This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Testing for MySQL"

From OWASP
Jump to: navigation, search
(Blind Sql Injection)
 
(48 intermediate revisions by 12 users not shown)
Line 1: Line 1:
{{Template:OWASP Testing Guide v2}}
+
{{Template:OWASP Testing Guide 4}}
  
== Short Description of the Issue (Topic and Explanation) ==  
+
== Summary ==  
[[SQL Injection AoC|SQL injection]] vulnerabilities occur whenever input is used in the construction of an SQL query without being adequately constrained or sanitized. The use of dynamic SQL (the construction of SQL queries by concatenation of strings) opens the door to these vulnerabilities. SQL injection allows an attacker to access the SQL servers. It allows for the execution of SQL code under the privileges of the user used to connect to the database.
+
[[SQL Injection]] vulnerabilities occur whenever input is used in the construction of a SQL query without being adequately constrained or sanitized. The use of dynamic SQL (the construction of SQL queries by concatenation of strings) opens the door to these vulnerabilities. SQL injection allows an attacker to access the SQL servers. It allows for the execution of SQL code under the privileges of the user used to connect to the database.
  
''MySQL server'' has a few particularities so that some exploits need to be
 
specially customized for this application. That's the subject of this section.
 
  
== Black Box testing and example ==
+
''MySQL server'' has a few particularities so that some exploits need to be specially customized for this application. That's the subject of this section.
=== How to Test ===
 
When a Sql Injection is found with Mysql as DBMS backend,
 
there is a number of attacks that could be accomplished depending
 
on Mysql version and user privileges on DBMS.
 
  
Mysql comes with at least four versions used in production worldwide.
+
 
3.23.x, 4.0.x, 4.1.x and 5.0.x.
+
== How to Test ==
Every version has a set of features proportional to version number.
+
When an SQL injection vulnerability is found in an application backed by a MySQL database, there are a number of attacks that could be performed depending on the MySQL version and user privileges on DBMS.
 +
 
 +
 
 +
MySQL comes with at least four versions which are used in production worldwide, 3.23.x, 4.0.x, 4.1.x and 5.0.x. Every version has a set of features proportional to version number.
  
 
* From Version 4.0: UNION  
 
* From Version 4.0: UNION  
Line 23: Line 20:
  
  
To be noted that for MySQL versions before 4.0.x, only Boolean or time-based Blind Injection  
+
It should be noted that for MySQL versions before 4.0.x, only Boolean or time-based Blind Injection attacks could be used, since the subquery functionality or UNION statements were not implemented.
could be used, as no subqueries or UNION statements are implemented.
+
 
  
From now on it will be supposed there is a classic sql injection in a request like the one described in [[SQL Injection AoC|SQL injection]] Section.
+
From now on, we will assume that there is a classic SQL injection vulnerability, which can be triggered by a request similar to the the one described in the Section on [[Testing for SQL Injection (OWASP-DV-005)|Testing for SQL Injection]].
  
 
  <nowiki>http://www.example.com/page.php?id=2</nowiki>
 
  <nowiki>http://www.example.com/page.php?id=2</nowiki>
  
=== The single Quotes Problem ===
 
Before taking advantage of MySQL features,
 
it has to be taken in consideration how strings could be represented
 
in a statement, as often web applications escape single quotes.
 
  
Mysql quote escaping is the following:<br>
+
=== The Single Quotes Problem ===
 +
Before taking advantage of MySQL features, it has to be taken in consideration how strings could be represented in a statement, as often web applications escape single quotes.
 +
 
 +
 
 +
MySQL quote escaping is the following:<br>
 
''' <nowiki>'A string with \'quotes\''</nowiki> '''
 
''' <nowiki>'A string with \'quotes\''</nowiki> '''
  
That is MySQL interprets escaped apostrophes (\') as characters and not as
 
metacharacters.
 
  
So if the needs of using constant strings occurs,
+
That is, MySQL interprets escaped apostrophes (\') as characters and not as metacharacters.
two cases are to be differentiated:  
+
 
 +
 
 +
So if the application, to work properly, needs to use constant strings, two cases are to be differentiated:  
 
# Web app escapes single quotes (' => \')
 
# Web app escapes single quotes (' => \')
# Web app does not escapes  single quotes escaped (' => ')
+
# Web app does not escape single quotes (' => ')
  
Under Mysql there is some standard way to bypass the need of single quotes, anyway there is some trick to
 
have a constant string to be declared without the needs of single quotes.
 
