the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 299
2. If an error or other divergent behavior was observed, submit two single
quotation marks together. Databases use two single quotation marks as
an escape sequence to represent a literal single quote, so the sequence is
interpreted as data within the quoted string rather than the closing string
terminator. If this input causes the error or anomalous behavior to disappear,
the application is probably vulnerable to SQL injection.
3. As a further verification that a bug is present, you can use SQL concatenator
characters to construct a string that is equivalent to some benign
input. If the application handles your crafted input in the same way as it
does the corresponding benign input, it is likely to be vulnerable. Each
type of database uses different methods for string concatenation. The
following examples can be injected to construct input that is equivalent to
FOO in a vulnerable application:
n Oracle: ‘||’FOO
n MS-SQL: ‘+’FOO
n MySQL: ‘ ‘FOO (note the space between the two quotes)
TIP One way of confirming that the application is interacting with a backend
database is to submit the SQL wildcard character % in a given parameter.
For example, submitting this in a search field often returns a large number of
results, indicating that the input is being passed into a SQL query. Of course,
this does not necessarily indicate that the application is vulnerable — only that
you should probe further to identify any actual flaws.
TIP While looking for SQL injection using a single quote, keep an eye
out for any JavaScript errors occurring when your browser processes the
returned page. It is fairly common for user-supplied input to be returned
within JavaScript, and an unsanitized single quote will cause an error in the
JavaScript interpreter, just as it does in the SQL interpreter. The ability to
inject arbitrary JavaScript into responses allows cross-site scripting attacks, as
described in Chapter 12.
Injecting into Numeric Data
When user-supplied numeric data is incorporated into a SQL query, the application
may still handle this as string data by encapsulating it within single quotation
marks. Therefore, you should always follow the steps described previously for string
data. In most cases, however, numeric data is passed directly to the database in
numeric form and therefore is not placed within single quotation marks. If none
of the previous tests points toward the presence of a vulnerability, you can take
some other specific steps in relation to numeric data.