the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 303
Fingerprinting the Database
Most of the techniques described so far are effective against all the common
database platforms, and any divergences have been accommodated through
minor adjustments to syntax. However, as we begin to look at more advanced
exploitation techniques, the differences between platforms become more significant,
and you will increasingly need to know which type of back-end database
you are dealing with.
You have already seen how you can extract the version string of the major
database types. Even if this cannot be done for some reason, it is usually possible
to fingerprint the database using other methods. One of the most reliable
is the different means by which databases concatenate strings. In a query where
you control some item of string data, you can supply a particular value in one
request and then test different methods of concatenation to produce that string.
When the same results are obtained, you have probably identified the type of
database being used. The following examples show how the string services
could be constructed on the common types of database:
n Oracle: ‘serv’||’ices’
n MS-SQL: ‘serv’+’ices’
n MySQL: ‘serv’ ‘ices’ (note the space)
If you are injecting into numeric data, the following attack strings can be
used to fingerprint the database. Each of these items evaluates to 0 on the target
database and generates an error on the other databases:
n Oracle: BITAND(1,1)-BITAND(1,1)
n MS-SQL: @@PACK_RECEIVED-@@PACK_RECEIVED
n MySQL: CONNECTION_ID()-CONNECTION_ID()
NOTE The MS-SQL and Sybase databases share a common origin, so they
have many similarities in relation to table structure, global variables, and stored
procedures. In practice, the majority of the attack techniques against MS-SQL
described in later sections will work in an identical way against Sybase.
A further point of interest when fingerprinting databases is how MySQL
handles certain types of inline comments. If a comment begins with an exclamation
point followed by a database version string, the contents of the comment
are interpreted as actual SQL, provided that the version of the actual database
is equal to or later than that string. Otherwise, the contents are ignored and
treated as a comment. Programmers can use this facility much like preprocessor
directives in C, enabling them to write different code that will be processed