OWASP Backend Security Project PHP Preventing SQL Injection - Revision history

Carlo.pelliccioni: /* Examples */

2008-05-19T08:41:37Z

‎Examples

Show changes

Dbellucci at 21:53, 18 May 2008

2008-05-18T21:53:44Z

Dbellucci at 21:52, 18 May 2008

2008-05-18T21:52:54Z

Dbellucci: /* Backend Database Enumeration */

2008-05-18T21:49:08Z

‎Backend Database Enumeration

Dbellucci: /* Backend Database Enumeration */

2008-05-18T21:36:05Z

‎Backend Database Enumeration

Dbellucci at 21:15, 18 May 2008

2008-05-18T21:15:57Z

Dbellucci: /* BLIND SQL Injection */

2008-05-18T21:13:47Z

‎BLIND SQL Injection

Dbellucci: /* BLIND SQL Injection */

2008-05-18T21:07:51Z

‎BLIND SQL Injection

Dbellucci: /* Online Catalog */

2008-05-18T20:47:30Z

‎Online Catalog

Dbellucci: /* UNION SELECT Injection */

2008-05-18T20:37:20Z

‎UNION SELECT Injection

← Older revision		Revision as of 21:53, 18 May 2008
Line 445:		Line 445:

	== Online Catalog ==		== Online Catalog ==
−
−	~~== Message Board ==~~
−

	= Defeating Automated Tools =		= Defeating Automated Tools =

@@ Line 314: / Line 314: @@
 First one will return the same page of ''/catalog.php?id=1'', latter will return a completely different pages. It's worst noticing that we can replace the above ''TRUE'' statement (''1=1'') with what ever we want to compare as a ''TRUE'' boolean identity expression.
-=== Backend Database Enumeration ===
+=== Database Enumeration ===
 Blind SQL Injection is a very usefull attacks to enumerate backend DBMS data. We'll see in this section how to accomplish this task.
@@ Line 427: / Line 427: @@
 </nowiki>
 = Application Security strategies =

@@ Line 337: / Line 337: @@
 By starting from 1 we need to compare original WEB Page with:
-* id=1 AND (SELECT(LENGTH(database())) = 1)
+* id=1 AND (LENGTH(database()) = 1)
-* id=1 AND (SELECT(LENGTH(database())) = 2)
+* id=1 AND (LENGTH(database()) = 2)
-* id=1 AND (SELECT(LENGTH(database())) = 3)
+* id=1 AND (LENGTH(database()) = 3)
 ''....''
 until we find contents from starting page:
-* '''id=1 AND (SELECT(LENGTH(database())) = 5)'''
+* ''id=1 AND (LENGTH(database()) = 5)''
 We just find that current database name length is equals to five. Next step is to enumerate it's characters.
@@ Line 350: / Line 350: @@
 To this aim we need to use:
-* '''SUBSTR(string, offset, length):''' returns a substring of '''string''' starting from '''offset'''
+* ''SUBSTR(string, offset, length):'' returns a substring of ''string'' starting from ''offset'' till
-  till '''offset + length - 1'''
+''offset + length - 1''
-* '''ORD(char):''' returns ASCII value of '''char'''
+* ''ORD(char):'' returns ASCII value of ''char''
 == Message Board ==

← Older revision		Revision as of 21:36, 18 May 2008
Line 315:		Line 315:

