Types Of SQL Injection

Introduction

 

This article is going to focus on the different types of SQL Injection attack methods. In a previous article, we took an introductory approach to SQL Injection and simply listed the types of SQL Injection and we managed to look at some examples of SQL injection. This time we will dive into the types of SQL Injection as well as try to give real-world examples of each type.

 

SQL Injection is a popular malicious attack on websites and web applications which involves the use of SQL statements through user input. SQL Injection may be used to tamper with organizational sensitive data, identity theft and exposing organizational sensitive data. This may result in financial loss to organizations or reputational damage of the organization or the web application/website.

 

Types of SQL Injections

 

The three different categories of SQL Injection are,

• In-band (Classic)
• Inferential(Blind)
• Out-of-Band

In-band Injection

 

Error-based SQLi and Union-based SQLi are the most commonly used In-band SQLi. In-band SQLi entails that an attack is launched and the attacker uses the same channel to obtain results.

 

Error-based SQLi

 

The user intentionally adds characters such as ‘,”,/*, etc to the input to invoke an error from the application

 

Then if you go on the code-behind file, you might find code like this,

Using con As New SqlConnection(ConfigurationManager.ConnectionStrings("Constring").ConnectionString)

                Using cmd1 = New SqlCommand("select  from tbl_users where user_login='" +  user_login + "'", con)

Notice that the server shows the user the error in syntax ‘from’ hence the attacker may use these prompts to launch an attack.

 

If the attacker replaces the username with,

'OR '1'='1';Select @@version  --'

Notice how the attacker obtains database information using the In-band method of injection and he may make use of the error dialogs to view information about the internal details of the database and may end up deleting some data.  

 

Union-based SQLi

 

As the name suggests this method makes use of the UNION SQL operator, which combines two statements. When using the SQL, UNION operator the SELECT statements must be similar, with the same number of columns and having same data types.

 

Example

i.e. SELECT user_id,user_login,password,user_type FROM customers UNION SELECT perm_id,username,password,role from Sys_Permissions

Once an attacker has got information about the database using the @@version keyword it is easier for them to now execute UNION statements trying out various table names and column combinations.

 

Inferential SQLi (Blind)

 

Inferential SQLi has two groups namely the Boolean-based and Time-based. They rely on the response from the server, which means it is a trial and error exercise. The attacker sends payloads to the server, waits for a response this, and is never sure of the execution of the SQL query thus the name "Blind". Unlike In-band, the attacker does not get the data from the website database.

 

Boolean-based Injection

 

The attacker needs to send values to the server and the server response is either TRUE/FALSE. In Boolean-based the attackers normally depend on guessing and that is why it takes a large amount of time. Unlike with In-band Injection, there is no direct response or result that the execution has been successful. The attacker has to guess number of columns and column names in the table and the underlying query, which is executing the requests. An example of Boolean-based Injection is given below,

 

Example

 

http://MyShopOnline/Products/?id=4401 or 1=1

 

This means the underlying query at the server-side will be as follows and this may return a TRUE/FALSE response.

Select * from Para_Products where prodid='2 ' OR '1'='1' --;

Depending on the backend database, the database connection settings, and operating system an attacker can achieve to read, update, or delete arbitrary data/tables from the database.

 

The user may start by sending an SQL statement, which he knows, will return False such as 1=0, and take note of the response. He will then use this false response to determine his trial once he gets any response that is different from the latter.

 

Time-based Injection

 

In Time-based SQL Injection the attacker uses an SQL query to force the database to wait for a given length of time before in sends a response. The attacker uses this response time to determine his success.

 

Example

Select * from Para_Products where prodid='2 '  OR '1'='1'   WAITFOR DELAY '0:0:5'   --;

The time factor is used by utilizing the WAITFOR DELAY operator.

 

Out-of-band Injection

 

Out of the three Injection Types is the least common type of Injection. Unlike In-band, when using this method it does not use the same channel to obtain information, instead it uses DNS/HTTP protocol. This means that the web application being attacked must not have any security parameters to deny DNS or HTTP outbound requests. Out-of-band is faster than Inferential attacks. 

 

Conclusion

 

These are the main types of SQL Injection and in later articles; we will look at SQL Injection Protection Methods, other injection flaws, etc.