the-web-application-hackers-handbook

312 Chapter 9 n Attacking Data Stores
n When attempting to inject batched queries into an MS-SQL database,
you do not need to use the semicolon separator. Provided that you fix
the syntax of all queries in the batch, the query parser will interpret them
correctly, whether or not you include a semicolon.
TRY IT!
http://mdsec.net/addressbook/71/
http://mdsec.net/addressbook/76/
Circumventing Simple Validation
Some input validation routines employ a simple blacklist and either block or
remove any supplied data that appears on this list. In this instance, you should
try the standard attacks, looking for common defects in validation and canonicalization
mechanisms, as described in Chapter 2. For example, if the SELECT
keyword is being blocked or removed, you can try the following bypasses:
SeLeCt
%00SELECT
SELSELECTECT
%53%45%4c%45%43%54
%2553%2545%254c%2545%2543%2554
TRY IT!
http://mdsec.net/addressbook/58/
http://mdsec.net/addressbook/62/
Using SQL Comments
You can insert inline comments into SQL statements in the same way as for C++,
by embedding them between the symbols /* and */. If the application blocks
or strips spaces from your input, you can use comments to simulate whitespace
within your injected data. For example:
SELECT/*foo*/username,password/*foo*/FROM/*foo*/users
In MySQL, comments can even be inserted within keywords themselves,
which provides another means of bypassing some input validation filters while
preserving the syntax of the actual query. For example:
SEL/*foo*/ECT username,password FR/*foo*/OM users