SQL Injection - MSSQL

Question

I'm learning about SQL injection and have the following backend code,

Set rs = server.CreateObject("ADODB.Recordset")
SQL = "SELECT * FROM Registration WHERE name='"&name&"'"
rs.Open SQL,Conn,0,1
if not rs.EOF then
    message = "Your ID is """ & rs("iD") & """."
else
    message = "id does not exist."
end if

I have been able to inject this to pull out a iD, but I'm wondering if it would be possible to go even further and get more info? Based on my code I don't think that is possible since my code only returns the iD DB field.

Am I right?

Answer 1

To exploit this vulnerability, one doesn’t need a direct output. There is also a technique called boolean-based blind where the behavior of different boolean expressions is used to extrapolate the data from:

foo' AND pass LIKE 'a%

If the success message is returned, pass begins with a, otherwise it doesn’t. If you repeat that with all possible characters recursively on each successful prefix, you’ll get the whole string.

You can do the same to get information about the database schema:

foo' AND EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE 'abc%') AND '1'='1

With the knowledge of the database schema, one can read any data.

As Rook has already mentioned, SQLmap is quite a useful tool to automate the exploitation of such SQL injection vulnerabilities.

Answer 2

You could alias a record to give any single column return using an As in the select. There is also the issue that you could send any arbitrary alteration to the DB as well assuming that "name" comes from unvalidated user input.

Answer 3

SQLMap is a great tool that automates the exploitation of flaws like this. SQLMap can dump an entire database, even if it is blind sql injection. It can also pop a shell depending on the database's configuration.