Testing for MS Access - Revision history

Andrew Muller at 16:03, 31 July 2014

2014-07-31T16:03:10Z

Jane O'Connor: Final edit

2014-05-19T09:38:31Z

Final edit

Show changes

Luca Carettoni at 06:55, 1 September 2013

2013-09-01T06:55:45Z

Luca Carettoni at 06:24, 1 September 2013

2013-09-01T06:24:00Z

Show changes

Luca Carettoni at 20:49, 31 August 2013

2013-08-31T20:49:59Z

Show changes

Luca Carettoni at 06:30, 26 August 2013

2013-08-26T06:30:44Z

Mmeucci at 15:00, 9 October 2012

2012-10-09T15:00:55Z

KirstenS: /* References */

2009-02-08T14:33:51Z

‎References

KirstenS: /* Short Description of the Issue */

2009-02-08T14:18:18Z

‎Short Description of the Issue

KirstenS: Testing for MS Access (OWASP-DV-009) moved to Testing for MS Access over redirect

2008-12-15T01:16:11Z

Testing for MS Access (OWASP-DV-009) moved to Testing for MS Access over redirect

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Short Description of the Issue ==
+== Summary ==
 As explained in the generic [[SQL injection]] section, SQL injection vulnerabilities occur whenever user-supplied input is used during the construction of a SQL query without being adequately constrained or sanitized. This class of vulnerabilities allows an attacker to execute SQL code under the privileges of the user that is used to connect to the database. In this section, relevant SQL injection techniques that utilize specific features of [http://en.wikipedia.org/wiki/Microsoft_Access Microsoft Access] will be discussed.
-== Black Box Testing and Example ==
+== How to Test ==
 === Fingerprinting ===

