the-web-application-hackers-handbook

294 Chapter 9 n Attacking Data Stores
TIP In some situations, an alternative way to handle the trailing quotation
mark without using the comment symbol is to “balance the quotes.” You finish
the injected input with an item of string data that requires a trailing quote
to encapsulate it. For example, entering the search term:
Wiley’ OR ‘a’ = ‘a
results in the query:
SELECT author,title,year FROM books WHERE publisher = ‘Wiley’ OR
‘a’=’a’ and published=1
This is perfectly valid and achieves the same result as the 1 = 1 attack to
return all books published by Wiley, regardless of whether they have been
published.
This example shows how application logic can be bypassed, allowing an access
control flaw in which the attacker can view all books, not just books matching
the allowed filter (showing published books). However, we will describe
shortly how SQL injection flaws like this can be used to extract arbitrary data
from different database tables and to escalate privileges within the database
and the database server. For this reason, any SQL injection vulnerability should
be regarded as extremely serious, regardless of its precise context within the
application’s functionality.
Injecting into Different Statement Types
The SQL language contains a number of verbs that may appear at the beginning
of statements. Because it is the most commonly used verb, the majority of SQL
injection vulnerabilities arise within SELECT statements. Indeed, discussions
about SQL injection often give the impression that the vulnerability occurs only
in connection with SELECT statements, because the examples used are all of this
type. However, SQL injection flaws can exist within any type of statement. You
need to be aware of some important considerations in relation to each.
Of course, when you are interacting with a remote application, it usually is
not possible to know in advance what type of statement a given item of user
input will be processed by. However, you can usually make an educated guess
based on the type of application function you are dealing with. The most common
types of SQL statements and their uses are described here.
SELECT Statements
SELECT statements are used to retrieve information from the database. They are
frequently employed in functions where the application returns information in
response to user actions, such as browsing a product catalog, viewing a user’s