WebApp Sec mailing list archives
Re: SQL injection
From: Serg Belokamen <sergb () tpg com au>
Date: Wed, 19 Jan 2005 22:58:35 +1100
Hi Francesco,Judging from what you wrote, you can do pretty much anything that can be done by a user (database process) the database server is running as. So for example if database server is running as administrator (very silly) then you have admin privelages to the database.
Futhermore, you can try few other less harmful approaches, as an alternative to your DELETE, evil!!!!
You might want to read the paper called "Blind SQL Injection" (sorry, dont have the link handy) and try discovering the database scheema as a hacker would, without any prior knowledge. After that you are set assuming you are nifty with SQL, sprinkle few UNIONS here and there and DB is owned, could be even a server ;) If on the other hand you have access to the database, then login in to the database SQL console and monitor some table (perhaps a test table you might want to create before you start) for changes while you issue an INSERT statment via the web application. This will not only let you see some imediate results and the risks envolved but could also lead to "second-order code injection" attacks (http://www.ngssoftware.com) .
Finaly you may also be interested few other articles such as "SQL Injection Attacks by Example" (again no link, sorry) and "Advanced SQL Injection In SQL Server Applications" (http://www.ngssoftware.com) , as well as trying to probe the web app. from the inside, since chances are security is poor within the account if you could login with 1=1.
Hope this gives you few ideas. Cheers, Serg Francesco wrote:
I have just discovered that I can successfully inject the following SQL: ' OR 1=1; -- into the Username field of a logon form on a "secure" site in my corporate network (Windows 2000, SQL 7.0). When I do this, leaving the password field blank, I am logged into the system as the first user in the "Users" table in the DB which is being authenticated against. LOL. If I can get that far, can't I theoretically: ' OR 1=1; DELETE Users; --or something similar? Couldn't I EXEC some system sprocs this way too? How much damage/rooting can be done here? I need to present a detailedreport to the admins. Thanks, Francesco Francesco Sanfilippo -------------------------------------------Blackcoil Productions - http://blackcoil.com URL123 Link Service - http://url123.com
Current thread:
- SQL injection Francesco (Jan 19)
- Re: SQL injection James Riden (Jan 23)
- Re: SQL injection Josh Zlatin-Amishav (Jan 23)
- RE: SQL injection John McGuire (Jan 23)
- Re: SQL injection exon (Jan 23)
- Re: SQL injection Serg Belokamen (Jan 23)
- Re: SQL injection Cory Foy (Jan 23)
- Re: SQL injection nummish (Jan 23)