SQL Injection Attacks and Defense - 2009

42 Chapter 2 • Testing for SQL Injection
current web request. Please review the stack trace for more information
about the error and where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation
mark before the character string 'attaker;'.
Obviously, you don’t have to memorize every error code. The important thing is that
you understand when and why an error occurs. In both examples, you can assert that the
remote SQL statement running on the database must be something similar to the following:
SELECT *
FROM products
WHERE category='attacker''
The application did not sanitize the single quotes, and therefore the syntax of the
statement is rejected by the database server returning an error.
You just saw an example of injection in an alphanumeric string. The following example
will show the typical error returned when injecting a numeric value, therefore not enclosed
between quotes in the SQL statement.
Imagine you find a page called showproduct.aspx in the victim.com application.
The script receives a parameter called id and displays a single product depending on the value
of the id parameter:
http://www.victim.com/showproduct.aspx?id=2
When you change the value of the id parameter to something such as the following:
http://www.victim.com/showproduct.aspx?id=attacker
the application returns an error similar to this:
Server Error in '/' Application.
Invalid column name 'attacker'.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: Invalid column name
'attacker'.
Based on the error, you can assume that in the first instance the application creates an
SQL statement such as this:
SELECT *
FROM products
WHERE idproduct=2
The preceding statement returns a result set with the product whose idproduct field
equals 2. However, when you inject a non-numeric value, such as attacker, the resultant SQL
statement sent to the database server has the following syntax: