SQL Injection Attacks and Defense - 2009

68 Chapter 2 • Testing for SQL Injection
Table 2.2 Signatures for Inline Injection of Numeric Values
Testing String Variations Expected Results
‘ Error triggering. If successful,
the database will return an error
1+1 3-1 If successful, it returns the same value
as the result of the operation
value + 0
If successful, it returns the same value
as the original request
1 or 1=1 1) or (1=1 Always true condition. If successful,
it returns every row in the table
value or 1=2 value) or (1=2 No condition. If successful, it returns
the same result as the original value
1 and 1=2 1) and (1=2 Always false condition. If successful,
it returns no rows from the table
1 or ‘ab’= ‘a’+’b’ 1) or (‘ab ‘= ‘a’+’b’ Microsoft SQL Server concatenation.
This injection is valid for Microsoft SQL
Server. If successful, it returns the same
information as an always true condition
1 or ‘ab’=’a’ ‘b’ 1) or (‘ab’=’a’ ‘b MySQL concatenation. If successful,
it returns the same information as an
always true condition
1 or ‘ ab’=’a’||’b’ 1) or (‘ab’=’a’||‘b’ Oracle concatenation. If successful,
it returns the same information as an
always true condition
As you can see from Table 2.2, all the injection strings follow similar principles. Confirming
the existence of an SQL injection vulnerability is just a matter of understanding what is being
executed server-side and injecting the conditions that you need for each particular case.
Terminating SQL Injection
There are several techniques for confirming the existence of SQL injection vulnerabilities. In
the previous section you saw inline injection techniques, and in this section you will see
how to create a valid SQL statement through its termination. Injection-terminating an SQL
statement is a technique whereby the attacker injects SQL code and successfully finalizes the
statement by commenting the rest of the query. Figure 2.14 shows a diagram introducing the
concept of SQL injection termination.