the-web-application-hackers-handbook

300 Chapter 9 n Attacking Data Stores
HACK STEPS
1. Try supplying a simple mathematical expression that is equivalent to the
original numeric value. For example, if the original value is 2, try submitting
1+1 or 3-1. If the application responds in the same way, it may be
vulnerable.
2. The preceding test is most reliable in cases where you have confirmed
that the item being modified has a noticeable effect on the application’s
behavior. For example, if the application uses a numeric PageID
parameter to specify which content should be returned, substituting 1+1
for 2 with equivalent results is a good sign that SQL injection is present.
However, if you can place arbitrary input into a numeric parameter without
changing the application’s behavior, the preceding test provides no
evidence of a vulnerability.
3. If the first test is successful, you can obtain further evidence of the vulnerability
by using more complicated expressions that use SQL-specific keywords
and syntax. A good example of this is the ASCII command, which returns
the numeric ASCII code of the supplied character. For example, because the
ASCII value of A is 65, the following expression is equivalent to 2 in SQL:
67-ASCII(‘A’)
4. The preceding test will not work if single quotes are being filtered.
However, in this situation you can exploit the fact that databases implicitly
convert numeric data to string data where required. Hence, because
the ASCII value of the character 1 is 49, the following expression is equivalent
to 2 in SQL:
51-ASCII(1)
TIP A common mistake when probing an application for defects such as SQL
injection is to forget that certain characters have special meaning within HTTP
requests. If you want to include these characters within your attack payloads,
you must be careful to URL-encode them to ensure that they are interpreted in
the way you intend. In particular:
n & and = are used to join name/value pairs to create the query string and
the block of POST data. You should encode them using %26 and %3d,
respectively.
n Literal spaces are not allowed in the query string. If they are submitted,
they will effectively terminate the entire string. You should encode them
using + or %20.
n Because + is used to encode spaces, if you want to include an actual +
in your string, you must encode it using %2b. In the previous numeric
example, therefore, 1+1 should be submitted as 1%2b1.