the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 295
profile, or performing a search. They are also often used in login functions where
user-supplied information is checked against data retrieved from a database.
As in the previous examples, the entry point for SQL injection attacks normally
is the query’s WHERE clause. User-supplied items are passed to the database to
control the scope of the query’s results. Because the WHERE clause is usually the
final component of a SELECT statement, this enables the attacker to use the comment
symbol to truncate the query to the end of his input without invalidating
the syntax of the overall query.
Occasionally, SQL injection vulnerabilities occur that affect other parts of the
SELECT query, such as the ORDER BY clause or the names of tables and columns.
TRY IT!
http://mdsec.net/addressbook/32/
INSERT Statements
INSERT statements are used to create a new row of data within a table. They are
commonly used when an application adds a new entry to an audit log, creates
a new user account, or generates a new order.
For example, an application may allow users to self-register, specifying their
own username and password, and may then insert the details into the users
table with the following statement:
INSERT INTO users (username, password, ID, privs) VALUES (‘daf’,
‘secret’, 2248, 1)
If the username or password field is vulnerable to SQL injection, an attacker can
insert arbitrary data into the table, including his own values for ID and privs.
However, to do so he must ensure that the remainder of the VALUES clause is
completed gracefully. In particular, it must contain the correct number of data
items of the correct types. For example, injecting into the username field, the
attacker can supply the following:
foo’, ‘bar’, 9999, 0)--
This creates an account with an ID of 9999 and privs of 0. Assuming that the
privs field is used to determine account privileges, this may enable the attacker
to create an administrative user.
In some situations, when working completely blind, injecting into an INSERT
statement may enable an attacker to extract string data from the application. For
example, the attacker could grab the version string of the database and insert
this into a field within his own user profile, which can be displayed back to his
browser in the normal way.