@@ Line 40: / Line 40: @@
 Nevertheless, it is possible to emulate those functions by combining multiple operators or by using alternative techniques.
-As mentioned, it is not possible to use the trick of inserting the characters <code>/*</code>, <code>--</code> or <code>#</code> in order to truncate the query. However, we can fortunately bypass this limitation by injecting the 'null' character. Using a null byte <code>%00</code> within
+As mentioned, it is not possible to use the trick of inserting the characters <code>/*</code>, <code>--</code> or <code>#</code> in order to truncate the query. However, we can fortunately bypass this limitation by injecting a 'null' character. Using a null byte <code>%00</code> within
-a SQL query will result in MS Access ignoring all remaining characters. This can be explained by considering that all strings are NULL terminated in the internal representation used by the database. It is worth mentioning that the 'null' character can sometimes cause troubles too as it may truncate strings at the web server level. In those situations, we can however employ another character: 0x16 (%16 in URL encoded format).
+a SQL query results in MS Access ignoring all remaining characters. This can be explained by considering that all strings are NULL terminated in the internal representation used by the database. It is worth mentioning that the 'null' character can sometimes cause troubles too as it may truncate strings at the web server level. In those situations, we can however employ another character: 0x16 (%16 in URL encoded format).
 Considering the following query:
@@ Line 69: / Line 69: @@
 * LAST: This function is used to select only the last row of a set of rows. For example the following query SELECT last(*) FROM users will return only the last row of the result.
-Some of these functions are essential to exploit blind SQL injections. For other advanced operators, please refer to the references.
+Some of these operators are essential to exploit blind SQL injections. For other advanced operators, please refer to the documents in the references.
 ==== Attributes Enumeration ====
-In order to enumerate the attributes of a query, it is possible to use a common error-based technique.
+In order to enumerate the column of a database table, it is possible to use a common error-based technique.
 In short, we can obtain the attributes name by analyzing error messages and repeating the query with different selectors. For example,
-assuming that we know the existence of a parameter, we can also obtain the name of the remaining attributes with the following query:
+assuming that we know the existence of a column, we can also obtain the name of the remaining attributes with the following query:
   ' GROUP BY Id%00
-In the error message received we can see that the name of the next attribute is shown. At this point, we iterate the
+In the error message received, it is possible to observe the name of the next column. At this point, we can iterate the
-method until we obtain the name of all attributes. If we don't know the name of at least
+method until we obtain the name of all attributes. If we don't know the name of the first attribute, we can still insert a fictitious column name and obtain the name of the first attribute within the error message.
 ==== Obtaining Database Schema ====
-Various system tables exist by default in MS Access that can be potentially used to obtain table names. Unfortunately, in the default configuration of recent MS Access database releases, these tables are not accessible. Nevertheless, it is always worth trying.
+Various system tables exist by default in MS Access that can be potentially used to obtain table names and columns. Unfortunately, in the default configuration of recent MS Access database releases, these tables are not accessible. Nevertheless, it is always worth trying:
 * MSysObjects
@@ Line 97: / Line 96: @@
 Alternatively, it is always possible to bruteforce the database schema by using a standard wordlist (e.g. [http://code.google.com/p/fuzzdb/ FuzzDb]).
-In some cases, developers or system administrators do not realize that including the actual ''.mdb'' file within the application webroot can allow to download to entire database. Database filename can be inferred with the following query:
+In some cases, developers or system administrators do not realize that including the actual ''.mdb'' file within the application webroot can allow to download the entire database. Database filenames can be inferred with the following query:
-  http://www.example.com/page.app?id=1'+UNION+SELECT+1+FROM+name[i].table%00
+  http://www.example.com/page.app?id=1'+UNION+SELECT+1+FROM+name.table%00
-where <code>name[i]</code> is the .mdb filename and <code>table</code> is a valid database table.
+where <code>name</code> is the ''.mdb'' filename and <code>table</code> is a valid database table.
 In case of password protected databases, multiple software utilities can be used to crack the password. Please refer to the references.
 === Blind SQL Injection Testing ===
-[[Blind SQL Injection]] vulnerabilities are by no means the most frequent type of vulnerability that you will find while testing real-life vulnerabilities. Generally, you find an SQL injection in a parameter where no union query is possible. In case of MS Access, it is also not possible to execute shell commands or easily read/write arbitrary file.
+[[Blind SQL Injection]] vulnerabilities are by no means the most easily exploitable SQL injections while testing real-life applications. In case of recent versions of MS Access, it is also not feasible to execute shell commands or read/write arbitrary files.
 In case of blind SQL injections, the attacker can only infer the result of the query by evaluating time differences or application responses. It is supposed that the reader already knows the theory behind blind SQL injection attacks, as the remaining part of this section will focus on MS Access specific details.
-For our test we take the following example:
+The following example is used:
   http://www.example.com/index.php?myId=[sql]
-where the id parameter is used in the following query:
+where the id parameter is used within the following query:
   SELECT * FROM orders WHERE [id]=$myId
-Let's consider the <code>myId</code> parameter vulnerable to blind SQL injection. As an attacker, we want to extract the content of column 'username' in the table 'users', assuming that we have already disclosed the database schema thanks to the techniques discussed above).
+Let's consider the <code>myId</code> parameter vulnerable to blind SQL injection. As an attacker, we want to extract the content of column 'username' in the table 'users', assuming that we have already disclosed the database schema.
 A typical query that can be used to infer the first character of the username of the 10th rows is:
-  http://www.example.com/index.php?id=IIF((select%20MID(LAST(username),1,1)%20from%20(select%20TOP%2010%20username%20from%20users))='a',0,'ko')
+  http://www.example.com/index.php?id=IIF((select%20MID(LAST(username),1,1)%20from%20(select%20TOP%2010%20username%20from%20users))='a',0,'no')
-If the first character is 'a', the query will return 0 ("true response"), otherwise a 'ko' string.
+If the first character is 'a', the query will return 0 or otherwise the string 'no'.
-By using a combination of the IFF, MID, LAST and TOP functions, it is possible to extract the first character of the username on a specifically selected row. As the inner query returns a set of records, and not just one, it is not possible to use it directly. Fortunately, we can combine multiple functions to extract the exact string.
+By using a combination of the IFF, MID, LAST and TOP functions, it is possible to extract the first character of the username on a specifically selected row. As the inner query returns a set of records, and not just one, it is not possible to use it directly. Fortunately, we can combine multiple functions to extract a specific string.
-Let's assume that we want to infer the username of the 10th row. First, we use the TOP function to select the first ten rows using the following query:
+Let's assume that we want to retrieve the username of the 10th row. First, we can use the TOP function to select the first ten rows using the following query:
   SELECT TOP 10 username FROM users
-Then, using this subset, we extract the last row by using the LAST function. Once we have only one row and exactly the row containing our string, we can use the IFF, MID and LAST functions to infer the actual value of the username. In our example, we employ IFF to return a number or a string. Using this trick we can distinguish whether we have a true response or not, by observing application error responses. As <code>id</code> is of a numeric type, the comparison with a string results in a SQL error that can be potentially leaked by <code>500 Internal Server Error pages</code>. Otherwise, a standard <code>200 OK</code> returns.
+Then, using this subset, we can extract the last row by using the LAST function. Once we have only one row and exactly the row containing our string, we can use the IFF, MID and LAST functions to infer the actual value of the username. In our example, we employ IFF to return a number or a string. Using this trick, we can distinguish whether we have a true response or not, by observing application error responses. As <code>id</code> is numeric, the comparison with a string results in a SQL error that can be potentially leaked by <code>500 Internal Server Error pages</code>. Otherwise, a standard <code>200 OK</code> page will be likely returned.
 For example, we can have the following query:
@@ Line 138: / Line 137: @@
   http://www.example.com/index.php?id='%20AND%201=0%20OR%20'a'=IIF((select%20MID(LAST(username),1,1)%20from%20(select%20TOP%2010%20username%20from%20users))='a','a','b')%00
-that is true if the first character is 'a' or false otherwise.
+that is TRUE if the first character is 'a' or false otherwise.
 As mentioned, this method allows to infer the value of arbitrary strings within the database:
-# By trying all the printable values, until we find a match
+# By trying all printable values, until we find a match
-# By inferring the length of the string using the LEN function, or by simply stopping after we have found all the characters
+# By inferring the length of the string using the LEN function, or by simply stopping after we have found all characters
-Time-based blind SQL injections are also possible, by abusing [http://technet.microsoft.com/it-it/library/cc512676%28en-us%29.aspx heavy queries].
+Time-based blind SQL injections are also possible by abusing [http://technet.microsoft.com/it-it/library/cc512676%28en-us%29.aspx heavy queries].
 == References ==