  
Let's suppose we want know the value of a field named 'password' in a record
+
Under MySQL, there is a standard way to bypass the need of single quotes, having a constant string to be declared without the need for single quotes.
with a condition like the following:
 
password like 'A%'
 
  
# The ascii values in a concatenated hex:<br>
+
 
 +
Let's suppose we want to know the value of a field named 'password' in a record, with a condition like the following:
 +
#: password like 'A%'
 +
# The ASCII values in a concatenated hex:<br>
 
#: password LIKE 0x4125
 
#: password LIKE 0x4125
 
# The char() function:
 
# The char() function:
 
#: password LIKE CHAR(65,37)
 
#: password LIKE CHAR(65,37)
 +
  
 
=== Multiple mixed queries: ===
 
=== Multiple mixed queries: ===
  
Mysql library connectors do not support multiple queries separated
+
MySQL library connectors do not support multiple queries separated by '''<nowiki>';'</nowiki>''' so there's no way to inject multiple non-homogeneous SQL commands inside a single SQL injection vulnerability like in Microsoft SQL Server.
by '''<nowiki>';'</nowiki>''' so there's no way to inject multiple non homogeneous sql commands  
+
 
inside a single SQL injection vulnerability like in Microsoft SQL Server.
 
  
As an example the following injection will result in an error:
+
For example the following injection will result in an error:
  
 
  1 ; update tablename set code='javascript code' where 1 --
 
  1 ; update tablename set code='javascript code' where 1 --
 +
  
 
=== Information gathering ===
 
=== Information gathering ===
  
==== Fingerprinting Mysql ====
+
==== Fingerprinting MySQL ====
  
Of course, the first thing to know is if there's Mysql DBMS as a backend.
+
Of course, the first thing to know is if there's MySQL DBMS as a back end database. MySQL server has a feature that is used to let other DBMS ignore a clause in MySQL dialect. When a comment block ''('/**/')'' contains an exclamation mark ''('/*! sql here*/')'' it is interpreted by MySQL, and is considered as a normal comment block by other DBMS as explained in [http://dev.mysql.com/doc/refman/5.0/en/comments.html MySQL manual].
  
Mysql server has a feature that is used to let other DBMS to ignore a clause in MySQL
 
dialect.
 
When a comment block ''('/**/')'' contains an exlamation mark ''('/*! sql here*/')'' it is
 
interpreted by mysql, and is considered as a normal comment block by other DBMS
 
as explained in [[http://dev.mysql.com/doc/refman/5.0/en/comments.html MySQL manual]].
 
  
E.g.:
+
Example:
 
  1 /*! and 1=0 */
 
  1 /*! and 1=0 */
 +
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
''If MySQL is present, the clause inside comment block will be interpreted.''
+
 
 +
If MySQL is present, the clause inside the comment block will be interpreted.
 +
 
  
 
==== Version ====
 
==== Version ====
Line 95: Line 90:
 
  <nowiki>if(version >= 4.1.10)  
 
  <nowiki>if(version >= 4.1.10)  
 
   add 'and 1=0' to the query.</nowiki>
 
   add 'and 1=0' to the query.</nowiki>
 +
  
 
These are equivalent as the result is the same.
 
These are equivalent as the result is the same.
Line 107: Line 103:
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
''A string like this: '''5.0.22-log''' ''
+
 
 +
A string like this:  
 +
5.0.22-log
 +
 
  
 
==== Login User ====
 
==== Login User ====
  
There are two kinds of users MySQL Server relies.
+
There are two kinds of users MySQL Server relies upon.
# [[http://dev.mysql.com/doc/refman/5.0/en/information-functions.html USER()]]: the user connected to MySQL Server.
+
# [[http://dev.mysql.com/doc/refman/5.0/en/information-functions.html USER()]]: the user connected to the MySQL Server.
# [[http://dev.mysql.com/doc/refman/5.0/en/information-functions.html CURRENT_USER()]]: the internal user is executing the query.
+
# [[http://dev.mysql.com/doc/refman/5.0/en/information-functions.html CURRENT_USER()]]: the internal user who is executing the query.
  
There is some difference between 1 and 2.
 
  
The main one is that an anonymous user could connect (if allowed)
+
There is some difference between 1 and 2. The main one is that an anonymous user could connect (if allowed) with any name, but the MySQL internal user is an empty name (<nowiki>''</nowiki>). Another difference is that a stored procedure or a stored function are executed as the creator user, if not declared elsewhere. This can be known by using '''CURRENT_USER'''.
with any name but the MySQL internal user is an empty name (<nowiki>''</nowiki>).
 
