The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Advanced Exploitation

In all of the attacks described so far, there has been a ready means of retrieving

any useful data that was extracted from the database — for example, by per-

forming a 

UNION

attack or returning data in an error message. As awareness of

SQL injection threats has evolved, this kind of situation has become gradually

less common. It is increasingly the case that the SQL injection flaws that you

encounter will be in situations where retrieving the results of your injected

queries is not straightforward. We shall look at several ways in which this

problem can arise, and can be dealt with.

N OT E