OWASP Backend Security Project Testing PostgreSQL - Revision history

Andrew Muller at 16:02, 31 July 2014

2014-07-31T16:02:03Z

Jane O'Connor: Final edit

2014-05-19T09:25:42Z

Final edit

Show changes

David Fern: Removed Cheat Sheet, link did not work

2012-11-06T17:01:40Z

Removed Cheat Sheet, link did not work

Matt Heckathorn: The query to retrieve the output from the stdout table in the section titled Dynamic Library was incorrect.

2010-07-21T14:31:40Z

The query to retrieve the output from the stdout table in the section titled Dynamic Library was incorrect.

Matt Heckathorn: typo

2010-07-21T13:45:21Z

typo

Matt Heckathorn: clarified some things in the identifying postgresql section

2010-07-20T15:19:13Z

clarified some things in the identifying postgresql section

Matt Heckathorn at 14:16, 20 July 2010

2010-07-20T14:16:29Z

Matt Heckathorn: clarified the comments on pg_sleep in the Blind Injection section.

2010-07-20T14:15:01Z

clarified the comments on pg_sleep in the Blind Injection section.

Matt Heckathorn: changed paragraph to section in the first sentence.

2010-07-20T13:40:28Z

changed paragraph to section in the first sentence.

Wichers: /* References */

2009-03-09T22:09:21Z

‎References

@@ Line 1: / Line 1: @@
-= Overview =
+==Summary==
 In this section, some SQL Injection techniques for PostgreSQL will be discussed. These techniques have the following characteristics:
@@ Line 9: / Line 9: @@
 From now on it is assumed that ''<nowiki>http://www.example.com/news.php?id=1</nowiki>'' is vulnerable to SQL Injection attacks.
-= Description =
+=== Identifying PostgreSQL ===
 When a SQL Injection has been found, you need to carefully
@@ Line 35: / Line 34: @@
-== Blind Injection ==
+=== Blind Injection ===
@@ Line 56: / Line 55: @@
-== Single Quote unescape ==
+=== Single Quote unescape ===
 Strings can be encoded, to prevent single quotes escaping, by using chr() function.
@@ Line 81: / Line 80: @@
-== Attack Vectors ==
+=== Attack Vectors ===
-=== Current User ===
+==== Current User ====
 The identity of the current user can be retrieved with the following SQL SELECT statements:
@@ Line 99: / Line 98: @@
-=== Current Database ===
+==== Current Database ====
 The built-in function current_database() returns the current database name.
@@ Line 109: / Line 108: @@
-=== Reading from a file ===
+==== Reading from a file ====
 PostgreSQL provides two ways to access a local file:
@@ Line 156: / Line 155: @@
-=== Writing to a file ===
+==== Writing to a file ====
 By reverting the COPY statement, we can write to the local file system with the ''postgres'' user rights
@@ Line 165: / Line 164: @@
-=== Shell Injection ===
+==== Shell Injection ====
 PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting languages such as python, perl, and tcl.
-==== Dynamic Library ====
+===== Dynamic Library =====
 Until PostgreSQL 8.1, it was possible to add a custom function linked with ''libc'':
@@ Line 208: / Line 207: @@
-==== plpython ====
+===== plpython =====
 PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrict
@@ Line 233: / Line 232: @@
-==== plperl ====
+===== plperl =====
 Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in order to disable runtime execution of operations that interact with the underlying operating system, such as ''open''. By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need to install the untrusted version from the ''postgres'' user, to avoid the so-called application mask filtering of trusted/untrusted operations.
@@ Line 257: / Line 256: @@
-= References =
+== References ==
 * OWASP : "[[Testing for SQL Injection (OWASP-DV-005) |Testing for SQL Injection]]"

@@ Line 227: / Line 227: @@
 * OWASP : [[SQL Injection Prevention Cheat Sheet]]
 * PostgreSQL : "Official Documentation" - http://www.postgresql.org/docs/
 * Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection tool - http://sqlmap.sourceforge.net

@@ Line 174: / Line 174: @@
 /store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --
-/store.php?id=1 UNION ALL SELECT NULL,(SELECT stdout FROM system_out ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--
+/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--
 </nowiki>

@@ Line 93: / Line 93: @@
 === Reading from a file ===
-ProstgreSQL provides two ways to access a local file:
+PostgreSQL provides two ways to access a local file:
 * COPY statement
 * pg_read_file() internal function (starting from PostgreSQL 8.1)

@@ Line 21: / Line 21: @@
    <nowiki>http://www.example.com/store.php?id=1 AND 1::int=1</nowiki>
-The function version() can be used to grab the PostgreSQL banner. This will also show the underlying operating system type and version.
+In addition, the function ''version()'' can be used to grab the PostgreSQL banner. This will also show the underlying operating system type and version.
 '''Example''':
    <nowiki>http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--</nowiki>
-        PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
 == Blind Injection ==

@@ Line 40: / Line 40: @@
 Starting at version 8.2, PostgreSQL introduced a built-in function, ''pg_sleep(n)'', to make the current
-session process sleep for ''n'' seconds. This function can be leveraged to execute timing attacks (discussed in detail at [[Blind SQL Injection]].
+session process sleep for ''n'' seconds. This function can be leveraged to execute timing attacks (discussed in detail at [[Blind SQL Injection]]).
 In addition, you can easily create a custom ''pg_sleep(n)'' in previous versions by using libc:
 * CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT

@@ Line 223: / Line 223: @@
 = References =
-* OWASP : "[[Testing for SQL Injection (OWASP-DV-005) |Testing for SQL Injection ]]"
+* OWASP : "[[Testing for SQL Injection (OWASP-DV-005) |Testing for SQL Injection]]"
 * Michael Daw : "SQL Injection Cheat Sheet" - http://michaeldaw.org/sql-injection-cheat-sheet/