SQL Injection Attacks and Defense - 2009

72 Chapter 2 • Testing for SQL Injection
Figure 2.16 shows an example of a multiline comment attack. Note that the text in the
Password field is disclosed for clarity. It illustrates an attack using multiline comments.
Figure 2.16 Using Multiline Comments
In this attack, we use the Username field to select the user we want and start the comment
with the /* sequence. In the Password field we finish the comment ( ∗/ ) and we add
the single-quote sequence to end the statement syntactically correct with no effect on the
result. The resultant SQL statement is:
SELECT *
FROM administrators
WHERE username = 'admin'/*' AND password = '*/ '';
Removing the commented code helps to better illustrate the example:
SELECT *
FROM administrators
WHERE username = 'admin' '';
As you can see, we needed to finish the statement with a string due to the last single
quote inserted by the application which we cannot control. We chose to concatenate an
empty string, which has no effect on the result of the query.
In the previous example, we concatenated our input with an empty string. String concatenation
is something you will always need when doing SQL injection testing. However, because
it is done differently in SQL Server, MySQL, and Oracle, it can therefore be used as a tool to
identify the remote database. Table 2.4 shows the concatenation operators in each database.