SQL Injection Attacks and Defense - 2009

60 Chapter 2 • Testing for SQL Injection
The representation of an example of the attack trying to show the product whose
idproduct=6 would be any of the following URLs:
http://www.victim.com/showproduct.php?id=1%2B5 (decodes to id=1+5)
http://www.victim.com/showproduct.php?id=2%2B4 (decodes to id=2+4)
http://www.victim.com/showproduct.php?id=3%2B3 (decodes to id=3+3)
Continuing the inference process, we can now insert conditions after the id value,
creating true and false results:
http://www.victim.com/showproduct.php?id=2 or 1=1
-- returns the first product
http://www.victim.com/showproduct.php?id=2 or 1=2
-- returns the second product
In the first request, the Web server returns the product whose idproduct=1, whereas in the
second request it returns the product whose idproduct=2.
In the first statement, or 1=1 makes the database return every product. The database
detects this as an anomaly and shows the first product.
In the second statement, or 1=2 makes no difference in the result, and therefore the flow
of execution continues without change.
You might have realized that there are some variations of the attack, based on the same
principles. For example, we could have opted for using the AND logical operator, instead of
OR. In that case:
http://www.victim.com/showproduct.php?id=2 and 1=1
-- returns the second product
http://www.victim.com/showproduct.php?id=2 and 1=2
-- returns the first product
As you can see, the attack is almost identical, except that now the true condition returns
the second product and the false condition returns the first product.
The important thing to note is that we are in a situation where we can manipulate an
SQL query but we cannot get data from it. Additionally, the Web server sends a different
response depending on the condition that we send. We can therefore confirm the existence
of blind SQL injection and start automating the exploitation.
Confirming SQL Injection
In the previous section, we discussed techniques for discovering SQL injection vulnerabilities
by tampering with user data entry and analyzing the response from the server. Once you
identify an anomaly you will always need to confirm the SQL injection vulnerability by
crafting a valid SQL statement.