The slides from my SOURCE Boston 2012 talk: Advanced SQL Injection with SQLol

1. Presented by:
COPYRIGHT TRUSTWAVE 2011

2. Whom?
Daniel Crowley
Trustwave SpiderLabs
@dan_crowley
dcrowley@trustwave.com
COPYRIGHT TRUSTWAVE 2011

3. What?
SQLol
A configurable SQLi test-bed
A tool for
Research
Education
Testing
http://github.com/SpiderLabs/SQLol
COPYRIGHT TRUSTWAVE 2011

4. Why?
Existing test-beds are
Inflexible
Simplified
Real-world scenarios are
Varied
Dangerous
COPYRIGHT TRUSTWAVE 2011

5. Why? Klingon version
Heghlu'meH QaQ jajvam
COPYRIGHT TRUSTWAVE 2011

6. Why? Shakespearean version
I humbly posit that the current state
(With much respect to work which
does precede)
Of test-beds made with vulns to
demonstrate
Is lacking some in flexibility.
COPYRIGHT TRUSTWAVE 2011

7. Why? Shakespearean version
Two options are presented present-
day,
As far as when one deals with SQL:
A blind injection (bool or time delay)
And UNION statement hax (oh gee,
how swell…)
COPYRIGHT TRUSTWAVE 2011

8. Why? Shakespearean version
Imagine we could choose how
queries read
And how our input sanitizes, oh!
How nimble and specific we could be
To recreate our ‘sploit scenarios.
COPYRIGHT TRUSTWAVE 2011

9. Why? Shakespearean version
And thus is S-Q-L-O-L conceived:
That we can study how to pwn DBs.
COPYRIGHT TRUSTWAVE 2011

10. Why? tl;dr version
‘Cuz.
COPYRIGHT TRUSTWAVE 2011

12. Choose type of query
COPYRIGHT TRUSTWAVE 2011

13. Choose sanitization options
COPYRIGHT TRUSTWAVE 2011

14. Choose verbosity
COPYRIGHT TRUSTWAVE 2011

15. Challenges
COPYRIGHT TRUSTWAVE 2011

17. Manual
COPYRIGHT TRUSTWAVE 2011

18. Manual
COPYRIGHT TRUSTWAVE 2011

19. Automated
COPYRIGHT TRUSTWAVE 2011

22. Requirements
Web server of your choice
with PHP
ADODB-supported database
COPYRIGHT TRUSTWAVE 2011

23. Deployment
Un-tar SQLol inside web root
COPYRIGHT TRUSTWAVE 2011

24. Deployment
Modify includes/database.config.php
COPYRIGHT TRUSTWAVE 2011

25. Deployment
Run database reset script
COPYRIGHT TRUSTWAVE 2011

26. Future features
Custom sanitization routines
Stored procedure injections
Database privilege options
More challenges
COPYRIGHT TRUSTWAVE 2011

27. Like SQLol?
Try XMLmao!
Possible future test beds?
cryptOMG
rofLDAP (asLDAP)
KTHXbypass
XSSmh
COPYRIGHT TRUSTWAVE 2011

28. Questions?
dcrowley@trustwave.com
Twitter: @dan_crowley
Code:
http://github.com/SpiderLabs/SQLol
http://www.surveymonkey.com/sourceboston12
COPYRIGHT TRUSTWAVE 2011