@@ Line 145: / Line 145: @@
 '''Whitepapers'''<br>
 * http://www.techonthenet.com/access/functions/index_alpha.php
-* http://www.webapptest.org/ms-access-sql-injection-cheat-sheet-IT.html
+* http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html

← Older revision		Revision as of 15:00, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Short Description of the Issue ==		== Short Description of the Issue ==

← Older revision		Revision as of 14:33, 8 February 2009
Line 146:		Line 146:
	* http://www.techonthenet.com/access/functions/index_alpha.php		* http://www.techonthenet.com/access/functions/index_alpha.php
	* http://www.webapptest.org/ms-access-sql-injection-cheat-sheet-IT.html		* http://www.webapptest.org/ms-access-sql-injection-cheat-sheet-IT.html
		+
		+	[[Category:FIXME\| is the second link correct?]]

@@ Line 3: / Line 3: @@
 == Short Description of the Issue ==
 This article describes how to exploit SQL Injection vulnerabilities when the
-backend database is MS Access, in particular, the article focuses on how to exploit Blind SQL Injection.
+backend database is MS Access. In particular, the article focuses on how to exploit Blind SQL Injection.
 After an initial introduction on the typical functions that are useful to exploit a SQL Injection vulnerability,
 a method to exploit Blind SQL Injection will be discussed.

← Older revision	Revision as of 01:16, 15 December 2008
(No difference)