  
Another difference is that a stored procedure or a stored function
 
are executed as the creator user, if not declared elsewhere. This
 
could be known by using '''CURRENT_USER'''.
 
  
 
In band injection:
 
In band injection:
Line 131: Line 125:
  
 
  1 AND USER() like 'root%'
 
  1 AND USER() like 'root%'
 +
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
''A string like this: '''user@hostname''' ''
+
 
 +
A string like this:  
 +
user@hostname
 +
 
  
 
==== Database name in use ====
 
==== Database name in use ====
Line 146: Line 144:
  
 
  1 AND DATABASE() like 'db%'
 
  1 AND DATABASE() like 'db%'
 +
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
''A string like this: '''dbname''' ''
+
A string like this:
 +
dbname
 +
 
  
 
==== INFORMATION_SCHEMA ====
 
==== INFORMATION_SCHEMA ====
From Mysql 5.0 a view named [[http://dev.mysql.com/doc/refman/5.0/en/information-schema.html INFORMATION_SCHEMA]] was created.
+
From MySQL 5.0 a view named [[http://dev.mysql.com/doc/refman/5.0/en/information-schema.html INFORMATION_SCHEMA]] was created.
It allows to get all informations about databases, tables and columns
+
It allows us to get all informations about databases, tables, and columns, as well as procedures and functions.
as well as procedures and functions.
+
 
  
Here is a summary about some interesting View.
+
Here is a summary of some interesting Views.
 
{| border=1
 
{| border=1
 
  || '''Tables_in_INFORMATION_SCHEMA''' || '''DESCRIPTION'''
 
  || '''Tables_in_INFORMATION_SCHEMA''' || '''DESCRIPTION'''
Line 182: Line 183:
 
|-
 
|-
 
|}
 
|}
All of these informations could be extracted by using known techniques as  
+
 
described in SQL Injection paragraph.
+
 
 +
All of this information could be extracted by using known techniques as described in SQL Injection section.
 +
 
  
 
=== Attack vectors ===
 
=== Attack vectors ===
Line 189: Line 192:
 
==== Write in a File ====
 
==== Write in a File ====
  
If connected user has '''FILE''' privileges _and_ single quotes are not escaped,
+
If the connected user has '''FILE''' privileges and single quotes are not escaped, the 'into outfile' clause can be used to export query results in a file.
it could be used the 'into outfile' clause to export query results in a file.
 
  
 
  Select * from table into outfile '/tmp/file'
 
  Select * from table into outfile '/tmp/file'
  
N.B. there are no ways to bypass single quotes outstanding filename.
 
So if there's some sanitization on single quotes like escape (\') there will
 
be no way to use 'into outfile' clause.
 
  
This kind of attack could be used as an out-of-band technique to gain informations
+
Note: there is no way to bypass single quotes surrounding a filename. So if there's some sanitization on single quotes like escape (\') there will be no way to use the 'into outfile' clause.
about the results of a query or to write a file which could be executed inside the  
+
 
web server directory.
+
 
 +
This kind of attack could be used as an out-of-band technique to gain information about the results of a query or to write a file which could be executed inside the web server directory.
 +
 
  
 
Example:
 
Example:
  
 
  <nowiki>1 limit 1 into outfile '/var/www/root/test.jsp' FIELDS ENCLOSED BY '//'  LINES TERMINATED BY '\n<%jsp code here%>';</nowiki>
 
  <nowiki>1 limit 1 into outfile '/var/www/root/test.jsp' FIELDS ENCLOSED BY '//'  LINES TERMINATED BY '\n<%jsp code here%>';</nowiki>
 +
  
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
'' Results are stored in a file with rw-rw-rw privileges owned by  
+
Results are stored in a file with rw-rw-rw privileges owned by MySQL user and group.
mysql user and group.
 
  
 
Where ''/var/www/root/test.jsp'' will contain:
 
Where ''/var/www/root/test.jsp'' will contain:
Line 217: Line 218:
 
==== Read from a File ====
 
==== Read from a File ====
  
Load_file is a native function that can read a file when allowed by  
+
Load_file is a native function that can read a file when allowed by the file system permissions. If a connected user has '''FILE''' privileges, it could be used to get the files' content. Single quotes escape sanitization can by bypassed by using previously described techniques.
filesystem permissions.  
+
 
 +
load_file('filename')
  
If connected user has '''FILE''' privileges, it could be used to get files content.
 
