The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Using Inference: Conditional Responses

There are many reasons why an out-of-band channel may not be available —

most commonly, because the database is located within a protected network

whose perimeter firewalls do not allow any outbound connections to the Inter-

net or any other network. In this situation, you are restricted to accessing the

database entirely via your injection point into the web application.

In this situation, working more or less blind, there are still techniques you

can use to retrieve arbitrary data from within the database. These techniques

are all based upon the concept of using an injected query to conditionally trig-

ger some detectable behavior by the database and then inferring a required

item of information on the basis of whether this behavior occurs.

This topic is a thriving area of current research into web application attack

techniques, and we will examine the very latest methods that have been

devised at the time of this writing.

Recall the vulnerable login function where the username and password

fields can be injected into to perform arbitrary queries:

SELECT * FROM users WHERE username = ‘marcus’ and password = ‘secret’

Suppose that you have not identified any method of transmitting the results

of your injected queries back to the browser. Nevertheless, you have already

seen how you can use SQL injection to modify the application’s behavior. For

example, submitting the following two pieces of input will cause very differ-

ent results:

admin’ AND 1=1--

admin’ AND 1=2--