OWASP Backend Security Project DBMS Fingerprint - Revision history

Dbellucci: /* Fingerprinting through SQL Dialect Injection */

2008-10-10T14:51:53Z

‎Fingerprinting through SQL Dialect Injection

Dbellucci: /* Fingerprinting through SQL Dialect Injection */

2008-09-05T21:19:49Z

‎Fingerprinting through SQL Dialect Injection

Dbellucci: /* Fingerprinting through SQL Dialect Injection */

2008-07-23T19:34:30Z

‎Fingerprinting through SQL Dialect Injection

Dbellucci: /* Fingerprinting through SQL Dialect Injection */

2008-07-23T19:33:55Z

‎Fingerprinting through SQL Dialect Injection

Dbellucci: /* Banner Grabbing */

2008-07-23T14:28:38Z

‎Banner Grabbing

Dbellucci: /* Overview */

2008-07-23T14:27:45Z

‎Overview

Dbellucci at 13:53, 23 July 2008

2008-07-23T13:53:47Z

Dbellucci: /* Banner Grabbing */

2008-07-22T22:21:30Z

‎Banner Grabbing

Dbellucci at 22:13, 22 July 2008

2008-07-22T22:13:13Z

Dbellucci: /* Fingerprinting without string concatenation */

2008-05-15T20:25:53Z

‎Fingerprinting without string concatenation

@@ Line 156: / Line 156: @@
 '''MS SQL Server:'''
-.....
+T-SQL adds ''TOP'' expression for ''SELECT'' statements in order to upper limit retrieved result set:
-.....

@@ Line 162: / Line 162: @@
 '''Oracle:'''
-.....
+Oracle implements the following set operators:
-.....
+''MINUS'' has not yet been implemented on other DBMS so we can inject it to see if it get executed by backend database with no errors at all.
 == Error Codes Analysis ==

← Older revision		Revision as of 19:34, 23 July 2008
Line 114:		Line 114:

	We can exploit this peculiarities to identify MySQL DBMS. To accomplish this task the following comparison shall be true:		We can exploit this peculiarities to identify MySQL DBMS. To accomplish this task the following comparison shall be true:
−	* http://www.example.com/news.php?id=1
−	* http://www.example.com/news.php?id=1 AND ISNULL(1/0)

		+	<nowiki>
		+	http://www.example.com/news.php?id=1
		+	http://www.example.com/news.php?id=1 AND ISNULL(1/0)
		+	</nowiki>

@@ Line 112: / Line 112: @@
 * '''Oracle:''' ORA-00923: FROM keyword not found where expected
 * '''SQL Server:''' Server: Msg 8134, Level 16, State 1, Line 1 Divide by zero error encountered.
@@ Line 158: / Line 163: @@
 .....
 == Error Codes Analysis ==

@@ Line 26: / Line 26: @@
 * Postgres: ''SELECT version()''
 * Oracle: ''SELECT version FROM v$instance''
-* MS SQL:
+* MS SQL: ''SELECT @@version''
 == Fingerprinting with string concatenation ==

@@ Line 4: / Line 4: @@
 what kind of Database Engine your web application is using.
 There are a few techniques to accomplish this task:
     * Error Code Analysis
 = Description =

@@ Line 21: / Line 21: @@
 Through a SQL Injection we can retrieve Backend DBMS banner but be aware that it could have been replaced by a system administrator. Such a SQL Injection shall include a SQL Statement to be evaluated. Let'see how to accomplish this task:
-* MySQL: ''select version()''
+* MySQL: ''SELECT version()''
-* Postgres: ''select version()''
+* Postgres: ''SELECT version()''
-* Oracle:
+* Oracle: ''SELECT version FROM v$instance''
 * MS SQL:

@@ Line 9: / Line 9: @@
 = Description =
-== Error Codes Analysis ==
+After determining that a web application is vulnerable to SQL Injection we need to fingerprint backend DBMS
+to furthermore exploit such a vulnerbility. Fingerprint is performed against a set of peculiarities of DBMS.
-By performing fault injection, or fuzzing, you can gather important
+Such a peculiarities are listed below in order of accuracy:
- <nowiki>
+* Informations exposed through an error code
-http://www.example.com/store/products.php?id='
+* String concatenation functions
-== Engine Fingerprint ==
+== Banner Grabbing ==
-First of all let see what differences exists between DBMS.
+Through a SQL Injection we can retrieve Backend DBMS banner but be aware that it could have been replaced by a system administrator. Such a SQL Injection shall include a SQL Statement to be evaluated. Let'see how to accomplish this task:
-One of the biggest difference between different database engine
+* MySQL: ''select version()''
-is on what operator should be used for string concatenation. A second one
+* Postgres: ''select version()''
-resides on DBMS internal function. Last but not least we can grab DBMS banner to deduce
+* Oracle:
-backend engine.
+* MS SQL:
 == Fingerprinting with string concatenation ==
 Different DBMS handle string concatenation with different operators:
@@ Line 108: / Line 98: @@
-=== Fingerprinting without string concatenation ===
+== Fingerprinting through SQL Dialect Injection ==
 '''MySQL:'''
@@ Line 157: / Line 157: @@
 .....
-= References =
+You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version
-Victor Chapela: "Advanced SQL Injection"
+ <nowiki>
-http://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt
+Warning: pg_exec() [function.pg-exec]: Query failed: ERROR: unterminated quoted string at or near "'" LINE 1:
-= Tools =
+= References =
-http://sqlmap.sourceforge.net/
+Victor Chapela: "Advanced SQL Injection" http://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt

@@ Line 120: / Line 120: @@
 So, if you determine that ''<nowiki>http://www.example.com/news.php?id=1</nowiki>'' is vulnerable
-to a BLIND SQL Injection the following comparison should be false when backend engine is MySQL:
+to a BLIND SQL Injection the following comparison should be '''TRUE'':
    <nowiki>http://www.example.com/news.php?id=1</nowiki>
-   <nowiki>http://www.example.com/news.php?id=1 /*! AND 1=0 */</nowiki>
+   <nowiki>http://www.example.com/news.php?id=1 AND 1=1--</nowiki>