Your SlideShare is downloading. ×
SQL injection exploitation internals
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×

Introducing the official SlideShare app

Stunning, full-screen experience for iPhone and Android

Text the download link to your phone

Standard text messaging rates apply

SQL injection exploitation internals

12,500
views

Published on

SQL injection exploitation internals: How do I exploit this web application injection point? …

SQL injection exploitation internals: How do I exploit this web application injection point?

These slides have been presented at a private conference in London on January 9, 2009.

Published in: Technology

0 Comments
6 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
12,500
On Slideshare
0
From Embeds
0
Number of Embeds
19
Actions
Shares
0
Downloads
856
Comments
0
Likes
6
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. SQL injection exploitation internals How do I exploit this web application injection point? Intercon III, London January 9, 2009 Bernardo Damele A. G. bernardo.damele@gmail.com
  • 2. Intercon III, London – January 9, 2009 2 About me Bernardo Damele A. G. ● Proud father ● Penetration Tester and Security Researcher ● Currently working at Portcullis Computer Security Ltd ● sqlmap lead developer
  • 3. Intercon III, London – January 9, 2009 3 SQL... what? (1/2) ● From the OWASP Testing Guide: “SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands” ● There are plenty of resources on the Net about SQL injection concept: it is a high-risk web application security flaw ● A long list of resources can be found on my delicious profile, http://delicious.com/inquis/sqlinjection ● I keep it updated with stuff I consider valuable ● A wise man once told me: “An image is worth thousands words”
  • 4. Intercon III, London – January 9, 2009 4 SQL... what? (2/2) Source http://xkcd.com/327/
  • 5. Intercon III, London – January 9, 2009 5 All right, tons of resources and I am still presenting about SQL injection, why? Because: ● New techniques have been released in the last year ● Some aspects have been over-looked in the past ● It is fun! State of art
  • 6. Intercon III, London – January 9, 2009 6 Basically the steps to go through are: ● Detection of a possible SQL injection flaw ● SQL query syntax detection ● Back-end database management system fingerprint ● Depending on the session user privileges, back-end DBMS and some possible security settings in place server-side, a SQL injection issue leads on the DBMS server to: ● DBMS data unauthorized access ● File system read and write access ● Operating system command execution How does it work?
  • 7. Intercon III, London – January 9, 2009 7 sqlmap is an automatic SQL injection tool: ● Developed in Python. Started on July 2006 initially by Daniele Bellucci, then I took over in December 2006 ● Licensed under the terms of GPLv2 ● Detects and take advantage of SQL injection vulnerabilities in web applications. The user can choose to: ● Perform an extensive back-end DBMS fingerprint ● Enumerate users, password hashes, privileges, databases, tables, columns and their datatypes ● Dump entire or user's specified database tables' entries ● Run custom SQL statements and more sqlmap
  • 8. Intercon III, London – January 9, 2009 8 sqlmap key features: ● Full support for MySQL, Oracle, PostgreSQL and Microsoft SQL Server back-end DBMS software ● Full support for three SQL injection techniques: ● Inferential blind SQL injection ● UNION query SQL injection ● Stacked queries (multiple statements) support ● Target aquisition: from user, by parsing WebScarab/Burp proxies requests log files, by Google dorking ● Tests for injection flaws on GET and POST parameters, HTTP User-Agent header and Cookie values sqlmap features (1/2)
  • 9. Intercon III, London – January 9, 2009 9 More features: ● Silent to verbose output messages ● Granularity in the user's options ● Support for concurrent HTTP requests (multi-threading) ● Estimated time of arrival ● Session save and resume ● Options from command line and/or configuration file ● Integration with Metasploit and w3af ● File system read and write access and operating system command execution by providing own queries, depending on the session user privileges and back-end DBMS sqlmap features (2/2)
  • 10. Intercon III, London – January 9, 2009 10 Real world Have you ever had a dream, Neo, that you were so sure was real? What if you were unable to wake from that dream? How would you know the difference between the dream world and the real world? Morpheus, The Matrix
