Advanced Sql Injection ENG

Advanced SQL Injection Dmitry Evteev ( Positive Technologies) Web Application Security Consortium (WASC) Contributor

Subjects in Question ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction to Web Application Security

Unsafe World of Web Applications ,[object Object],[object Object],[object Object],[object Object],[object Object],The data is based on automatic scanning of 16121 systems, detailed analysis of 59 web applications including analysis of the source code of over 10 applications .

Unsafe World of Web Applications: Statistics 2008

Chapter 1 : SQL Injection Vulnerability ,[object Object]

Illustrative Example of SQL Injection Web Server DBMS http://web/? id=6329&print=Y … . SELECT * from news where id = 6329 … .

Illustrative Example of SQL Injection Web Server DBMS http://web/? id=6329+union+select+id,pwd,0+from... … . SELECT * from news where id = 6329 union select id,pwd,0 from… … .

SQL Injection – Basic Concepts ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection – Basic Concepts ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection – Basic Concepts ,[object Object],[object Object]

SQL Injection – Basic Concepts ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injectio n – Classical Exploitation ( MySQL ) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injectio n – Features of Different DBMSs ,[object Object],MySQL MSSQL MS Access Oracle DB2 PostgreSQL String concatenation concat(,) concat_ws(delim,) ' '+' ' " "&" " ' '||' ' '' concat '' " "+" " ' '||' ' ' '||' ' Comments -- and /* * / and # -- and /* No -- and /* -- -- and /* Request union union union and ; union union union union and ; Sub-requests v .4.1 >= Yes No Yes Yes Yes Stored procedures No Yes No Yes No Yes Availability of information_schema or its analogs v .5.0 >= Yes Yes Yes Yes Yes

SQL Injectio n – Exploitation for Different DBMSs ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chapter 2 : Blind SQL Injection ,[object Object]

Blind SQL Injection – Basic Concepts ,[object Object],[object Object],[object Object]

Blind SQL Injection – Basic Concepts ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – Classical Exploitation ( MySQL ) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – Classical Exploitation ( MySQL ) Let’s go faster … ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – New Methods of Exploitation ( MySQL ) … and even faster … ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – New Methods of Exploitation ( MySQL ) … at the same rate … ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Note: in the example, hexadecimal equivalents were used, e.g. 0 x787B312C307D instead x{1,0}

Blind SQL Injectio n – New Methods of Exploitation ( MySQL ) … at the same rate … ,[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – New Methods of Exploitation ( MySQL ) … at the maximal rate ! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Blind SQL Injectio n – New Methods of Exploitation ( MySQL ) The Rate Limit … ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Double Blind SQL Injectio n – Classical Exploitation ( MySQL ) More haste, less speed;) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chapter 3 : Working with File System and Executing Commands on Server ,[object Object]

Working with File System ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Working with File System – Difference of DBMSs ,[object Object],[object Object],[object Object],[object Object],[object Object],MySQL MSSQL MS Access Oracle PostgreSQL Built-in functions Yes No Yes No Yes Available functions load_file, load data infile, into otfile/dumpfile Procedures eq insert from file curdir() Procedures eq insert from file pg_read_file(), pg_ls_dir(), copy, etc.

Working with File System ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Executing Commands on Server – Difference of DBMSs ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],MySQL MSSQL MS Access Oracle PostgreSQL Built-in functions No Yes Yes No No Available functions No EXEC shell() Own procedures Own procedures

Executing Commands on Server ,[object Object],[object Object],[object Object],[object Object],[object Object]

Chapter 4 : Methods to Bypass Security Filters ,[object Object]

Filters for Incoming data. Types ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass Security Filters (1) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass Security Filters (2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass Security Filters ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass Security Filters (3) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass Security Filters ( 4 ) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Raz0r, http://raz0r.name/vulnerabilities/sql-inekcii-svyazannye-s-multibajtovymi-kodirovkami-i-addslashes/

Methods to Bypass Security Filters (5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chapter 5 : Methods to Bypass Web Application Firewall ,[object Object]

What is WAF http:// server /?id=6329&print=Y At attack is detected ! Alarm !!! WAF Webserver http:// server /?id=5351 http:// server /?id=8234 http:// server /? id=“><script>... http:// server /?id=1+union+select... http:// server /? id=/../../../etc/passwd Data normalization Decode HTML entities (e.g. c, ", ª) Escaped characters (e.g. , 01, AA, AABB) Null byte string termination ... Signature search /(sel)(ect.+fr)(om)/is /(uni)(on.+sel)(ect)/is ...

Classification ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Methods to Bypass WAF ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection - Normalization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection – HPP ( example 1) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection – HPP ,[object Object]

Practice of Bypassing WAF: SQL Injection - HPP Technology/Environment Parameter Interpretation Example ASP.NET/IIS Concatenation by comma par1=val1,val2 ASP/IIS Concatenation by comma par1=val1,val2 PHP/APACHE The last parameter is resulting par1=val2 PHP/Zeus The last parameter is resulting par1=val2 JSP, Servlet/Apache Tomcat The first parameter is resulting par1=val1 JSP,Servlet/Oracle Application Server 10g The first parameter is resulting par1=val1 JSP,Servlet/Jetty The first parameter is resulting par1=val1 IBM Lotus Domino The first parameter is resulting par1=val1 IBM HTTP Server The last parameter is resulting par1=val2 mod_perl,libapeq2/Apache The first parameter is resulting par1=val1 Perl CGI/Apache The first parameter is resulting par1=val1 mod_perl,lib???/Apache The first parameter is resulting par1=val1 mod_wsgi (Python)/Apache An array is returned ARRAY(0x8b9058c) Pythin/Zope The first parameter is resulting par1=val1 IceWarp An array is returned ['val1','val2'] AXIS 2400 The last parameter is resulting par1=val2 Linksys Wireless-G PTZ Internet Camera Concatenation by comma par1=val1,val2 Ricoh Aficio 1022 Printer The last parameter is resulting par1=val2 webcamXP Pro The first parameter is resulting par1=val1 DBMan Concatenation by two tildes par1=val1~~val2

Practice of Bypassing WAF: SQL Injection – HPP ( example 2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection – HPF ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: Blind SQL Injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: Blind SQL Injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection – Signature Bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Practice of Bypassing WAF: SQL Injection – Signature Bypass ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection in “wildlife” ,[object Object]

Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Automated Exploitation of SQL Injection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Automatic detection of SQL Injection

Additional materials and references ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Thank you for your attention ! [email_address] http://devteev.blogspot.com/

Advanced Sql Injection ENG

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (20)

Semelhante a Advanced Sql Injection ENG

Semelhante a Advanced Sql Injection ENG (20)

Mais de Dmitry Evteev

Mais de Dmitry Evteev (20)

Último

Último (20)

Advanced Sql Injection ENG