  
Single quotes escape sanitization can by bypassed by using previously described
+
'''Result Expected:'''<br>
techniques.
 
  
load_file('filename')
+
The whole file will be available for exporting by using standard techniques.
  
'''Result Expected:'''<br>
 
  
'' the whole file will be available for exporting by using standard techniques.''
+
=== Standard SQL Injection Attack ===
  
 +
In a standard SQL injection you can have results displayed directly in a page as normal output or as a MySQL error.
 +
By using already mentioned SQL Injection attacks and the already described MySQL features, direct SQL injection could be easily accomplished at a level depth depending primarily on the MySQL version the pentester is facing.
  
=== Standard Sql Injection Attack ===
 
  
In a standard sql injection you can have results displayed directly
+
A good attack is to know the results by forcing a function/procedure or the server itself to throw an error. A list of errors thrown by MySQL and in particular native functions could be found on [http://dev.mysql.com/doc/refman/5.0/en/error-messages-server.html MySQL Manual].
in a page as normal output or as a MySQL error.
 
By using already mentioned SQL Injection attacks and the already described
 
MySQL features, direct sql injection could be easily accomplished at a level
 
depth depending primarily on mysql version the pentester is facing.
 
  
A good attack is to know the results by forcing a function/procedure
 
or the server itself to throw an error.
 
A list of errors thrown by Mysql and in particular native functions could
 
be found on [[http://dev.mysql.com/doc/refman/5.0/en/error-messages-server.html MySQL Manual]].
 
  
=== Out of band Sql Injection ===
+
=== Out of band SQL Injection ===
  
 
Out of band injection could be accomplished by using the [[#Write_in_a_File|'into outfile']] clause.
 
Out of band injection could be accomplished by using the [[#Write_in_a_File|'into outfile']] clause.
=== Blind Sql Injection ===
+
 
For blind injection there is a set of useful function natively provided by MySQL server.
+
 
 +
=== Blind SQL Injection ===
 +
For blind SQL injection, there is a set of useful function natively provided by MySQL server.
  
 
* String Length:  
 
* String Length:  
Line 256: Line 250:
 
*: ''SUBSTRING(string, offset, #chars_returned)''
 
*: ''SUBSTRING(string, offset, #chars_returned)''
 
* Time based Blind Injection: BENCHMARK and SLEEP  
 
* Time based Blind Injection: BENCHMARK and SLEEP  
*: ''BENCHMARK(#ofcicles,action_to_be_performed )''
+
*: ''BENCHMARK(#ofcycles,action_to_be_performed )''
*: Benchmark function could be used to perform timing attacks when blind injection by boolean values does not yeld any results.
+
*: The benchmark function could be used to perform timing attacks, when blind injection by boolean values does not yield any results.
*: See. SLEEP() (Mysql > 5.0.x) for an alternative on benchmark.
+
*: See. SLEEP() (MySQL > 5.0.x) for an alternative on benchmark.
  
For a complete list the reader could refer to [[http://dev.mysql.com/doc/refman/5.0/en/functions.html MySQL manual]].
+
For a complete list, refer to the MySQL manual at http://dev.mysql.com/doc/refman/5.0/en/functions.html
 +
 
 +
 
 +
 
 +
==Tools==
 +
* Francois Larouche: Multiple DBMS SQL Injection tool - http://www.sqlpowerinjector.com/index.htm<br>
 +
* ilo--, Reversing.org - [http://packetstormsecurity.org/files/43795/sqlbftools-1.2.tar.gz.html sqlbftools]
 +
* Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http://sqlmap.org/
 +
* Muhaimin Dzulfakar: MySqloit, MySql Injection takeover tool - http://code.google.com/p/mysqloit/
 +
* http://sqlsus.sourceforge.net/
  
== Gray Box testing and example ==
 
'''Testing for Topic X vulnerabilities:'''<br>
 
...<br>
 
'''Result Expected:'''<br>
 
...<br><br>
 
 
== References ==
 
== References ==
 
'''Whitepapers'''<br>
 
'''Whitepapers'''<br>
* Chris Anley: "Hackproofing MySQL" -http://www.nextgenss.com/papers/HackproofingMySQL.pdf
+
* Chris Anley: "Hackproofing MySQL" - http://www.databasesecurity.com/mysql/HackproofingMySQL.pdf
 
