The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

331

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 331

---

diagnosed several potential SQL injection flaws. Which one of the fol-

lowing would be the safest location to test whether more crafted input

has an effect on the application’s processing?

(a) Registering a new user

(b) Updating your personal details

(c) Unsubscribing from the service

4. You have found a SQL injection vulnerability in a login function, and

you try to use the input 

‘ or 1=1--

to bypass the login. Your attack

fails and the resulting error message indicates that the 

--

characters are

being stripped by the application’s input filters. How could you cir-

cumvent this problem?

5. You have found a SQL injection vulnerability but have been unable to

carry out any useful attacks because the application rejects any input

containing whitespace. How can you work around this restriction?

6. The application is doubling up all single quotation marks within user

input before these are incorporated into SQL queries. You have found a

SQL injection vulnerability in a numeric field, but you need to use a

string value in one of your attack payloads. How can you place a string

into your query without using any quotation marks?

7. In some rare situations, applications construct dynamic SQL queries out

of user-supplied input in a way that cannot be made safe using parame-

terized queries. When does this occur?

8. You have escalated privileges within an application such that you now

have full administrative access. You discover a SQL injection vulnera-

bility within a user administration function. How can you leverage this

vulnerability to further advance your attack?

9. You are attacking an application that holds no sensitive data, and con-

tains no authentication or access control mechanisms. In this situation,

how should you rank the significance of the following vulnerabilities?

(a) SQL injection

(b) XPath injection

(c) OS command injection

10. You are probing an application function that enables you to search per-

sonnel details. You suspect that the function is accessing either a data-

base or an Active Directory back end. How could you try to determine

which of these is the case?