP. The majority of SQL injection
vulnerabilities occur when user-supplied data is included with the WHERE clause
portion of a SELECT statement.
˛˛
˛˛
The UPDATE and DELETE statements rely on a WHERE clause to determine
which records are modified or deleted. When injecting SQL into either an
UPDATE or a DELETE statement it is important to understand how your input
could affect the database. Avoid injecting OR 1=1 or any other condition that
returns true into either of these statements.
The UNION operator is used to combine the results of two or more SELECT
statements. UNION SELECT is frequently used to exploit SQL injection
vulnerabilities.
SQL Injection Quick Reference
˛˛ Identifying the database platform is an important step when attempting to exploit
an SQL injection vulnerability. Triggering a measurable time delay is a reliable
method of accurately identifying the database platform.
˛˛ When exploiting SQL injection vulnerabilities you are often restricted to returning
one column from one row at a time. You can overcome this restriction by
concatenating the results from multiple columns and rows into a single string.
Bypassing Input Validation Filters
˛˛ You often can circumvent input validation filters that are designed to handle the
single-quote character (‘) by representing string values using character functions.
For example, char(65,66,67) is equivalent to ‘ABC’ on Microsoft SQL Server.
˛˛ HTTP encoding variants such as Unicode and Overlong UTF-8 can sometimes be
used to bypass input validation filters.
˛˛ Input validation filters that rely on rejecting known bad data, often referred to as
blacklisting, are frequently flawed.