The outline techniques are known as blind as fuel injection the methodology of this attack type relies
not only on embedding single expressions like o'War one equals one into as Cuil commands entire statements
or complicated expressions logical conditions.
Tests can be injected as well.
You can communicate with the server without having access to a server interface by using only information
returned or not returned an error messages.
This is one of the most popular techniques for blindest fuel injection and other method is a technique
that relies on measuring the times needed to execute a query.
It's worth noting that this is not the sole alternative.
An attacker can try to embed some commands and attempt to delay an execution of equerry if an application
responds immediately.
The attacker will know that the answer to command has not been executed.
If the answer is delayed by for example two seconds this is proof that the command has been executed
despite no credentials having been directly obtain.
Remember the results are visible for us in an editor window an attacker would not be able to see the
results.
A database server as you can now see will execute any well-formed command to execute it.
However the instruction must refer to another command that is contained in an object database.
The command has to be both syntactically and semantically well-formed.
You should not expect an application like Hackney travel to which were quickly logged in.
See the taskbar where were logged as user to display and tired tables with data when you type.
Select a posture from table.
This isn't likely.
Apart from that error messages might be filtered and replaced with messages that are more general.
This is a good practice as far as application security is concerned and end users should not be able
to see any detailed error messages
despite this plan Eskew all injection is still possible.
Why is that.
It's because we're able to execute commands that are sure to always be executed.
This is the basic idea behind blindest fuel injection.
If you know such commands this requires the knowledge of a specific dialect of a given language or the
knowledge of the database server.
You can ask server questions that will always be answered with true or false.
Something is or is not executable.
This is obviously a time consuming solution but it can be used to obtain all needed or relevant information.
Let's use a particular blind bascule injection attack that targeted a really large web application several
years ago as a case study.
The fact that the text application was Espey net based is largely irrelevant all this means is that
a given application certainly uses a Microsoft database server.
It's difficult to imagine otherwise the reverse configuration is possible.
But if an application is based on HSP dot net it almost certainly uses some version of an Escuela server
a common feature of web applications is that they are publicly available.
This is one of their strengths.
They attacked the application was also a public
blogging form and the application required the submission of a log in and password.
What's more the form and allows users to reset their password if a user forgot their password.
They did not have to contact an administrator.
The process could have been done automatically.
This was possible because clicking on the Remine password button send a user's password to the email
address submitted during registration.
It would be absurd to send the forgotten password to an address submitted only a while ago by a user.
Attackers checked that after entering a single quote into a user field and clicking on the send password
button.
The application reported a specific error.
The query executed at this point by the application might have looked like this.
Note that we mentioned a single quote the above listing has three apostrophe's the same was the case
with the examples we showed before.
We'll come back to this later in our presentations.
It's worth noting however that the key here is the correct ending of a line.
Why are there three or just one apostrophe.
Alternately if a command itself used a single quote to make a quarter quote It has to be preceded with
another quote.
This is how as QOL is written and unfortunately it's not the only language that is constructed in this
way.
Many languages need to double a control character to make it retain its meaning.
We would like to end this string.
This means we need another apostrophe.
We'll come back to this subject later.
When trying to submit a different username the attackers clicked send this prompted a different error
message.
This was no longer error 500.
Instead the unknown user error message would be displayed if a true expression was entered into a user
field like o'War one equals one.
An interesting message would be prompted a new password has been sent.
We might assume that the server executed the following query as we saw it before.
This is more or less the use line of reasoning at this point the first user in a table received an email
that contained a new password.
Regrettably But let's not cry over spilled milk.
This means that we have three system reactions.
We sent a new password to a user.
We got an error 500 message or a user unknown error message 3 system reactions have been discovered.
Let's try to find the names of the table columns.
We had a chance to see one of the methods used for extracting this data live using executable instructions
this information can be checked also in a different manner.
Take a guess at the columns name and check system reaction.
See if this brings an error or not and if the column is contained in the table at all as you already
know we can communicate with the application by interpreting messages like user unknown or internal
server error.
When the column names are obtained it's time to extract the table name.
In order to do this you can use a sub query that again takes a guess at the table name.
The method we saw before was more universal.
The table name would be returned in an error message at once
having acquired the names of the columns in the name of the table.
You need to verify if the table name is really correct.
This is essential since most database servers object names are made up from two parts a table name is
preceded by a name that is known as a schema.
This means that the same table name might be reused multiple times inside a database.
Need to be sure that you have both the name of the schema and the table name.
You can put a schema head of the table name in a query and see the results
having obtained this information.
You can try to read user data in this case however the attackers opted for another solution.
They decided to change an email address of one of the users.
Why would they do that.
Remember that the application sends a new password to an email address supplied at registration knowing
this we chose a user who we suspect to be an administrator and update the email address column of this
user by entering an arbitrary email to which we'd like a new password to be sent.
It turns out that this approach is adequate the system forwards and password with administrative permissions
to the attacker on its own.