the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 305
This returns the results of the original search followed by the contents of
the users table:
AUTHOR TITLE YEAR
Litchfield The Database Hacker’s Handbook 2005
Anley The Shellcoder’s Handbook 2007
admin r00tr0x 0
cliff Reboot 1
NOTE When the results of two or more SELECT queries are combined using
the UNION operator, the column names of the combined result set are the
same as those returned by the first SELECT query. As shown in the preceding
table, usernames appear in the author column, and passwords appear in the
title column. This means that when the application processes the results
of the modified query, it has no way of detecting that the data returned has
originated from a different table.
This simple example demonstrates the potentially huge power of the UNION
operator when employed in a SQL injection attack. However, before it can be
exploited in this way, two important provisos need to be considered:
n When the results of two queries are combined using the UNION operator,
the two result sets must have the same structure. In other words, they must
contain the same number of columns, which have the same or compatible
data types, appearing in the same order.
n To inject a second query that will return interesting results, the attacker
needs to know the name of the database table that he wants to target, and
the names of its relevant columns.
Let’s look a little deeper at the first of these provisos. Suppose that the attacker
attempts to inject a second query that returns an incorrect number of columns.
He supplies this input:
Wiley’ UNION SELECT username,password FROM users--
The original query returns three columns, and the injected query returns
only two columns. Hence, the database returns the following error:
ORA-01789: query block has incorrect number of result columns
Suppose instead that the attacker attempts to inject a second query whose
columns have incompatible data types. He supplies this input:
Wiley’ UNION SELECT uid,username,password FROM users--