The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Fingerprinting the Database

Most of the techniques described so far are effective against all of the common

database platforms, and any divergences have been accommodated through

minor adjustments to syntax. However, as we begin to look at more advanced

exploitation techniques, the differences between platforms become more sig-

nificant, and you will increasingly need to know which type of back-end data-

base you are dealing with.

You have already seen how you can extract the version string of the major

database types. Even if this cannot be done for some reason, it is usually pos-

sible to fingerprint the database using other methods. One of the most reliable

is the different means by which databases concatenate strings. In a query

where you control some item of string data, you can supply a particular value

in one request and then test different methods of concatenation to produce that

string. When the same results are obtained, you have probably identified the

type of database being used. The following examples show how the string

services

could be constructed on the common types of database:

■■