Encoding can be a great way of evading SQL
injection defenses because it can take
characters and represent them in an
entirely different form whilst actually
not losing the actual intent of the
character. So for signatures that are
looking for very specific patterns, this
can be a great implementation. Now you can
use a number of different encoding
patterns to circumvent this sort of
defense. And the pattern you use will
depend on both the context of where you
inject the attack and the ability of the
application to then decode that attack. So
for example, something like URL encoding
can be very useful at getting around a
signature based defense. But of course
that URL does have to be decoded by the
system. And it's the same with using
something like hex. And in fact we'll see
an example of using hex a little bit later
on in this module. UTF-8 or Unicode is
another way of encoding for evasion. And
even using something like SQL's char
function, because if we pass an ASCII
value in the char function, the database
will kindly resolve that to a character
that can be part of an injection attack
once it hits the database. Now the web
app, or the device in front of the web
app, is often not looking for these
encoding patterns. So encoding before the
attack is passed in the request can be a
very effective mechanism of evasion. So
that's encoding. And again, lots of
different ways depending on the context
you're using. Let's now go and have a look
at how we can still use the original
attack strings but we'll just split them up a bit.