SQL Injection Attacks and Defense - 2009

74 Chapter 2 • Testing for SQL Injection
Table 2.5 Continued. Signatures Using Database Comments
Testing String Variations Expected Results
-1 and 1=2-- -1) and 1=2-- Return no rows injecting a numeric parameter
‘ and ‘1’=‘2’-- ‘) and ‘1’=‘2’-- Return no rows injecting a string parameter
1/*comment*/
Comment injection. If successful, it makes no
difference to the original request. Helps identify
SQL injection vulnerabilities
Executing Multiple Statements
Terminating an SQL statement provides you with greater control over the SQL code sent to
the database server. In fact, this control goes beyond the statement created by the database.
If you terminate the SQL statement you can create a brand-new one with no restrictions on it.
Microsoft SQL Server 6.0 introduced server-side cursors to its architecture, which provided
the functionality of executing a string with multiple statements over the same connection
handle. This functionality is also supported in all the later versions and allows the execution of
statements such as the following:
SELECT foo FROM bar; SELECT foo2 FROM bar2;
The client connects to the SQL Server and sequentially executes each statement.
The database server returns to the client as many result sets as statements were sent.
MySQL has also introduced this functionality in Version 4.1 and later; however, this is not
enabled by default. Oracle databases don’t support multiple statements, unless using PL/SQL.
The exploitation technique requires that you are able to terminate the first statement,
so you can then concatenate arbitrary SQL code.
This concept can be exploited in a number of ways. Our first example will target an
application connecting to an SQL Server database. We are going to use multiple statements
to escalate privileges within the application—for example, by adding our user to the administrators
group. Our goal will be to run an UPDATE statement for that:
UPDATE users /* Update table Users */
SET isadmin=1 /* Add administrator privileges in the application */
WHERE uid= /* to your user */
We need to start the attack, enumerating columns using the HAVING 1=1 and
GROUP BY technique explained before:
http://www.victim.com/welcome.aspx?user=45; select * from users
having 1=1;--