the-web-application-hackers-handbook

306 Chapter 9 n Attacking Data Stores
This causes the database to attempt to combine the password column from the
second query (which contains string data) with the year column from the first
query (which contains numeric data). Because string data cannot be converted
into numeric data, this causes an error:
ORA-01790: expression must have same datatype as corresponding expression
NOTE The error messages shown here are for Oracle. The equivalent
messages for other databases are listed in the later section “SQL Syntax and
Error Reference.”
In many real-world cases, the database error messages shown are trapped
by the application and are not be returned to the user’s browser. It may appear,
therefore, that in attempting to discover the structure of the first query, you are
restricted to pure guesswork. However, this is not the case. Three important
points mean that your task usually is easy:
n For the injected query to be capable of being combined with the first, it is
not strictly necessary that it contain the same data types. Rather, they must
be compatible. In other words, each data type in the second query must
either be identical to the corresponding type in the first or be implicitly
convertible to it. You have already seen that databases implicitly convert
a numeric value to a string value. In fact, the value NULL can be converted
to any data type. Hence, if you do not know the data type of a particular
field, you can simply SELECT NULL for that field.
n In cases where the application traps database error messages, you can
easily determine whether your injected query was executed. If it was,
additional results are added to those returned by the application from its
original query. This enables you to work systematically until you discover
the structure of the query you need to inject.
n In most cases, you can achieve your objectives simply by identifying a
single field within the original query that has a string data type. This is
sufficient for you to inject arbitrary queries that return string-based data
and retrieve the results, enabling you to systematically extract any desired
data from the database.
HACK STEPS
Your first task is to discover the number of columns returned by the original
query being executed by the application. You can do this in two ways:
1. You can exploit the fact that NULL can be converted to any data type to
systematically inject queries with different numbers of columns until your
injected query is executed. For example: