The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

immensely useful when performing initial probing of an application to detect

SQL injection vulnerabilities. In some cases of completely blind SQL injection,

where no results are returned to the browser and all errors are handled

invisibly, the vulnerability itself may be very hard to detect using standard

techniques based on supplying crafted input. In this situation, using time delays

is often the most reliable way of detecting the presence of a vulnerability

during initial probing. For example, if the back-end database is MS-SQL, then

you can inject each of the following strings into each request parameter in turn,

and monitor the time taken for the application to respond to identify any

vulnerabilities:

‘; waitfor delay ‘0:30:0’--

1; waitfor delay ‘0:30:0’--

Beyond SQL Injection: Escalating the Database Attack

A successful exploit of an SQL injection vulnerability very often results in total

compromise of all application data. Most applications employ a single account

for all database access and rely upon application-layer controls to enforce seg-

regation of access between different users. Gaining unrestricted use of the

application’s database account results in access to all of its data. 

You may suppose, therefore, that owning all of the application’s data is the

finishing point of a SQL injection attack. However, there are many reasons

why it might be productive to advance your attack further, either by exploiting

a vulnerability within the database itself, or by harnessing some of its built-in

functionality to achieve your objectives. Further attacks that can be performed

by escalating the database attack include the following:

■■

If the database is shared with other applications, you may be able to

escalate privileges within the database and gain access to other applica-

tions’ data.