  • 11. Intercon III, London – January 9, 2009 11 In the real world web applications are often complex Usually the page content changes at each refresh ● They have inline counters, advertisement banner, clocks, etc. Inferential blind SQL injection algorithm is based on the concept that the HTTP responses differ depending on the SQL query Dealing with advertisements (1/3)
  • 12. Intercon III, London – January 9, 2009 12 Obstacle If the page content does not depend only on the SQL statement and changes at each refresh then the algorithm may not work Dealing with advertisements (2/3)
  • 13. Intercon III, London – January 9, 2009 13 Python library helped to solve this problem: for each HTTP response sqlmap calls a function that compares the returned page content with the untouched original page content: ● Return a measure of the page contents' similarity as a float in the range [0, 1] with a radio of 3. ● It works also when the original page is stable, but the injected query with a valid condition (True) differs If the automatic comparison fails, the user can provide a string or a regular expression to match on both original and True page contents and to not match on False page contents Dealing with advertisements (3/3)
  • 14. Intercon III, London – January 9, 2009 14 ● In standard SQL language NULL is allowed as a value for a table column field ● In the inferential blind SQL injection technique usually a bisection algorithm is used to identify if the ordinal value of the Nth query output character is higher of a certain ASCII table number: this causes the page content to be True or False ● The SQL statement used by sqlmap, depending on the back- end DBMS, is similar to: ASCII(SUBSTR((SQL query), Nth SQL query  output char, 1)) > Bisection algorithm  number To NULL or not to NULL (1/4)
  • 15. Intercon III, London – January 9, 2009 15 Obstacle On some DBMS the substring function can not be used on NULL To NULL or not to NULL (2/4)
  • 16. Intercon III, London – January 9, 2009 16 ● A possible solution for this problem consists in modifying all SQL query's columns explicitly: ● Casting its output to be a string ● Returning value ' ' (space) if the casted value is still NULL ● Example on MySQL 5.0. The SQL query to enumerate the column name first entry is: SELECT name FROM test.users LIMIT 0, 1 ● Casted SQL query: SELECT IFNULL(CAST(name AS CHAR(10000)),  CHAR(32)) FROM test.users LIMIT 0, 1 To NULL or not to NULL (3/4)
  • 17. Intercon III, London – January 9, 2009 17 The inferential blind SQL injected statement will be then: ORD(MID((SELECT IFNULL(CAST(name AS  CHAR(10000)), CHAR(32)) FROM test.users  LIMIT 0, 1), Nth SQL query output character,  1)) > Bisection algorithm number URL encoded: ORD%28MID%28%28SELECT%20IFNULL%28CAST%28name %20AS%20CHAR%2810000%29%29%2C%20CHAR %2832%29%29%20FROM%20test.users%20LIMIT %200%2C%201%29%2C%201%2C%201%29%29%20%3E %2063 To NULL or not to NULL (4/4)
  • 18. Intercon III, London – January 9, 2009 18 You have got an injection point The injection point is in a SQL statement as follows: SELECT * FROM users WHERE id LIKE ((('%" .  $_GET['id'] . "%'))) LIMIT 0, 1 SQL payload (1/3)
  • 19. Intercon III, London – January 9, 2009 19 Obstacle The injection is after a LIKE clause, within three parenthesis, the statement terminates with a LIMIT clause SQL payload (2/3)
  • 20. Intercon III, London – January 9, 2009 20 In this example the SQL payload that sqlmap identifies is: id=1'))) AND ((('RaNd' LIKE 'RaNd In the inferential blind SQL injection algorithm will be: id=1'))) AND ORD(MID((SQL query), Nth SQL  query output character, 1)) > Bisection  algorithm number AND ((('RaNd' LIKE 'RaNd In the UNION query SQL injection technique will be: id=1'))) UNION ALL SELECT NULL, Concatenated  SQL query, NULL# AND ((('RaNd' LIKE 'RaNd SQL payload (3/3)
  • 21. Intercon III, London – January 9, 2009 21 First demo I did every demo possible to see if the things would do what they were promising they would do Doug Hall
  • 22. Intercon III, London – January 9, 2009 22 You have got an injection point It is vulnerable to UNION query SQL injection: ● sqlmap detected it for you by NULL bruteforcing or by ORDER BY clause bruteforcing, depending on your options Bypass columns limitation (1/4)
  • 23. Intercon III, London – January 9, 2009 23 Obstacle The number of columns in the web application SELECT statement is lower than the number of columns of your UNION ALL SELECT statement Bypass columns limitation (2/4)
