Time-Based Blind SQL Injection

Time-Based Blind SQL Injection

• 1.
  TIME-BASED BLIND SQLINJECTION Matt Presson (@matt_presson) Memphis ISSA November 2012
• 2.
  WHO AM I? Sr. Information Security Analyst  Focus:  Application Security  Database Security  Mobile Security
• 3.
  OBJECTIVE  Quick introductionto SQL Injection  Four main types of SQL Injection  Time-based + Blind  A likely scenario  DEMOs
• 4.
  INTRO TO SQLINJECTION
• 5.
  DEFINITION “SQL injection isan attack in which malicious code is inserted into strings that are later passed to [a database] for parsing and execution.” “The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed.” Source: http://msdn.microsoft.com/en-us/library/ms161953(v=sql.105).aspx
• 6.
  SAMPLE VULNERABLE CODE var_shipCity = Request.form("ShipCity"); var sql = "select * from OrdersTable" + " where ShipCity = " + "'" + _shipCity + "'"; Source: http://msdn.microsoft.com/en-us/library/ms161953(v=sql.105).aspx
• 7.
  CATEGORIES OF SQLINJECTION  Normal  UNION queries  Blind  Boolean expressions  Error-based  Valid syntax that throws exceptions  Time-based  Resource intensive or sleep-style queries
• 8.
  EXAMPLES – NORMALINJECTION var sql = "select ShipCity, Dest from Orders" + " where ShipCity = '"+_shipCity+"'"; Inject: ' UNION <data you want to extract> -- - Example: select ShipCity, Dest from Orders where ShipCity='' UNION select Username, Password from Users -- -'
• 9.
  EXAMPLES – BLINDINJECTION var sql = "select * from Orders" + " where ShipCity = '"+_shipCity+"'"; Inject: <valid value>' and <positive expression> <valid value>' and <negative expression> Example: select * from Orders where ShipCity='Memphis' and '1'='1'
• 10.
  EXAMPLES – ERROR-BASEDINJECTION var sql = "select * from Orders" + " where ShipCity = '"+_shipCity+"'"; Example (SQL Server): select * from Orders where ShipCity='' and 1=CAST(suser_name() as INT)-- -' Example (MySQL): select * from Orders where ShipCity='' and ExtractValue(0,CONCAT(0x5c,(select user())))-- -'
• 11.
  EXAMPLES – TIME-BASEDINJECTION var sql = "select ShipCity, Dest from Orders" + " where ShipCity = '"+_shipCity+"'"; Example (SQL Server): select ShipCity, Dest from Orders where ShipCity='' waitfor delay '0:0:10' Example (MySQL >= 5.0.12): select ShipCity, Dest from Orders where ShipCity='' UNION SELECT SLEEP(5), 2'
• 12.
  TIME-BASED + BLIND Same:  Resource intensive or sleep/wait style functions New:  Extract arbitrary data  Bypass business functionality
• 13.
  EXAMPLES – TIME-BASED+ BLIND var sql = "select ShipCity, Dest from Orders" + " where ShipCity = '"+_shipCity+"'"; Example (SQL Server): select ShipCity, Dest from Orders where ShipCity=''; if(<boolean>) waitfor delay '0:0:10' Example (MySQL >= 5.0.12): select ShipCity, Dest from Orders where ShipCity='' UNION SELECT IF(<bool>,SLEEP(5),1), '2'
• 14.
  SCENARIO
• 15.
  DEMOS