SQL Injection Attacks and Defense - 2009

472 Index
testing and inference (Continued)
blind injection detection, 56–60
confirming and terminating
back-end server, 73
BENCHMARK function, 79
database comment syntax, 69–70
database concatenation operators, 72–73
DBMS_LOCK.SLEEP( ) function, 80
executing multiple statement, 74–78
exploitation, 71
inline function, 62–68
multiline comments, 71–72
numbers and strings, 61
statement, 68–69
testing string, 73–74
time delays, 79–80
trial-and-error process, 60–61
Victim Inc, 70
database errors
information flow, 40
Microsoft SQL Server, 41–46
MySQL, 46–49
Oracle, 49–50
triggers, 41
GET requests, 31–32
information workflow, 39–40
injectable data, 35–36
manipulating parameters, 36–39
POST requests, 32–35
Trigger anomalies, 31
three-tier architecture, 4–5
time-based techniques
database queries
methods, 235
MySQL delays, 235–238
Oracle delays, 240–241
SQL Server delays, 238–240
inference considerations, 241
transmission control protocol (TCP),
250, 281
troubleshooting SQL injection attacks,
443–446
U
UNION statements
data types
back-end database, 155
brute-force guessing, 151
cast operators, 153
integer and string, 152
looping statement, 156
multiple data, 153
NULL clause, 151
SELECT queries, 154
system_user and db_name( ), 152–153
WHERE clause, 155
matching columns
DBMS technology, 149
ORDER BY clause, 150–151
products.asp, 150
requirements, 149
syntax, 148–149
universal naming convention (UNC), 280
user datagram protocol (UDP), 251, 297
user-defined function (UDF), 294
V
virtual private database (VPD), 370
W
Web application firewalls (WAF), 318
HTTP/HTTPS, 379
ModSecurity
configurable rule set, 380–383
generic attacks rule file, 382
intrusion detection capabilities, 385–356
request normalization, 383–384
REQUEST variables and coverage, 383
SecRule, generic syntax, 380–382
SQL errors leakage rule, 385