SQL Injection Attacks and Defense - 2009

40 Chapter 2 • Testing for SQL Injection
As you can see, the Web server and the database server are separate entities. The Web server
just creates an SQL query, parses the results, and displays the results to the user. The database
server receives the query and returns the results to the Web server. This is very important for
exploiting SQL injection vulnerabilities because if you can manipulate the SQL statement and
make the database server return arbitrary data (such as usernames and passwords from the
Victim Inc. Web site) the Web server has no means to verify whether the data is legitimate.
Database Errors
In the previous section, you saw some SQL injection errors displayed as a result of
parameter manipulation. Although the errors are displayed in the Web server response,
the SQL injection happens at the database layer. Those examples showed how you can reach
a database server via the Web application.
It is very important that you familiarize yourself with the different database errors that
you may get from the Web server when testing for SQL injection vulnerabilities. Figure 2.5
shows how an SQL injection error happens and how the Web server deals with it.
Figure 2.5 Information Flow during an SQL Injection Error
As you can see in Figure 2.5, the following occurs during an SQL injection error:
1. The user sends a request in an attempt to identify an SQL injection vulnerability.
In this case, the user sends a value with a single quote appended to it.
2. The Web server retrieves user data and sends an SQL query to the database server.
In this example, you can see that the SQL statement created by the Web server
includes the user input and forms a syntactically incorrect query due to the two
terminating quotes.
3. The database server receives the malformed SQL query and returns an error to the
Web server.
4. The Web server receives the error from the database and sends an HTML response
to the user. In this case, it sent the error message, but it is entirely up to the
application how it presents any errors in the contents of the HTML response.