This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP SQLiX Project"

From OWASP
Jump to: navigation, search
(→‎Output example)
m (Added a date to be more clear.)
 
(35 intermediate revisions by 14 users not shown)
Line 1: Line 1:
−
== Overview ==
+
=Main=
  
−
SQLiX, coded in Perl, is a SQL Injection scanner, able to crawl, detect SQL injection vectors, identify the back-end database and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and doesn't need to reverse engineer the original SQL request (using only function calls).
+
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 +
<div style="width:100%;height:100px;border:0,margin:0;overflow: hidden;">[[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]] </div>
  
−
== Goals ==
+
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
−
'''SQLiX''' is a '''SQL Injection scanner''' which attempts to fill the gap between what commercial software available on the market can do and what can really be done to detect and identify SQL injection.
+
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 +
'''NOTE:'''
 +
 
 +
The project is currently under the process of porting from Perl to Python. The next version will be released soon!<br />-- AnirudhAnand, 16 March 2014
 +
 
 +
==Introduction==
 +
 
 +
SQLiX is a [[SQL Injection]] scanner coded in Perl. It is able to crawl, detect SQL injection vectors, identify the back-end database, and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and doesn't need to reverse engineer the original SQL request (using only function calls).
 +
 
 +
If you are a developer interested in remediating or avoiding the kinds of SQL injection vulnerabilities this tool can find, check out the OWASP [[SQL Injection Prevention Cheat Sheet]].
 +
 
 +
==Description==
 +
 
 +
'''SQLiX''' is a '''[[SQL Injection]] scanner''' which attempts to fill the gap between what commercial software available on the market can do and what can really be done to detect and identify SQL injection.
  
 
Current injection methods used by commercial web assessment software are based on error generation or statement injections.
 
Current injection methods used by commercial web assessment software are based on error generation or statement injections.
Line 17: Line 31:
 
'''statement injection:'''
 
'''statement injection:'''
  
−
The second method used is statement injection.
+
The second method used is statement injection. Let's look at an example:
−
Let's look at an example:
 
 
   
 
   
 
The target URL
 
The target URL
Line 40: Line 53:
  
  
−
----
+
==Licensing==
 +
OWASP SQLiX is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
  
  
−
'''How could SQLiX help to fill the gap?'''
+
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 +
 
 +
== What is SQLiX? ==
 +
 
 +
OWASP SQLiX  provides:
  
 
* SQLiX uses multiple techniques to determine if the current server-side script is vulnerable to SQL Injection
 
* SQLiX uses multiple techniques to determine if the current server-side script is vulnerable to SQL Injection
Line 54: Line 72:
 
* SQLiX contains an exploit module to demonstrate how a hacker could exploit the found SQL injection to gather sensitive information
 
* SQLiX contains an exploit module to demonstrate how a hacker could exploit the found SQL injection to gather sensitive information
  
−
== Download ==
 
  
−
OWASP SQLiX v1.0 is available for download [http://cedri.cc/tools/SQLiX_v1.0.tar.gz '''here'''].
+
== Presentation ==
  
−
== Features ==
+
Link to presentation
  
−
TBD
 
  
−
== Command line usage ==
+
 
 +
== Project Leader ==
 +
 
 +
Anirudh
 +
 
 +
 
 +
 
 +
== Related Projects ==
 +
 
 +
 
 +
 
 +
| valign="top"  style="padding-left:25px;width:200px;" |
 +
 
 +
== Quick Download ==
 +
 
 +
OWASP SQLiX v1.0 is available for download [http://cedri.cc/tools/SQLiX_v1.0.tar.gz '''here'''] or [http://www.mediafire.com/?5lbt0tb1jee '''here'''].
 +
 
 +
 
 +
== News and Events ==
 +
* [20 Nov 2013] News 2
 +
* [30 Sep 2013] News 1
 +
 
 +
 
 +
== In Print ==
 +
 
 +
 
 +
 
 +
==Classifications==
 +
 
 +
  {| width="200" cellpadding="2"
 +
  |-
 +
  | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]] 
 +
  |-
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=]]
 +
  |}
 +
 
 +
|}
 +
 
 +
=Requirements=
 +
Perl with the following dependencies:
 +
 
 +
WWW::CheckSite
 +
 
 +
Tie::CharArray
 +
 
 +
      perl -MCPAN -e 'install WWW::CheckSite'
 +
      perl -MCPAN -e 'install Tie::CharArray'
 +
 
 +
= Command line usage =
  
 
'''Usage: SQLiX.pl [options]'''
 
'''Usage: SQLiX.pl [options]'''
Line 115: Line 184:
 
                                       v=5 => debug view [all url,content and headers are displayed]
 
                                       v=5 => debug view [all url,content and headers are displayed]
  
