SQL Injection Strategies by Ettore Galluccio Edoardo Caselli and Gabriele Lombari

Author:Ettore Galluccio, Edoardo Caselli and Gabriele Lombari
Language: eng
Format: epub
Publisher: packt publishing Pvt Ltd
Published: 2020-07-14T00:00:00+00:00

Figure 4.27 – SQLol challenge 5 Boolean result

Now that we know what a true result looks like, we can guess the output using checks. Since we need to reconstruct the data, we need a way to spot the content of the table using only Boolean answers. The most common technique we can use is to check for single characters using the SUBSTRING(s, d, n) function. This takes, given s tring s, the number (n) of characters after the position, p, of that string. SUBSTRING('hello', 1, 1) would return h, which is located at a 1 character distance after the first position (1).

For each record, we will check the characters of the fields one by one, using both the SUBSTRING() function and the LIMIT 1 OFFSET clause, as we need to check each record separately in order to infer them with certainty. This is definitely a long process, but we have another trick up our sleeve to speed it all up: binary search. We will use the ASCII() function, which returns the ASCII encoding number of a single character, and compare it each time with a number, which will be the pivot of our binary search. In the ASCII encoding, we have 255 possible values, so our optimal pivot will be the middle value (128). By comparing this with 128, we can tell whether the character belongs to the lower or upper part of the range, and we will split our possible range into two each time.

If, for example, our check tells us that the character's ASCII is equal or greater than 128, then next time we will try with 192 as the pivot. If not, we will go down to 64. Each time, we will be splitting the range into two, thus drastically reducing the number of steps for guessing.

For this walk-through, once again, we will skip directly to the ssn table. However, for the complete attack, you should apply this method to all of the earlier discovery steps and the table fields too. We prefer to leave this up to the reader to decide.

Let's try using the ' OR ASCII(SUBSTRING((SELECT NAME FROM SSN LIMIT 1 OFFSET 0),1,1)) >= 128 -- - payload to apply this principle to our specific case, with number 128 as the pivot of our search:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.