the-web-application-hackers-handbook

302 Chapter 9 n Attacking Data Stores
path traversal string, single quote, double quote, or any other arbitrary string.
Therefore, common techniques for both automated fuzzing and manual testing
are liable to overlook the vulnerability. The standard test strings for numerous
kinds of vulnerabilities will all cause the same response, which may not itself
disclose the nature of the error.
NOTE Some conventional SQL injection defenses described later in this
chapter cannot be implemented for user-specified column names. Using
prepared statements or escaping single quotes will not prevent this type of
SQL injection. As a result, this vector is a key one to look out for in modern
applications.
HACK STEPS
1. Make a note of any parameters that appear to control the order or field
types within the results that the application returns.
2. Make a series of requests supplying a numeric value in the parameter
value, starting with the number 1 and incrementing it with each subsequent
request:
n If changing the number in the input affects the ordering of the results,
the input is probably being inserted into an ORDER BY clause. In SQL,
ORDER BY 1 orders by the first column. Increasing this number to 2
should then change the display order of data to order by the second
column. If the number supplied is greater than the number of columns
in the result set, the query should fail. In this situation, you can confirm
that further SQL can be injected by checking whether the results order
can be reversed, using the following:
1 ASC --
1 DESC --
n If supplying the number 1 causes a set of results with a column containing
a 1 in every row, the input is probably being inserted into the name
of a column being returned by the query. For example:
SELECT 1,title,year FROM books WHERE publisher=’Wiley’
NOTE Exploiting SQL injection in an ORDER BY clause is significantly different
from most other cases. A database will not accept a UNION, WHERE, OR, or
AND keyword at this point in the query. Generally exploitation requires the
attacker to specify a nested query in place of the parameter, such as replacing
the column name with (select 1 where or 1/0=0),
thereby leveraging the inference techniques described later in this chapter.
For databases that support batched queries such as MS-SQL, this can be the
most efficient option.