Testing for SQL Server - Revision history

Andrew Muller at 15:59, 31 July 2014

2014-07-31T15:59:58Z

Jane O'Connor: Final edit

2014-05-18T10:56:20Z

Final edit

David Fern: Updated URL for Davd Litchfield Article, Updated URL for more Advanced SQK Injection, Updated link to Paul Litwin' article, Updated sqlmap URL,

2012-11-06T16:57:18Z

Updated URL for Davd Litchfield Article, Updated URL for more Advanced SQK Injection, Updated link to Paul Litwin' article, Updated sqlmap URL,

Mmeucci at 15:00, 9 October 2012

2012-10-09T15:00:48Z

Shady at 09:58, 18 May 2012

2012-05-18T09:58:33Z

Matt Heckathorn: Corrected description of code from Antonin Foller on creating a new xp_cmdshell.

2010-07-16T14:47:40Z

Corrected description of code from Antonin Foller on creating a new xp_cmdshell.

Inquis at 12:32, 13 September 2009

2009-09-13T12:32:15Z

KirstenS: /* Trial and error */

2009-02-08T14:00:07Z

‎Trial and error

KirstenS: /* Trial and error */

2009-02-08T13:59:48Z

‎Trial and error

KirstenS: /* Trial and error */

2009-02-08T13:58:56Z

‎Trial and error

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 In this section some [[SQL Injection]] techniques that utilize specific features of Microsoft SQL Server will be discussed.
 SQL injection vulnerabilities occur whenever input is used in the construction of an SQL query without being adequately constrained or sanitized. The use of dynamic SQL (the construction of SQL queries by concatenation of strings) opens the door to these vulnerabilities. SQL injection allows an attacker to access the SQL servers and execute SQL code under the privileges of the user used to connect to the database.
@@ Line 21: / Line 19: @@
-== Black Box testing and example ==
+== How to Test ==
 ===SQL Server Characteristics===
@@ Line 339: / Line 337: @@
 Remember that OPENROWSET is accessible to all users on SQL Server 2000 but it is restricted to administrative accounts on SQL Server 2005.
 == References ==
@@ Line 350: / Line 354: @@
 * SQL Injection - http://msdn2.microsoft.com/en-us/library/ms161953.aspx
 * Cesar Cerrudo: Manipulating Microsoft SQL Server Using SQL Injection - http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf uploading files, getting into internal network, port scanning, DOS

@@ Line 285: / Line 285: @@
 == References ==
 '''Whitepapers'''<br>
-* David Litchfield: "Data-mining with SQL Injection and Inference" - http://www.nextgenss.com/research/papers/sqlinference.pdf
+* David Litchfield: "Data-mining with SQL Injection and Inference" - http://www.databasesecurity.com/webapps/sqlinference.pdf
-* Chris Anley, "(more) Advanced SQL Injection" - http://www.ngssoftware.com/papers/more_advanced_sql_injection.pdf
+* Chris Anley, "(more) Advanced SQL Injection" - http://www.encription.co.uk/downloads/more_advanced_sql_injection.pdf
 * Steve Friedl's Unixwiz.net Tech Tips: "SQL Injection Attacks by Example" - http://www.unixwiz.net/techtips/sql-injection.html
 * Alexander Chigrik: "Useful undocumented extended stored procedures" - http://www.mssqlcity.com/Articles/Undoc/UndocExtSP.htm
 * Antonin Foller: "Custom xp_cmdshell, using shell object" - http://www.motobit.com/tips/detpg_cmdshell
-* Paul Litwin: "Stop SQL Injection Attacks Before They Stop You" - http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/
+* Paul Litwin: "Stop SQL Injection Attacks Before They Stop You" - http://msdn.microsoft.com/en-us/magazine/cc163917.aspx
 * SQL Injection - http://msdn2.microsoft.com/en-us/library/ms161953.aspx
 * Cesar Cerrudo: Manipulating Microsoft SQL Server Using SQL Injection - http://www.appsecinc.com/presentations/Manipulating_SQL_Server_Using_SQL_Injection.pdf uploading files, getting into internal network, port scanning, DOS
@@ Line 298: / Line 298: @@
 * Northern Monkee: [[http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html Bobcat]]
 * icesurfer: SQL Server Takeover Tool - [[http://sqlninja.sourceforge.net sqlninja]]
-* Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http://sqlmap.sourceforge.net
+* Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http://sqlmap.org/

← Older revision		Revision as of 15:00, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

@@ Line 292: / Line 292: @@
 * Paul Litwin: "Stop SQL Injection Attacks Before They Stop You" - http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/
 * SQL Injection - http://msdn2.microsoft.com/en-us/library/ms161953.aspx
 '''Tools'''<br>

@@ Line 133: / Line 133: @@
    return @result
 </pre>
-This code, written by Antonin Foller (see links at the bottom of the page), creates a new xp_cmdshell using sp_oacreate, sp_method and sp_destroy (as long as they haven't been disabled too, of course). Before using it, we need to delete the first xp_cmdshell we created (even if it was not working), otherwise the two declarations will collide.
+This code, written by Antonin Foller (see links at the bottom of the page), creates a new xp_cmdshell using sp_oacreate, sp_oamethod and sp_oadestroy (as long as they haven't been disabled too, of course). Before using it, we need to delete the first xp_cmdshell we created (even if it was not working), otherwise the two declarations will collide.
 <br><br>
 On SQL Server 2005, xp_cmdshell can be enabled by injecting the following code instead:

@@ Line 210: / Line 210: @@
 ====Trial and error====
-Alternatively, one may play lucky. That is the attacker may assume that there is a blind or out-of-band SQL injection vulnerability in a the web application. He will then select an attack vector (e.g., a web entry), use fuzz vectors ([[[OWASP_Testing_Guide_Appendix_C:_Fuzz_Vectors|1]]]) against this channel and watch the response. For example, if the web application is looking for a book using a query
+Alternatively, one may play lucky. That is the attacker may assume that there is a blind or out-of-band SQL injection vulnerability in a the web application. He will then select an attack vector (e.g., a web entry), use fuzz vectors ([[OWASP_Testing_Guide_Appendix_C:_Fuzz_Vectors|1]]) against this channel and watch the response. For example, if the web application is looking for a book using a query
     select * from books where title='''text entered by the user'''

@@ Line 214: / Line 214: @@
     select * from books where title='''text entered by the user'''
-then the penetration tester might enter the text: ''''Bomba' OR 1=1-''' and if data is not properly validated, the query will go through and return the whole list of books. This is evidence that there is a SQL-injection vulnerability. The penetration tester might later ''play'' with the queries in order to assess the criticality of this vulnerability.
+then the penetration tester might enter the text: ''''Bomba' OR 1=1-''' and if data is not properly validated, the query will go through and return the whole list of books. This is evidence that there is a SQL injection vulnerability. The penetration tester might later ''play'' with the queries in order to assess the criticality of this vulnerability.
 ====If more than one error message is displayed====