the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 293
In this case, the query interpreter reaches the string data in the same way as
before. It parses this data, which is encapsulated within single quotation marks,
and obtains the value O. It then encounters the expression Reilly’, which is not
valid SQL syntax, and therefore generates an error:
Incorrect syntax near ‘Reilly’.
Server: Msg 105, Level 15, State 1, Line 1
Unclosed quotation mark before the character string ‘
When an application behaves in this way, it is wide open to SQL injection.
An attacker can supply input containing a quotation mark to terminate the
string he controls. Then he can write arbitrary SQL to modify the query that
the developer intended the application to execute. In this situation, for example,
the attacker can modify the query to return every book in the retailer’s catalog
by entering this search term:
Wiley’ OR 1=1--
This causes the application to perform the following query:
SELECT author,title,year FROM books WHERE publisher = ‘Wiley’ OR
1=1--’ and published=1
This modifies the WHERE clause of the developer’s query to add a second
condition. The database checks every row in the books table and extracts
each record where the publisher column has the value Wiley or where 1 is
equal to 1. Because 1 always equals 1, the database returns every record in
the books table.
The double hyphen in the attacker’s input is a meaningful expression in SQL
that tells the query interpreter that the remainder of the line is a comment and
should be ignored. This trick is extremely useful in some SQL injection attacks,
because it enables you to ignore the remainder of the query created by the
application developer. In the example, the application encapsulates the usersupplied
string in single quotation marks. Because the attacker has terminated
the string he controls and injected some additional SQL, he needs to handle the
trailing quotation mark to avoid a syntax error, as in the O’Reilly example. He
achieves this by adding a double hyphen, causing the remainder of the query
to be treated as a comment. In MySQL, you need to include a space after the
double hyphen, or use a hash character to specify a comment.
The original query also controlled access to only published books, because
it specified and published=1. By injecting the comment sequence, the attacker
has gained unauthorized access by returning details of all books, published or
otherwise.