 
'''Tools'''<br>
 
* Francois Larouche: Multiple DBMS Sql Injection tool - [[http://www.sqlpowerinjector.com/index.htm SQL Power Injector]]<br>
 
* ilo--:  MySql Blind Injection Bruteforcing, Reversing.org - [[http://www.reversing.org/node/view/11 sqlbftools]]<br>
 
* Daniele Bellucci: MySql Injection Inference tool - [[http://sourceforge.net/projects/sqlmap SqlMap]]<br>
 
* Antonio Parata: Dump Files by sql inference on Mysql - [[http://www.ictsc.it/site/IT/projects/sqlDumper/sqldumper.src.tar.gz SqlDumper]]<br>
 
  
{{Category:OWASP Testing Project AoC}}
+
'''Case Studies'''<br>
 +
* Zeelock: Blind Injection in MySQL Databases - http://archive.cert.uni-stuttgart.de/bugtraq/2005/02/msg00289.html

Latest revision as of 15:57, 31 July 2014

Template:OWASP Testing Guide 4

Summary

SQL Injection vulnerabilities occur whenever input is used in the construction of a SQL query without being adequately constrained or sanitized. The use of dynamic SQL (the construction of SQL queries by concatenation of strings) opens the door to these vulnerabilities. SQL injection allows an attacker to access the SQL servers. It allows for the execution of SQL code under the privileges of the user used to connect to the database.


MySQL server has a few particularities so that some exploits need to be specially customized for this application. That's the subject of this section.


How to Test

When an SQL injection vulnerability is found in an application backed by a MySQL database, there are a number of attacks that could be performed depending on the MySQL version and user privileges on DBMS.


MySQL comes with at least four versions which are used in production worldwide, 3.23.x, 4.0.x, 4.1.x and 5.0.x. Every version has a set of features proportional to version number.

  • From Version 4.0: UNION
  • From Version 4.1: Subqueries
  • From Version 5.0: Stored procedures, Stored functions and the view named INFORMATION_SCHEMA
  • From Version 5.0.2: Triggers


It should be noted that for MySQL versions before 4.0.x, only Boolean or time-based Blind Injection attacks could be used, since the subquery functionality or UNION statements were not implemented.


From now on, we will assume that there is a classic SQL injection vulnerability, which can be triggered by a request similar to the the one described in the Section on Testing for SQL Injection.

http://www.example.com/page.php?id=2


The Single Quotes Problem

Before taking advantage of MySQL features, it has to be taken in consideration how strings could be represented in a statement, as often web applications escape single quotes.


MySQL quote escaping is the following:
'A string with \'quotes\''


That is, MySQL interprets escaped apostrophes (\') as characters and not as metacharacters.


So if the application, to work properly, needs to use constant strings, two cases are to be differentiated:

  1. Web app escapes single quotes (' => \')
  2. Web app does not escape single quotes (' => ')


Under MySQL, there is a standard way to bypass the need of single quotes, having a constant string to be declared without the need for single quotes.


Let's suppose we want to know the value of a field named 'password' in a record, with a condition like the following:

  1. password like 'A%'
  2. The ASCII values in a concatenated hex:
    password LIKE 0x4125
  3. The char() function:
    password LIKE CHAR(65,37)


Multiple mixed queries:

MySQL library connectors do not support multiple queries separated by ';' so there's no way to inject multiple non-homogeneous SQL commands inside a single SQL injection vulnerability like in Microsoft SQL Server.


For example the following injection will result in an error:

1 ; update tablename set code='javascript code' where 1 --


Information gathering

Fingerprinting MySQL

Of course, the first thing to know is if there's MySQL DBMS as a back end database. MySQL server has a feature that is used to let other DBMS ignore a clause in MySQL dialect. When a comment block ('/**/') contains an exclamation mark ('/*! sql here*/') it is interpreted by MySQL, and is considered as a normal comment block by other DBMS as explained in MySQL manual.


Example:

1 /*! and 1=0 */


Result Expected:

If MySQL is present, the clause inside the comment block will be interpreted.


Version

There are three ways to gain this information:

  1. By using the global variable @@version
  2. By using the function [VERSION()]
  3. By using comment fingerprinting with a version number /*!40110 and 1=0*/
    which means
if(version >= 4.1.10) 
   add 'and 1=0' to the query.


These are equivalent as the result is the same.