−
== Output example==
+
 
 +
= Output example =
  
 
*'''MS-SQL System command execution'''  
 
*'''MS-SQL System command execution'''  
Line 183: Line 253:
 
  Analysing URI obtained by flat file [crawling]
 
  Analysing URI obtained by flat file [crawling]
 
   http://www.target.example.com/MySQL-DocumentDescriptionMagicQuote.asp?DocID=2
 
   http://www.target.example.com/MySQL-DocumentDescriptionMagicQuote.asp?DocID=2
−
        [+] working on DocID
+
      [+] working on DocID
−
                [+] Method: MS-SQL error message
+
            [+] Method: MS-SQL error message
−
                [+] Method: SQL error message
+
            [+] Method: SQL error message
−
                        [FOUND] Match found INPUT:[user] - "Microsoft OLE DB Provider for ODBC Drivers"
+
                  [FOUND] Match found INPUT:[user] - "Microsoft OLE DB Provider for ODBC Drivers"
−
                        [INFO] Error without quote
+
                  [INFO] Error without quote
−
                        [INFO] Database identified: MySQL Server
+
                  [INFO] Database identified: MySQL Server
−
                        [INFO] Current function: version()
+
                  [INFO] Current function: version()
−
                        [INFO] length: 19
+
                  [INFO] length: 19
−
                            4.1.20-community-nt
+
                      4.1.20-community-nt
−
                        [FOUND] SQL error message
+
                  [FOUND] SQL error message
 
   http://www.target.example.com/PGSQL-DocumentDescription.asp?DocID=2
 
   http://www.target.example.com/PGSQL-DocumentDescription.asp?DocID=2
−
        [+] working on DocID
+
      [+] working on DocID
−
                [+] Method: MS-SQL error message
+
            [+] Method: MS-SQL error message
−
                [+] Method: SQL error message
+
            [+] Method: SQL error message
−
                        [FOUND] Match found INPUT:['] - "Microsoft OLE DB Provider for ODBC Drivers"
+
                  [FOUND] Match found INPUT:['] - "Microsoft OLE DB Provider for ODBC Drivers"
−
                        [INFO] Error without quote
+
                  [INFO] Error without quote
−
                        [INFO] Database identified: PostgreSQL Server
+
                  [INFO] Database identified: PostgreSQL Server
−
                        [INFO] Current function: version()
+
                  [INFO] Current function: version()
−
                        [INFO] length: 88
+
                  [INFO] length: 88
−
                            PostgreSQL 8.0.7 on i686-pc-mingw32, compiled by GCC gcc.exe (GCC) 3.4.2 (mingw-special)
+
                      PostgreSQL 8.0.7 on i686-pc-mingw32, compiled by GCC gcc.exe (GCC) 3.4.2
−
                        [FOUND] SQL error message
+
                  [FOUND] SQL error message
 
   
 
   
 
  RESULTS:
 
  RESULTS:
−
  The variable [DocID] from [ http://www.target.example.com/MySQL-DocumentDescriptionMagicQuote.asp?DocID=2 ] ...
+
  The variable [DocID] from  
 +
  [ http://www.target.example.com/MySQL-DocumentDescriptionMagicQuote.asp?DocID=2 ] ...
 
     ... is vulnerable to SQL Injection [Error message (user) - MySQL].
 
     ... is vulnerable to SQL Injection [Error message (user) - MySQL].
−
  The variable [DocID] from [ http://www.target.example.com/PGSQL-DocumentDescription.asp?DocID=2 ] ...
+
  The variable [DocID] from
 +
  [ http://www.target.example.com/PGSQL-DocumentDescription.asp?DocID=2 ] ...
 
     ... is vulnerable to SQL Injection [Error message (') - PostgreSQL].
 
     ... is vulnerable to SQL Injection [Error message (') - PostgreSQL].
  
−
== Future Development ==
 
  
−
Currently working on a module able to dump the database schema and the data of the vulnerable database.
 
  
−
PS: If you are a real Perl developer (not like me ;) ), feel free to provide code improvement or advice.
 
  
−
== News ==
+
= Acknowledgements =
 +
==Volunteers==
  
−
'''OWASP SQLiX Project Created! - 09:45, 28 August 2006 (EDT)'''
 
  
−
While the SQLiX Project has been under development for some time now, it has only recently been donated to OWASP.
+
= Road Map and Getting Involved =
 +
As of XXX, the priorities are:
 +
* xxx
 +
* xxx
 +
* xxx
  
−
The OWASP community would like to thank Cedric Cochin for the generous donation.  
+
We hope you find the OWASP SQLiX Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to owasp@owasp.org.  To join the OWASP SQLiX Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-sqlix subscription page.]
  
