the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 329
n Determine the location of the vulnerable field within the back-end SQL
query by appending various characters such as closing brackets, comment
characters, and SQL keywords.
n Attempt to perform a UNION attack by brute-forcing the number of required
columns and then identifying a column with the varchar data type, which
can be used to return results.
n Inject custom queries to retrieve arbitrary data — if necessary, concatenating
data from multiple columns into a string that can be retrieved
through a single result of the varchar data type.
n If results cannot be retrieved using UNION, inject Boolean conditions (AND
1=1, AND 1=2, and so on) into the query to determine whether conditional
responses can be used to retrieve data.
n If results cannot be retrieved by injecting conditional expressions, try
using conditional time delays to retrieve data.
These tools locate data by querying the relevant metadata tables for the database
in question. Generally they can perform some level of escalation, such as
using xp_cmdshell to gain OS-level access. They also use various optimization
techniques, making use of the many features and built-in functions in the various
databases to decrease the number of necessary queries in an inference-based
brute-force attack, evade potential filters on single quotes, and more.
NOTE These tools are primarily exploitation tools, best suited to extracting
data from the database by exploiting an injection point that you have already
identified and understood. They are not a magic bullet for finding and exploiting
SQL injection flaws. In practice, it is often necessary to provide some
additional SQL syntax before and/or after the data injected by the tool for the
tool’s hard-coded attacks to work.
HACK STEPS
When you have identified a SQL injection vulnerability, using the techniques
described earlier in this chapter, you can consider using a SQL injection tool to
exploit the vulnerability and retrieve interesting data from the database. This
option is particularly useful in cases where you need to use blind techniques
to retrieve a small amount of data at a time.
1. Run the SQL exploitation tool using an intercepting proxy. Analyze the
requests made by the tool as well as the application’s responses. Turn on
any verbose output options on the tool, and correlate its progress with the
observed queries and responses.
Continued