In band injection:

1 AND 1=0 UNION SELECT @@version /*

Inferential injection:

1 AND @@version like '4.0%'

Result Expected:

A string like this:

5.0.22-log


Login User

There are two kinds of users MySQL Server relies upon.

  1. [USER()]: the user connected to the MySQL Server.
  2. [CURRENT_USER()]: the internal user who is executing the query.


There is some difference between 1 and 2. The main one is that an anonymous user could connect (if allowed) with any name, but the MySQL internal user is an empty name (''). Another difference is that a stored procedure or a stored function are executed as the creator user, if not declared elsewhere. This can be known by using CURRENT_USER.


In band injection:

1 AND 1=0 UNION SELECT USER() 

Inferential injection:

1 AND USER() like 'root%'


Result Expected:

A string like this:

user@hostname


Database name in use

There is the native function DATABASE()

In band injection:

1 AND 1=0 UNION SELECT DATABASE() 

Inferential injection:

1 AND DATABASE() like 'db%'


Result Expected:
A string like this:

dbname


INFORMATION_SCHEMA

From MySQL 5.0 a view named [INFORMATION_SCHEMA] was created. It allows us to get all informations about databases, tables, and columns, as well as procedures and functions.


Here is a summary of some interesting Views.

Tables_in_INFORMATION_SCHEMA DESCRIPTION
..[skipped].. ..[skipped]..
SCHEMATA All databases the user has (at least) SELECT_priv
SCHEMA_PRIVILEGES The privileges the user has for each DB
TABLES All tables the user has (at least) SELECT_priv
TABLE_PRIVILEGES The privileges the user has for each table
COLUMNS All columns the user has (at least) SELECT_priv
COLUMN_PRIVILEGES The privileges the user has for each column
VIEWS All columns the user has (at least) SELECT_priv
ROUTINES Procedures and functions (needs EXECUTE_priv)
TRIGGERS Triggers (needs INSERT_priv)
USER_PRIVILEGES Privileges connected User has


All of this information could be extracted by using known techniques as described in SQL Injection section.


Attack vectors

Write in a File

If the connected user has FILE privileges and single quotes are not escaped, the 'into outfile' clause can be used to export query results in a file.

Select * from table into outfile '/tmp/file'


Note: there is no way to bypass single quotes surrounding a filename. So if there's some sanitization on single quotes like escape (\') there will be no way to use the 'into outfile' clause.


This kind of attack could be used as an out-of-band technique to gain information about the results of a query or to write a file which could be executed inside the web server directory.


Example:

1 limit 1 into outfile '/var/www/root/test.jsp' FIELDS ENCLOSED BY '//'  LINES TERMINATED BY '\n<%jsp code here%>';


Result Expected:
Results are stored in a file with rw-rw-rw privileges owned by MySQL user and group.

Where /var/www/root/test.jsp will contain:

//field values//
<%jsp code here%>


Read from a File

Load_file is a native function that can read a file when allowed by the file system permissions. If a connected user has FILE privileges, it could be used to get the files' content. Single quotes escape sanitization can by bypassed by using previously described techniques.

load_file('filename')


Result Expected:

The whole file will be available for exporting by using standard techniques.


Standard SQL Injection Attack

In a standard SQL injection you can have results displayed directly in a page as normal output or as a MySQL error. By using already mentioned SQL Injection attacks and the already described MySQL features, direct SQL injection could be easily accomplished at a level depth depending primarily on the MySQL version the pentester is facing.


A good attack is to know the results by forcing a function/procedure or the server itself to throw an error. A list of errors thrown by MySQL and in particular native functions could be found on MySQL Manual.


Out of band SQL Injection

Out of band injection could be accomplished by using the 'into outfile' clause.


Blind SQL Injection

For blind SQL injection, there is a set of useful function natively provided by MySQL server.

  • String Length:
    LENGTH(str)
  • Extract a substring from a given string:
    SUBSTRING(string, offset, #chars_returned)
  • Time based Blind Injection: BENCHMARK and SLEEP
    BENCHMARK(#ofcycles,action_to_be_performed )
    The benchmark function could be used to perform timing attacks, when blind injection by boolean values does not yield any results.
    See. SLEEP() (MySQL > 5.0.x) for an alternative on benchmark.

For a complete list, refer to the MySQL manual at http://dev.mysql.com/doc/refman/5.0/en/functions.html


Tools

References

Whitepapers

Case Studies