−
== Project Contributor ==
 
  
−
The project is lead by Cedric Cochin (cedric.cochin at gmail dot com)
 
  
−
[http://cedri.cc Homepage]
 
  
−
== Project Sponsors ==
 
  
−
If you would like to help SQLiX project developement, feel free to contact the project leader.
+
=Project About=
 +
==== Project Identification ====
 +
{{:GPC_Project_Details/OWASP_SQLiX_Project | OWASP Project Identification Tab}}}}
  
−
== RoadMap ==
+
__NOTOC__ <headertabs />
  
−
Please refer to the [http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project_Roadmap OWASP SQLiX Project Roadmap] for current tasks.
 
  
−
[[Category:OWASP SQLiX Project Roadmap]]
+
[[Category:OWASP Project|SQLiX Project]]
−
[[Category:OWASP Project]]
 
 
[[Category:OWASP Download]]
 
[[Category:OWASP Download]]
 
[[Category:OWASP Tool]]
 
[[Category:OWASP Tool]]
−
[[Category:Injection Attack]]
 
−
[[Category:Attack]]
 
 
[[Category:SQL]]
 
[[Category:SQL]]
 +
[[Category:OWASP Oracle Project]]

Latest revision as of 18:51, 25 May 2017

OWASP Inactive Banner.jpg

NOTE:

The project is currently under the process of porting from Perl to Python. The next version will be released soon!
-- AnirudhAnand, 16 March 2014

Introduction

SQLiX is a SQL Injection scanner coded in Perl. It is able to crawl, detect SQL injection vectors, identify the back-end database, and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and doesn't need to reverse engineer the original SQL request (using only function calls).

If you are a developer interested in remediating or avoiding the kinds of SQL injection vulnerabilities this tool can find, check out the OWASP SQL Injection Prevention Cheat Sheet.

Description

SQLiX is a SQL Injection scanner which attempts to fill the gap between what commercial software available on the market can do and what can really be done to detect and identify SQL injection.

Current injection methods used by commercial web assessment software are based on error generation or statement injections.

error generation:

The error generation method is quite simple and is based on meta characters like single quotes or double quotes. By injecting these characters in the original SQL request, you generate a syntax error which could result in an SQL error message displayed in the HTTP reply. The main issue with this technique is the fact that it's only based on pattern matching. There is no way to handle multiple languages or complex behaviors when the error message is filtered by the server-side scripts.

statement injection:

The second method used is statement injection. Let's look at an example:

The target URL 

(0) is http://target.example.com/news.php?id=25.

The scanner will try to compare the HTML content of the original request with the HTML content of 

(1) http://target.example.com/news.php?id=25%20or%201=1

(2) http://target.example.com/news.php?id=25%20or%201=0

If the request (1) provides the same result as request (0) and request (2) doesn't, the scanner will conclude that SQL injection is possible. This method works fine, but is very limited by the syntax of the original request. If the original request contains parentheses, store procedures or function calls, this method will rarely work. Worse, if the variable is used by multiple SQL requests, all with different syntaxes, there is no automatic way to make them all work simultaneously.

Frequently you will see more advanced scanners like SQLBrute from www.justinclarke.com trying to reverse engineer the original SQL syntax by injecting multiple requests with different sets of parentheses or comas. This method is a little more time consuming but does provide better results (for free), especially when error messages are not displayed.

Another global issue concerning SQL injection is the fact that pen testers frequently conclude that a given SQL injection vulnerability can't be exploited. By concluding this incorrect statement they are inviting their customers to not patch the vulnerability.


Licensing

OWASP SQLiX is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


What is SQLiX?

OWASP SQLiX provides:

  • SQLiX uses multiple techniques to determine if the current server-side script is vulnerable to SQL Injection
    • conditional errors injection
    • blind injection based on integers, strings or statements
    • MS-SQL verbose error messages ("taggy" method)
  • SQLiX using UDF (User defined functions) or function calls thus no need to reverse engineer the original SQL syntax
  • SQLix is able to identify the database version and gather sensitive information for the following SQL servers: MS-Access, MS-SQL, MySQL, Oracle and PostgreSQL.
  • The comparison module of SQLiX is able to deal with complex HTML contents even when they include dynamic ads
  • SQLiX contains an exploit module to demonstrate how a hacker could exploit the found SQL injection to gather sensitive information


Presentation

Link to presentation


Project Leader

Anirudh


Related Projects

Quick Download

OWASP SQLiX v1.0 is available for download here or here.


News and Events

  • [20 Nov 2013] News 2
  • [30 Sep 2013] News 1


In Print

Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg

Subcategories

This category has only the following subcategory.

O

Retrieved from "https://wiki.owasp.org/index.php?title=Category:OWASP_SQLiX_Project&oldid=230041"