the-web-application-hackers-handbook

296 Chapter 9 n Attacking Data Stores
TIP When attempting to inject into an INSERT statement, you may not know
in advance how many parameters are required, or what their types are. In the
preceding situation, you can keep adding fields to the VALUES clause until the
desired user account is actually created. For example, when injecting into the
username field, you could submit the following:
foo’)--
foo’, 1)--
foo’, 1, 1)--
foo’, 1, 1, 1)--
Because most databases implicitly cast an integer to a string, an integer
value can be used at each position. In this case the result is an account with
a username of foo and a password of 1, regardless of which order the other
fields are in.
If you find that the value 1 is still rejected, you can try the value 2000,
which many databases also implicitly cast to date-based data types.
When you have determined the correct number of fields following the injection
point, on MS-SQL you can add a second arbitrary query and use one of
the inference-based techniques described later in this chapter.
In Oracle, a subselect query can be issued within an insert query. This
subselect query can cause a success or failure of the main query, using the
inference-based techniques described later.
TRY IT!
http://mdsec.net/addressbook/12/
UPDATE Statements
UPDATE statements are used to modify one or more existing rows of data within
a table. They are often used in functions where a user changes the value of data
that already exists — for example, updating her contact information, changing
her password, or changing the quantity on a line of an order.
A typical UPDATE statement works much like an INSERT statement, except that
it usually contains a WHERE clause to tell the database which rows of the table to
update. For example, when a user changes her password, the application might
perform the following query:
UPDATE users SET password=’newsecret’ WHERE user = ‘marcus’ and password
= ‘secret’
This query in effect verifies whether the user’s existing password is correct
and, if so, updates it with the new value. If the function is vulnerable to SQL