  • 24. Intercon III, London – January 9, 2009 24 ● A possible solution consists in concatenating your SELECT statement columns in a single output by using the specific DBMS string concatenation operator or function ● Example on PostgreSQL 8.3 to retrieve users privileges ● The SQL query to inject is: SELECT usename, usecreatedb, usesuper,  usecatupd FROM pg_user Bypass columns limitation (3/4)
  • 25. Intercon III, London – January 9, 2009 25 The injection will be: UNION ALL SELECT NULL, CHR(83)||CHR(114)|| CHR(108)||CHR(71)||CHR(86)||CHR(116)|| COALESCE(CAST(usename AS CHARACTER(10000)),  CHR(32))||CHR(104)||CHR(100)||CHR(122)|| CHR(81)||CHR(121)||CHR(90)|| COALESCE(CAST(usecreatedb AS  CHARACTER(10000)), CHR(32))||CHR(104)|| CHR(100)||CHR(122)||CHR(81)||CHR(121)|| CHR(90)||COALESCE(CAST(usesuper AS  CHARACTER(10000)), CHR(32))||CHR(104)|| CHR(100)||CHR(122)||CHR(81)||CHR(121)|| CHR(90)||COALESCE(CAST(usecatupd AS  CHARACTER(10000)), CHR(32))||CHR(75)|| CHR(121)||CHR(80)||CHR(65)||CHR(68)|| CHR(102), NULL FROM pg_user­­ Bypass columns limitation (4/4)
  • 26. Intercon III, London – January 9, 2009 26 Obstacle You have got an injection point vulnerable to UNION query SQL injection. Only the query output's first entry or a range of entries is displayed in the page content Going partial.. UNION (1/3)
  • 27. Intercon III, London – January 9, 2009 27 sqlmap automatizes a known technique: ● Changes the parameter value to its negative value causing the original query to produce no output ● Inspects and unpack the provided SQL statement: ● Calculates its output number of entries ● Limits it after the UNION ALL SELECT to return one entry at a time ● Repeat the previous action N times where N is equal to the number of entries Going partial.. UNION (2/3)
  • 28. Intercon III, London – January 9, 2009 28 ● Example on MySQL 4.1 to enumerate list of databases ● The SQL query to inject is: SELECT db FROM mysql.db ● sqlmap identified the injection point as being an non-quoted parameter (integer) in the WHERE clause with the equal operator (simple scenario) ● The injection will be: id=­1 UNION ALL SELECT NULL,  CONCAT(CHAR(100,84,71,69,87,98),IFNULL(CAST (db AS CHAR(10000)), CHAR(32)),  CHAR(65,83,118,81,87,116)), NULL FROM  mysql.db LIMIT 0, 1# AND 6972=6972 Going partial.. UNION (3/3)
  • 29. Intercon III, London – January 9, 2009 29 ● Back-end DBMS fingerprinting is a mandatory step to go through to take full advantage of a SQL injection flaw ● There are a few well known techniques and a few over-looked techniques ● sqlmap implements up to four techniques, three of these are in use by other tools: ● The user can force the back-end DBMS software value: no HTTP requests are sent to identify the software ● By default a basic DBMS fingerprint based on one or two techniques is done: only two HTTP requests are sent ● The user can choose to perform an extensive DBMS fingerprint based on four techniques: numerous (30+) HTTP requests are sent DBMS fingerprint (1/4)
  • 30. Intercon III, London – January 9, 2009 30 ● The techniques implemented to perform an extensive back- end DBMS fingerprint are: ● Inband error messages ● Banner parsing ● SQL dialect ● Specific functions static output comparison ● On a default installation all of them are reliable ● On a hardened installation the last two are reliable DBMS fingerprint (2/4)
  • 31. Intercon III, London – January 9, 2009 31 Example of basic back-end DBMS fingerprint on PostgreSQL 8.3 ● The techniques in use are two ● The two SQL queries injected to identify it are: AND integer::int=integer ● SQL dialect AND COALESCE(integer, NULL)=integer ● Specific function static output comparison DBMS fingerprint (3/4)
  • 32. Intercon III, London – January 9, 2009 32 Example of extensive back-end DBMS fingerprint on Microsoft SQL Server 2005 ● The techniques in use are three ● The result is: active fingerprint: Microsoft SQL Server 2005 banner parsing fingerprint: Microsoft SQL Server  2005 Service Pack 0 version 9.00.1399 html error message fingerprint: Microsoft SQL Server ● Active fingerprint refers to SQL dialect and specific functions static output comparison DBMS fingerprint (4/4)
  • 33. Intercon III, London – January 9, 2009 33 ● Fingerprinting is a key step in penetration testing ● It is not only about back-end DBMS software ● There are techniques and tools to fingerprint the web server, the web application technology and their underlying system ● What about the back-end DBMS underlying system? ● sqlmap can fingerprint them without making extra requests: ● Web/application server and web application technology: by parsing the HTTP response headers (Server, X-AspNet- Version, X-Powered-By, etc.) – known technique ● Back-end DBMS operating system: by parsing the DBMS banner – over-looked technique More on fingerprint
