the-web-application-hackers-handbook

324 Chapter 9 n Attacking Data Stores
connect to a nonexistent server, causing a timeout. This causes the database
to attempt to connect to the specified server and eventually time out. For
example:
SELECT ‘a’||Utl_Http.request(‘http://madeupserver.com’) from dual
...delay...
ORA-29273: HTTP request failed
ORA-06512: at “SYS.UTL_HTTP”, line 1556
ORA-12545: Connect failed because target host or object does not exist
You can leverage this behavior to cause a time delay contingent on some
condition that you specify. For example, the following query causes a timeout
if the default Oracle account DBSNMP exists:
SELECT ‘a’||Utl_Http.request(‘http://madeupserver.com’) FROM dual WHERE
(SELECT username FROM all_users WHERE username = ‘DBSNMP’) = ‘DBSNMP’
In both Oracle and MySQL databases, you can use the SUBSTR(ING)and ASCII
functions to retrieve arbitrary information one byte at a time, as described
previously.
TIP We have described the use of time delays as a means of extracting
interesting information. However, the time-delay technique can also be
immensely useful when performing initial probing of an application to
detect SQL injection vulnerabilities. In some cases of completely blind
SQL injection, where no results are returned to the browser and all errors
are handled invisibly, the vulnerability itself may be hard to detect using
standard techniques based on supplying crafted input. In this situation,
using time delays is often the most reliable way to detect the presence of a
vulnerability during initial probing. For example, if the back-end database
is MS-SQL, you can inject each of the following strings into each request
parameter in turn and monitor how long the application takes to identify
any vulnerabilities:
‘; waitfor delay ‘0:30:0’--
1; waitfor delay ‘0:30:0’--
TRY IT!
This lab example contains a SQL injection vulnerability with no error feedback.
You can use it to practice various advanced techniques, including the
use of conditional responses and time delays.
http://mdsec.net/addressbook/44/