the-web-application-hackers-handbook

316 Chapter 9 n Attacking Data Stores
TIP There are numerous subtle variations in how different database platforms
handle string manipulation and numeric computation, which you may
need to take into account when performing advanced attacks of this kind. An
excellent guide to these differences covering many different databases can be
found at http://sqlzoo.net/howto/source/z.dir/i08fun.xml.
In a variation on this situation, the authors have encountered cases in which
what is returned by the application is not an actual number, but a resource for
which that number is an identifier. The application performs a SQL query based
on user input, obtains a numeric identifier for a document, and then returns the
document’s contents to the user. In this situation, an attacker can first obtain
a copy of every document whose identifiers are within the relevant numeric
range and construct a mapping of document contents to identifiers. Then, when
performing the attack described previously, the attacker can consult this map to
determine the identifier for each document received from the application and
thereby retrieve the ASCII value of the character he has successfully extracted.
Using an Out-of-Band Channel
In many cases of SQL injection, the application does not return the results of
any injected query to the user’s browser, nor does it return any error messages
generated by the database. In this situation, it may appear that your position is
futile. Even if a SQL injection flaw exists, it surely cannot be exploited to extract
arbitrary data or perform any other action. This appearance is false, however.
You can try various techniques to retrieve data and verify that other malicious
actions have been successful.
There are many circumstances in which you may be able to inject an arbitrary
query but not retrieve its results. Recall the example of the vulnerable login
form, where the username and password fields are vulnerable to SQL injection:
SELECT * FROM users WHERE username = ‘marcus’ and password = ‘secret’
In addition to modifying the query’s logic to bypass the login, you can inject
an entirely separate subquery using string concatenation to join its results to
the item you control. For example:
foo’ || (SELECT 1 FROM dual WHERE (SELECT username FROM all_users WHERE
username = ‘DBSNMP’) = ‘DBSNMP’)--
This causes the application to perform the following query:
SELECT * FROM users WHERE username = ‘foo’ || (SELECT 1 FROM dual WHERE
(SELECT username FROM all_users WHERE username = ‘DBSNMP’) = ‘DBSNMP’)