Error-based injection suits applications that hide query rows but reflect database error text. PostgreSQL has no XPath error functions like MySQL's EXTRACTVALUE; instead the reliable channel is a type-cast failure. Casting a string to a numeric type raises invalid input syntax for type integer: "<value>", and because the message quotes the value that failed to convert, a subquery placed in that cast leaks its result.
The advantage over MySQL's XPath channel is that PostgreSQL does not truncate the reflected value, so a whole row or an aggregated dump comes back in one error rather than in 32-character windows.
Pages#
- Cast error: leak values through
CAST(... AS int)conversion failures.
Tools#
- sqlmap: automated error-based extraction through type-cast failures.
- ghauri: fast alternative with strong WAF evasion.
References#
- PostgreSQL Documentation: type casts, error messages
- OWASP Testing Guide: Testing for SQL Injection