	=== Backend Database Enumeration ===		=== Backend Database Enumeration ===
		+
		+	Blind SQL Injection is a very usefull attacks to enumerate backend DBMS data. We'll see in this section how to accomplish this task.
		+
		+	As you remember our WEB Page is vulnerable to Blind SQL Injection since:
		+
		+	* <nowiki> /catalog.php?id=1</nowiki> gives the same contents of <nowiki>/catalog.php?id=1 AND 1=1</nowiki>
		+	* <nowiki> /catalog.php?id=1</nowiki> differs from <nowiki>/catalog.php?id=1 AND 1=0</nowiki>
		+
		+	'''Replacing TRUE expression: 1=1:'''
		+
		+	Let's start with a simple example. We want to enumerate current database name. MySQL has a builtint function
		+	to accomplish this task: ''database()'':
		+
		+	<nowiki> SELECT database()</nowiki>
		+
		+	''database()'' returns a string containing current database name. To find it's values through a Blind SQL Injection we need to catch out one character at time from it's result value.
		+
		+	'''How to find out database() length:'''
		+
		+	We know that ''SELECT LENGTH(database())'' return length of current database name. How can we find out it's value?
		+
		+	By starting from 1 we need to compare original WEB Page with:
		+	* id=1 AND (SELECT(LENGTH(database())) = 1)
		+	* id=1 AND (SELECT(LENGTH(database())) = 2)
		+	* id=1 AND (SELECT(LENGTH(database())) = 3)
		+	''....''
		+
		+	until we find contents from starting page:
		+	* '''id=1 AND (SELECT(LENGTH(database())) = 5)'''
		+
		+	We just find that current database name length is equals to five. Next step is to enumerate it's characters.
		+
		+	''' database() chars enumeration: '''
		+
		+	To this aim we need to use:
		+	* '''SUBSTR(string, offset, length):''' returns a substring of '''string''' starting from '''offset'''
		+	till '''offset + length - 1'''
		+	* '''ORD(char):''' returns ASCII value of '''char'''

	== Message Board ==		== Message Board ==

← Older revision		Revision as of 21:15, 18 May 2008
Line 340:		Line 340:

	= Defeating Automated Tools =		= Defeating Automated Tools =
		+
		+	= References =
		+
		+	= Tools =

@@ Line 305: / Line 305: @@
 while the following will retrieve an empty record set:
- <nowiki> SELECT * FROM book WHERE id=$_GET['id'] AND 1=0</nowiki>
+You can easily guess than ''Blind SQL Injection'' can be checked by supplying to ''catalog.php'' the
 === Backend Database Enumeration ===

← Older revision		Revision as of 21:07, 18 May 2008
Line 269:		Line 269:

	=== BLIND SQL Injection ===		=== BLIND SQL Injection ===
		+
		+	While a SQL Injection occours web server may responds with error message describing why
		+	remove database engine fails to execute SQL statement. Sometime network administrator properly tune
		+	WEB Server to hide error message. When it occours you don't know if SQL Injection has been executed with no errors at all. Blind SQL Injection is identical except that attacker need to compare orginal page with the one where SQL statement has been injected in some way.
		+
		+
		+	We know that ''catalog.php'':
		+
		+	<nowiki>function aGetBookEntry($id) {
		+	$aBookEntry = NULL;
		+	$link = iMysqlConnect();
		+
		+	$query = "SELECT * FROM books WHERE id = $id";
		+	$result = mysql_query($query);
		+
		+	if ($result) {
		+	if ($row = mysql_fetch_array($result)) {
		+	$aBookEntry = $row;
		+	}
		+	}
		+
		+	return $aBookEntry;
		+
		+	}
		+	</nowiki>
		+
		+	query backend database with the following SQL statement:
		+
		+	<nowiki> SELECT * FROM book WHERE id=$_GET['id']</nowiki>
		+
		+	which will retrieve the same record set of:
		+
		+	<nowiki> SELECT * FROM book WHERE id=$_GET['id'] AND 1=1</nowiki>
		+
		+	while the following will retrieve an empty record set:
		+
		+
		+	<nowiki> SELECT * FROM book WHERE id=$_GET['id'] AND 1=0</nowiki>

	=== Backend Database Enumeration ===		=== Backend Database Enumeration ===

@@ Line 257: / Line 257: @@
 * Retrieve current user
 *: ''id=1 UNION ALL SELECT NULL,user(),NULL,NULL,NULL LIMIT 1,1#''
 === BLIND SQL Injection ===
 === Backend Database Enumeration ===
 == Message Board ==

@@ Line 251: / Line 251: @@
 Well we just guessed that original page (''id=1'') evaluates 5 expression on ''SELECT'' statement.
 * Retrieve DBMS banner
@@ Line 256: / Line 257: @@
 * Retrieve current user
 *: ''id=1 UNION ALL SELECT NULL,user(),NULL,NULL,NULL LIMIT 1,1#''
 === BLIND SQL Injection ===