The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

284

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 284

---

You can leverage this behavior to cause a time delay contingent on some

condition that you specify. For example, the following query will cause a time-

out if the default Oracle account 

DBSNMP

exists:

SELECT ‘a’||Utl_Http.request(‘http://madeupserver.com’) FROM dual WHERE

(SELECT username FROM all_users WHERE username = ‘DBSNMP’) = ‘DBSNMP’

In both Oracle and MySQL databases, you can use the 

SUBSTR(ING)

and

ASCII

functions to retrieve arbitrary information one byte at a time, as

described previously.

T I P

We have described the use of time delays as a means of extracting

interesting information. However, the time-delay technique can also be