the-web-application-hackers-handbook

290 Chapter 9 n Attacking Data Stores
all other accounts via the application. Furthermore, if the query returns the
details for more than one user, most applications will simply process the first
user whose details are returned. An attacker can often exploit this behavior to
log in as the first user in the database by supplying the username:
‘ OR 1=1--
This causes the application to perform the query:
SELECT * FROM users WHERE username = ‘’ OR 1=1--’ AND password = ‘foo’
Because of the comment symbol, this is equivalent to:
SELECT * FROM users WHERE username = ‘’ OR 1=1
which returns the details of all application users.
NOTE Injecting into an interpreted context to alter application logic is a
generic attack technique. A corresponding vulnerability could arise in LDAP
queries, XPath queries, message queue implementations, or indeed any
custom query language.
HACK STEPS
Injection into interpreted languages is a broad topic, encompassing many
different kinds of vulnerabilities and potentially affecting every component of
a web application’s supporting infrastructure. The detailed steps for detecting
and exploiting code injection flaws depend on the language that is being
targeted and the programming techniques employed by the application’s
developers. In every instance, however, the generic approach is as follows:
1. Supply unexpected syntax that may cause problems within the context of
the particular interpreted language.
2. Identify any anomalies in the application’s response that may indicate the
presence of a code injection vulnerability.
3. If any error messages are received, examine these to obtain evidence
about the problem that occurred on the server.
4. If necessary, systematically modify your initial input in relevant ways in an
attempt to confirm or disprove your tentative diagnosis of a vulnerability.
5. Construct a proof-of-concept test that causes a safe command to be
executed in a verifiable way, to conclusively prove that an exploitable
code injection flaw exists.
6. Exploit the vulnerability by leveraging the functionality of the target
language and component to achieve your objectives.