Common Attack Pattern Enumeration and Classification

High

High

1. Hypothesize SQL queries in application:

   Generated hypotheses regarding the SQL queries in an application. For example, the adversary may hypothesize that their input is passed directly into a query that looks like:
   "SELECT * FROM orders WHERE ordernum = _____"

   
   

   or

   
   

   "SELECT * FROM orders WHERE ordernum IN (_____)"

   
   

   or

   
   

   "SELECT * FROM orders WHERE ordernum in (_____) ORDER BY _____"
   Of course, there are many other possibilities.

   Techniques
   Research types of SQL queries and determine which ones could be used at various places in an application.

2. Determine how to inject information into the queries:

   Determine how to inject information into the queries from the previous step such that the injection does not impact their logic. For example, the following are possible injections for those queries:
   "5' OR 1=1; --"

   
   

   and

   
   

   "5) OR 1=1; --"

   
   

   and

   
   

   "ordernum DESC; --"

   Techniques
   Add clauses to the SQL queries such that the query logic does not change.
   Add delays to the SQL queries in case server does not provide clear error messages (e.g. WAITFOR DELAY '0:0:10' in SQL Server or BENCHMARK(1000000000,MD5(1) in MySQL). If these can be injected into the queries, then the length of time that the server takes to respond reveals whether the query is injectable or not.

1. Determine user-controllable input susceptible to injection: Determine the user-controllable input susceptible to injection. For each user-controllable input that the adversary suspects is vulnerable to SQL injection, attempt to inject the values determined in the previous step. If an error does not occur, then the adversary knows that the SQL injection was successful.

   Techniques
   Use web browser to inject input through text fields or through HTTP GET parameters.
   Use a web application debugging tool such as Tamper Data, TamperIE, WebScarab,etc. to modify HTTP POST parameters, hidden fields, non-freeform fields, etc.
   Use network-level packet injection tools such as netcat to inject input
   Use modified client (modified by reverse engineering) to inject input.

2. Determine database type: Determines the type of the database, such as MS SQL Server or Oracle or MySQL, using logical conditions as part of the injected queries

   Techniques
   Try injecting a string containing char(0x31)=char(0x31) (this evaluates to 1=1 in SQL Server only)
   Try injecting a string containing 0x313D31 (this evaluates to 1=1 in MySQL only)
   Inject other database-specific commands into input fields susceptible to SQL Injection. The adversary can determine the type of database that is running by checking whether the query executed successfully or not (i.e. whether the adversary received a normal response from the server or not).

1. Extract information about database schema: Extract information about database schema by getting the database to answer yes/no questions about the schema.

   Techniques
   Automatically extract database schema using a tool such as Absinthe.
   Manually perform the blind SQL Injection to extract desired information about the database schema.

2. Exploit SQL Injection vulnerability: Use the information obtained in the previous steps to successfully inject the database in order to bypass checks or modify, add, retrieve or delete data from the database

   Techniques
   Use information about how to inject commands into SQL queries as well as information about the database schema to execute attacks such as dropping tables, inserting records, etc.