  • 34. Intercon III, London – January 9, 2009 34 Second demo A demo, as in "demolish", or "demonstration"? Cyclops, X-Men: Evolution
  • 35. Intercon III, London – January 9, 2009 35 It might comes in handy sometimes to be able to run your own SQL queries, mainly for file system read and write access and operating system command execution The tool inspects the provided statement: ● If it is a SELECT statement sqlmap uses, depending on user's options, the inferential blind or the UNION query technique to retrieve its output ● If it is a data manipulation statement, a transaction statement or any other valid SQL statement, it uses stacked queries to run it if the web application supports them Give me a SQL shell!
  • 36. Intercon III, London – January 9, 2009 36 Automation vs granularity (1/2) sqlmap has been developed to make it simple for a busy penetration tester to detect and exploit SQL injection vulnerabilities in web applications ● Providing it with a source of targets, it can automatically: ● Detect all possible SQL injections and confirm them ● Identify the SQL query syntax ● Fingerprint the back-end DBMS ● The user does not have to look on the Net for DBMS specific queries then manually inject them to enumerate users password hashes, check if the session user is a DBA, enumerate table columns' datatype, etc. ● There is an option to dump the whole back-end DBMS
  • 37. Intercon III, London – January 9, 2009 37 Automation vs granularity (2/2) ● The tester is a professional, he knows what he does and why ● There are options to specify: ● How to compare True and False HTTP responses ● A single or more testable parameters ● The SQL payload prefix and postfix ● A single or a range of entries to dump from a table ● A single or multiple columns to dump from a table ● Custom SQL statements to run ● Options can be specified from both command line and/or configuration file ● Options are documented in the user's manual with examples
  • 38. Intercon III, London – January 9, 2009 38 Third demo I get tons of uninteresting mail, and system announcements about babies born, etc. At least a demo MIGHT have been interesting Richard Stallman
  • 39. Intercon III, London – January 9, 2009 39 Limitations Can sqlmap fail to detect or to exploit a SQL injection vulnerability? ● Yes, in some cases mainly because it does not support: ● SQL injection on SQL clauses other than WHERE ● Time based blind SQL injection technique ...but I am working on these and others!
  • 40. Intercon III, London – January 9, 2009 40 Want to contribute? I am always looking forward to code contributions Try it, find bugs, send feature requests, review the code and the documentation, contribute on the mailing lists! I can provide you with: ● Details on code internals ● Write access to the Subversion repository ● Access to the development platform ● A beer if you are in London area
  • 41. Intercon III, London – January 9, 2009 41 Links and contacts Homepage: http://sqlmap.sourceforge.net Documentation: ● http://sqlmap.sourceforge.net/dev/index.html ● http://sqlmap.sourceforge.net/doc/README.pdf Mailing lists: ● https://lists.sourceforge.net/lists/listinfo/sqlmap-users ● https://lists.sourceforge.net/lists/listinfo/sqlmap-devel Personal contacts: ● E-mail / Jabber: bernardo.damele@gmail.com ● Blog: http://bernardodamele.blogspot.com
  • 42. Intercon III, London – January 9, 2009 42 References ● OWASP Testing Guide, Open Web Application Security Project ● Exploit of a Mom, xkcd ● Deep Blind SQL Injection, Ferruh Mavituna (Portcullis Computer Security Ltd) ● Microsoft SQL Server sp_replwritetovarbin limited memory overwrite vulnerability, Bernhard Mueller (SEC Consult Vulnerability Lab) ● Metasploit Framework, H D Moore and the Metasploit development team ● w3af, Andres Riancho and the w3af development team ● Data-mining with SQL Injection and Inference, David Litchfield (NGS Software) ● Advanced SQL Injection, Victor Chapela (Sm4rt Security Services) ● Python difflib, Python Software Foundation ● NULL (SQL), Wikipedia ● Agent oriented SQL abuse, Fernando Russ and Diego Tiscornia (CORE Security) ● Insight on UNION query SQL injection, Bernardo Damele A. G. ● DBMS Fingerprint, Daniele Bellucci (OWASP Backend Security Project)
  • 43. Intercon III, London – January 9, 2009 43 Questions? Thanks for your attention