the-web-application-hackers-handbook

322 Chapter 9 n Attacking Data Stores
This appears in the following back-end query, which parameterizes the department
parameter but concatenates the sort parameter onto the query:
String queryText = “SELECT ename,job,deptno,hiredate FROM emp WHERE deptno = ?
ORDER BY “ + request.getParameter(“sort”) + “ DESC”;
It is not possible to alter the WHERE clause, or issue a UNION query after an ORDER
BY clause; however, an attacker can create an inference condition by issuing the
following statement:
/search.jsp?department=20&sort=(select%201/0%20from%20dual%20where%20
(select%20substr(max(object_name),1,1)%20FROM%20user_objects)=’Y’)
If the first letter of the first object name in the user_objects table is equal
to ‘Y’, this will cause the database to attempt to evaluate 1/0. This will result
in an error, and no results will be returned by the overall query. If the letter
is not equal to ‘Y’, results from the original query will be returned in the
default order. Carefully supplying this condition to an SQL injection tool
such as Absinthe or SQLMap, we can retrieve every record in the database.
Using Time Delays
Despite all the sophisticated techniques already described, there may yet be
situations in which none of these tricks are effective. In some cases, you may
be able to inject a query that returns no results to the browser, cannot be used
to open an out-of-band channel, and that has no effect on the application’s
behavior, even if it induces an error within the database itself.
In this situation, all is not lost, thanks to a technique invented by Chris Anley
and Sherief Hammad of NGSSoftware. They devised a way of crafting a query
that would cause a time delay, contingent on some condition specified by the
attacker. The attacker can submit his query and then monitor the time taken for
the server to respond. If a delay occurs, the attacker may infer that the condition
is true. Even if the actual content of the application’s response is identical
in the two cases, the presence or absence of a time delay enables the attacker to
extract a single bit of information from the database. By performing numerous
such queries, the attacker can systematically retrieve arbitrarily complex data
from the database one bit at a time.
The precise means of inducing a suitable time delay depends on the target
database being used. MS-SQL contains a built-in WAITFOR command, which can
be used to cause a specified time delay. For example, the following query causes
a time delay of 5 seconds if the current database user is sa:
if (select user) = ‘sa’ waitfor delay ‘0:0:5’