the-web-application-hackers-handbook

320 Chapter 9 n Attacking Data Stores
For example, submitting the following two pieces of input causes very different
results:
admin’ AND 1=1--
admin’ AND 1=2--
In the first case, the application logs you in as the admin user. In the second
case, the login attempt fails, because the 1=2 condition is always false. You
can leverage this control of the application’s behavior as a means of inferring
the truth or falsehood of arbitrary conditions within the database itself. For
example, using the ASCII and SUBSTRING functions described previously, you
can test whether a specific character of a captured string has a specific value. For
example, submitting this piece of input logs you in as the admin user, because
the condition tested is true:
admin’ AND ASCII(SUBSTRING(‘Admin’,1,1)) = 65--
Submitting the following input, however, results in a failed login, because
the condition tested is false:
admin’ AND ASCII(SUBSTRING(‘Admin’,1,1)) = 66--
By submitting a large number of such queries, cycling through the range
of likely ASCII codes for each character until a hit occurs, you can extract the
entire string, one byte at a time.
Inducing Conditional Errors
In the preceding example, the application contained some prominent functionality
whose logic could be directly controlled by injecting into an existing SQL
query. The application’s designed behavior (a successful versus a failed login)
could be hijacked to return a single item of information to the attacker. However,
not all situations are this straightforward. In some cases, you may be injecting
into a query that has no noticeable effect on the application’s behavior, such
as a logging mechanism. In other cases, you may be injecting a subquery or a
batched query whose results are not processed by the application in any way.
In this situation, you may struggle to find a way to cause a detectable difference
in behavior that is contingent on a specified condition.
David Litchfield devised a technique that can be used to trigger a detectable
difference in behavior in most circumstances. The core idea is to inject
a query that induces a database error contingent on some specified condition.
When a database error occurs, it is often externally detectable, either
through an HTTP 500 response code or through some kind of error message
or anomalous behavior (even if the error message itself does not disclose any
useful information).