the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 291
Injecting into SQL
Almost every web application employs a database to store the various kinds of
information it needs to operate. For example, a web application deployed by an
online retailer might use a database to store the following information:
n User accounts, credentials, and personal information
n Descriptions and prices of goods for sale
n Orders, account statements, and payment details
n The privileges of each user within the application
The means of accessing information within the database is Structured Query
Language (SQL). SQL can be used to read, update, add, and delete information
held within the database.
SQL is an interpreted language, and web applications commonly construct
SQL statements that incorporate user-supplied data. If this is done in an unsafe
way, the application may be vulnerable to SQL injection. This flaw is one of the
most notorious vulnerabilities to have afflicted web applications. In the most
serious cases, SQL injection can enable an anonymous attacker to read and
modify all data stored within the database, and even take full control of the
server on which the database is running.
As awareness of web application security has evolved, SQL injection vulnerabilities
have become gradually less widespread and more difficult to detect
and exploit. Many modern applications avoid SQL injection by employing APIs
that, if properly used, are inherently safe against SQL injection attacks. In these
circumstances, SQL injection typically occurs in the occasional cases where these
defense mechanisms cannot be applied. Finding SQL injection is sometimes a
difficult task, requiring perseverance to locate the one or two instances in an
application where the usual controls have not been applied.
As this trend has developed, methods for finding and exploiting SQL injection
flaws have evolved, using more subtle indicators of vulnerabilities, and more
refined and powerful exploitation techniques. We will begin by examining
the most basic cases and then go on to describe the latest techniques for blind
detection and exploitation.
A wide range of databases are employed to support web applications. Although
the fundamentals of SQL injection are common to the vast majority of these, there
are many differences. These range from minor variations in syntax to significant
divergences in behavior and functionality that can affect the types of attacks you
can pursue. For reasons of space and sanity, we will restrict our examples to the
three most common databases you are likely to encounter — Oracle, MS-SQL,
and MySQL. Wherever applicable, we will draw attention to the differences
between these three platforms. Equipped with the techniques we describe here,