SQL Injection Attacks and Defense - 2009

64 Chapter 2 • Testing for SQL Injection
SELECT *
FROM administrators
WHERE username = ''' AND password = '';
The syntax of the query is wrong due to the injected quote and the database throws an
error, which the Web server sends back to the client.
Once we identify the vulnerability, our goal in this scenario is to craft a valid SQL
statement which satisfies the conditions imposed by the application so that we can bypass
the authentication control.
In this case, we assume we are attacking a string value because a username is usually
represented by a string and because injecting a quote returned an Unclosed quotation mark
error. Due to these reasons we are going to inject ‘ or ‘1’=’1 in the username field, leaving
the password blank. The entry will result in the following SQL statement:
SELECT *
FROM administrators
WHERE username = '' OR '1'='1' AND password = '';
This statement will not have the intended results. It will not return TRUE for every field
due to logical operator priority. AND has a higher priority than OR, and therefore we could
rewrite the SQL statement as follows to make it easier to understand:
SELECT *
FROM administrators
WHERE (username = '' OR '1'='1') AND (password = '');
This is not what we wanted to do, as this will return only the rows that contain a blank
password. We can change this behavior by adding a new OR condition such as ‘ or 1=1 or
‘1’=’1:
SELECT *
FROM administrators
WHERE username = '' OR 1=1 OR '1'='1' AND password = '';
The new OR condition makes the statement always return true, and therefore we might
bypass the authentication process. In the previous section you saw how you could solve this
scenario by terminating the SQL statement; however, you might find a scenario where
termination is not possible and the preceding technique is therefore necessary.
Some authentication mechanisms cannot be bypassed by returning every row in the
administrators table, as we have done in these examples; they might require just one row to be
returned. For those scenarios, you may want to try something such as admin’ and ‘1’=’1’ or
‘1’=’1, resulting in the following SQL code:
SELECT *
FROM administrators
WHERE username = 'admin' AND 1=1 OR '1'='1' AND password = '';