the-web-application-hackers-handbook

828 Chapter 21 n A Web Application Hacker’s Methodology
As always, be sure to URL-encode characters such as + and space that
have special meaning within HTTP requests.
7.2.5 If the original input is numeric, try using a mathematical expression that
is equivalent to the original value. For example, if the original value was
2, try submitting 1+1 or 3–1. If the application responds in the same way,
it may be vulnerable, particularly if the value of the numeric expression
has a systematic effect on the application’s behavior.
7.2.6 If the preceding test is successful, you can gain further assurance that
a SQL injection vulnerability is involved by using SQL-specific mathematical
expressions to construct a particular value. If the application’s
logic can be systematically manipulated in this way, it is almost certainly
vulnerable to SQL injection. For example, both of the following items
are equivalent to the number 2:
67-ASCII(‘A’)
51-ASCII(1)
7.2.7 If either of the fuzz test cases using the waitfor command resulted
in an abnormal time delay before the application responded, this is a
strong indicator that the database type is MS-SQL and the application
is vulnerable to SQL injection. Repeat the test manually, specifying different
values in the waitfor parameter, and determine whether the time
taken to respond varies systematically with this value. Note that your
attack payload may be inserted into more than one SQL query, so the
time delay observed may be a fixed multiple of the value specified.
7.2.8 If the application is vulnerable to SQL injection, consider what kinds
of attacks are feasible and likely to help you achieve your objectives.
Refer to Chapter 9 for the detailed steps needed to carry out any of the
following attacks:
n Modify the conditions within a WHERE clause to change the application’s
logic (for example, by injecting or 1=1-- to bypass a login).
n Use the UNION operator to inject an arbitrary SELECT query and combine
the results with those of the application’s original query.
n Fingerprint the database type using database-specific SQL syntax.
n If the database type is MS-SQL and the application returns ODBC error
messages in its responses, leverage these to enumerate the database
structure and retrieve arbitrary data.
n If you cannot find a way to directly retrieve the results of an arbitrary
injected query, use the following advanced techniques to extract data:
n Retrieve string data in numeric form, one byte at a time.
n Use an out-of-band channel.