SQL Injection Attacks and Defense - 2009

70 Chapter 2 • Testing for SQL Injection
Tip
A defense technique consists of detecting and removing all spaces or truncating
the value to the first space from the user entry. Multiline comments can
be used to bypass such restrictions. Say you are exploiting an application
using the following attack:
http://www.victim.com/messages/list.aspx?uid=45 or 1=1
However, the application removes the spaces and the SQL statement
becomes:
SELECT *
FROM messages
WHERE uid=45or1=1
This will not return the results you want, but you can add multiline
comments with no content to avoid using spaces:
http://www.victim.com/messages/list.aspx?uid=45/**/or/**/1=1
The new query will not have spaces in the user input, but it will be valid,
returning all of the rows in the messages table.
The “Evading Input Filters” section in Chapter 7 explains in detail this
technique and many others used for signature evasion.
The following technique to confirm the existence of a vulnerability makes use of
SQL comments. Have a look at the following request:
http://www.victim.com/messages/list.aspx?uid=45/*hello yes*/
If vulnerable, the application will send the value of the uid followed by a comment.
If there are no problems processing the request and we get the same result we would get
with uid=45, this means the database ignored the content of the comment. This might be
due to an SQL injection vulnerability.
Using Comments
Let’s see how we can use comments to terminate SQL statements.
We are going to use the authentication mechanism in the Victim Inc. administration
Web site. Figure 2.15 represents the concept of terminating the SQL statement.