SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 67
Note that injecting a number doesn’t require terminating and commencing the
single-quote delimiters. In this example, we can directly inject after the uid parameter
in the URL.
In this scenario, we have control over the messages returned from the database.
The application doesn’t perform any sanitization in the uid parameter, and therefore we can
interfere in the rows selected from the messages table. The method of exploitation in this
scenario is to add an always true (or 1=1) statement, so instead of returning only the messages
for our user, all of them are displayed. The URL would be:
http://www.victim.com/messages/list.aspx?uid=45 or 1=1
The result of the request would return messages to every user, as shown in Figure 2.13.
Figure 2.13 Exploitation of a Numeric Injection
The result of the exploitation generated the following SQL statement:
SELECT *
FROM messages
WHERE uid=45 or 1=1 /* Always true condition*/
ORDER BY received;
Due to the always true condition injected (or 1=1) the database returns all rows in the
messages table and not just the ones sent to our user. In Chapter 4, you will learn how to
exploit this further to read arbitrary data from any table of the database and even from
other databases.
Table 2.2 shows a collection of signatures for testing numeric values.