Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS.

I am in the process of writing an sql injection tool from scratch, but I am having problems finding a way/number of ways of fingerprinting the DBMS reliably. (I am aware that there are lots of excellent tools out there already, but for this project it needs to be written from scratch).

Doing this manually:

Fingerprinting the DBMS manually is a lot easier as it's easier to observe the changes and behaviour of the page, however when trying to do this in an automated fashion with a script/program it becomes a lot more difficult to monitor the behaviour of the page.

Automating this using a scanner/fuzzer:

I am aware that one possible way is to analyse the error messages returned and see whether they contain certain error messages relating to a particular DBMS, but in instances where this is not possible I need another way of doing this.

The problem I am having:

I have also played around with string concatenation methods e.g ...

This uses the fact that different DBMS handles string concantenation with different operators. Concatentation is performed in different DBMS like:

MS SQL : 'string1' + 'string2'
MYSQL : CONCAT('string1','string2')
Oracle : 'string1' || 'string2' or CONCAT('string1','string2')

http://example/index.php?id=1+UNION+SELECT+NULL, CONCAT('sql',+'injection'),NULL,NULL  <-- MYSQL
http://www.example.com/abc.php?id=1 AND 'str1str2' ='str1'+'str2'         <-- MSSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- MYSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- ORACLE
http://www.example.com/abc.php?=1 AND 'str1str2'='str1'||'str2'   <-- ORACLE

I can supposedly use this method to see if the string is output on the page or if the page changes or if an error is generated...and so on

but from some testing I have done a number of these concatenation methods appear to work on a number of DBMS (e.g using the + symbol works on both MSSQL and MYSQL), which is no use when I am trying to definatively determine which DBMS it is.

Using different SQL dialect appears to be another possible method, see http://digitizor.com/2009/03/27/sql-injection-2-fingerprinting/, but I can find very little information regarding this method?

Do you know of the best/most reliable way of fingerprinting the DBMS in an automated/scripted fashion?

your help is much appreciated, thanks

share|improve this question
    
On MySQL, 'a'+'b' is an arithmetic operation and yields 0 as neither 'a' nor 'b' are numeric. –  Gumbo Apr 11 '13 at 16:32
1  
You could, download a program that already includes this functionality like Havij itsecteam.com/products/havij-v116-advanced-sql-injection Then run wireshark on your NIC while it fingerprints the vulnerable database and view the requests it sends/receives. –  NULLZ Apr 12 '13 at 0:16
add comment

2 Answers

up vote 2 down vote accepted

If you like to automate fingerprinting i recommend using more than just one indicator, because sometimes it happens to be a little tricky...

Even i hate those timing attacks they are sometimes quite useful... Here another hint on different sql dialects...

(MSSQL) http://www.example.com/abc.php?id=1; waitfor delay '0:0:10'--

(MySQL) http://www.example.com/abc.php?id=1; if 1=1 BENCHMARK(1000000000,MD5(1))

(Postgre) http://www.example.com/abc.php?id=1; select pg_sleep(10);

share|improve this answer
    
Yes this would be a good way of automating fingerprinting that I had not considered, thanks –  perl-user Apr 17 '13 at 14:38
    
no problem... for oracle this doesn't work. afaik ora doesn't have something like sleep (without sys rights) –  Dr.Ü Apr 17 '13 at 16:01
add comment

Have you considered how SQLMap does its fingerprinting? It says it uses:

error messages, banner parsing, functions output comparison and specific features such as MySQL comment injection.

share|improve this answer
    
Yes, the only real piece of detailed information I was able to find related to how SQL map does it's fingerprinting (I may be mistaken but it may have actually been written by one of the authors of SQL map), thanks for your help –  perl-user Apr 17 '13 at 14:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.