How does Netsparker extract the version of SQL Server during a SQL injection?

Question

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities.

However I am surprised as the injection query throw error for casting and the scanner has extract SQL server version information.

microsoft sql server 2012 (sp3) (kb3072779) - 11.0.6020.0 (x64)
oct 20 2015 15:36:27
copyright (c) microsoft corporation
web edition (64-bit) on windows nt 6.3 <x64> (build 9600: ) (hypervisor)

String used for injection

'AND 1=cast(0x5f21403264696c656d6d61 as varchar(8000)) or '1'='

When form submitted in response server throw error for casting as below.

Conversion failed when converting the varchar value '_!@2dilemma' to data type int.

Then I tried to look on web and I found below links but the do not have information how they extract data.

http://xss.cx/examples/netsparker/www.hmficweb.hinghammutual.com_80.htm

Answer 1

The variable @@version returns the current SQL Server version.

Examples here:

Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)

Apr 2 2010 15:48:46

Copyright (c) Microsoft Corporation

Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

Going back to basics, to manually find a SQL injection vulnerability you would inject something like

' OR '1'='1' UNION SELECT 1;--

into an input, which would make a query execute similar to the following

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT 1;--'

This would combine the results from the original, altered query, with the results from the additional 1 value column.

However, you first need to make sure the number of columns you are selecting matches the original query. So you may need to change the 1 to 1, 2, 1, 2, 3, 1, 2, 3, 4, etc, until you get your values returned.

Once you get a valid result returned from the page that contains your injected values, you simply replace one of the injected values with @@version. e.g.

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT @@version,2,3;--'