The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Manipulating Blocked Strings

If the application blocks certain strings that you wish to place as data items

within an injected query, then the required string can be constructed dynami-

cally using various string manipulation functions. For example, if the expres-

sion 

admin

is being blocked, then you can build this in the following ways: 

■■

Oracle:

‘adm’||’in’

■■

MS-SQL:

‘adm’+’in’

■■

MySQL:

concat(‘adm’,’in’)

Most databases contain many custom functions for string manipulation that

can be used to construct blocked strings in arbitrarily complex ways, in order

to circumvent different input validation filters. For example, Oracle contains

the functions 

CHR

, 

REVERSE

, 

TRANSLATE

, 

REPLACE

, and 

SUBSTR

. A function like

CHR

can be used to introduce a literal string in cases where single quotation

marks are being blocked. For example, the following query effectively smug-

gles in the string 

admin

:

SELECT password from users where username = chr(97) || chr(100) ||

chr(109) || chr(105) || chr(110)