The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

283

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 283

---

Equipped with this command, the attacker can retrieve arbitrary informa-

tion in various ways. One method is to leverage the same technique already

described for the case where the application returns conditional responses.

Now, instead of triggering a different application response when a particular

condition is detected, the injected query instead induces a time delay. For

example, the second of these queries will cause a time delay, indicating that the

first letter of the captured string is A:

if ASCII(SUBSTRING(‘Admin’,1,1)) = 64 waitfor delay ‘0:0:5’

if ASCII(SUBSTRING(‘Admin’,1,1)) = 65 waitfor delay ‘0:0:5’

As before, the attacker can cycle through all possible values for each charac-

ter until a time delay occurs. Alternatively, the attack could be made more effi-

cient by reducing the number of requests needed. An additional technique to

that described previously for Absinthe is to break each byte of data down into

individual bits and retrieve each bit in a single query. The 

POWER

command and

the bitwise 

AND

operator 

&

can be used to specify conditions on a bit-by-bit

basis. For example, the following query will test the first bit of the first byte of

the captured data, and pause if it is 1:

if (ASCII(SUBSTRING(‘Admin’,1,1)) & (POWER(2,0))) > 0 waitfor delay

‘0:0:5’

The following query will perform the same test on the second bit:

if (ASCII(SUBSTRING(‘Admin’,1,1)) & (POWER(2,1))) > 0 waitfor delay

‘0:0:5’

As mentioned earlier, the means of inducing a time delay are highly database-

dependent. Other databases do not contain a built-in time-delay command;

however, you can easily use other tricks to cause a time delay to occur.

In MySQL, the benchmark function can be used to perform a specified

action repeatedly. Instructing the database to perform a processor-intensive

action, such as a SHA-1 hash, a large number of times will result in a measur-

able time delay. For example:

select if(user() like ‘root@%‘, benchmark(50000,sha1(‘test’)), ‘false’)

In Oracle, one trick is to use 

UTL_HTTP

to connect to a nonexistent server,

causing a timeout. This will cause the database to attempt to connect to the

specified server, and eventually timeout. For example:

SELECT ‘a’||Utl_Http.request(‘http://madeupserver.com’) from dual

...delay...

ORA-29273: HTTP request failed

ORA-06512: at “SYS.UTL_HTTP”, line 1556

ORA-12545: Connect failed because target host or object does not exist