0

OK so I have a classic ASP website and it recently was victim of some SQL injection where some tables where updated. Nothing seriously happened as for I don't keep anything personal in the database. I've researched a bit and can seem to find an answer to my question.

So here is what i have found so far. I have the URL to my website (not the real one)

www.myWebSite/default.asp?pg=buy&Id=1

I can simply write an UPDATE query as such

www.myWebSite/default.asp?pg=buy&Id=1; UPDATE table SET col WHERE something here.

This will update the database and such but that's if you already know all the tables names.

So this isn't ideal at all. My question is: how do i get all the table information? I've tried to get errors to be thrown and do anything I can find online but nothing seems to show.

2

There's a lot of ways to get information out of databases through SQL Injection (similar techniques can work for other injection avenues as well).

First, there's error based - you deliberately create invalid request and the webpage helpfully hands you back a full SQL statement with what's wrong with it. You can use this to guess table names and confirm whether you are right. This one only works with websites that are not properly configured - 500 (server error) pages should NEVER return debugging / stack / database information, ever. That data should be logged and a friendly, non-specific message should be given to end users.

Second, there's taking advantage of queries that display data. If you've got a page that is displaying rows of data, the attacker can tack on a Union and another select, guessing the number of columns that the query is expecting (you can do this by trial and error) and the database tables that provide table/column data. This will provide them all the tables and their columns and they can use that information to extract further information or do damage with updates and deletes.

Third, if you can't actually get any data out (because the only injectable statement doesn't return any data (an update for instance), you can do what is called Blind SQL Injection. You can cause the database to leak information just by its success and failure - you can guess table names and see if the update succeeded or failed. You can even guess column values and use that to leak data - is there a user whose name starts with a? b? that the second character is o? that the third character is b? Oh, there's a user named Bob. Obviously, this is best scripted, since leaking quantities of data this way takes a LOT of requests, but not as many as you might think. Blind SQL Injection can also be done timing based rather than error based - basically if a condition is true, they put a sleep in and use the difference in the query execution time to determine if the condition was true or false.

Hopefully this will help you find more information on each of these. There are likely variants and other techniques that I am not familiar with - my role is not primarily pen-testing, but rather secure software development practices.

0
www.myWebSite/default.asp?pg=buy&Id=1 UNION ALL select table_name,'','' from all_tables; 

depending on how many columns the original query returns, you will have to adjust the number of columns you ask for from all_tables.

the above is Oracle syntax. For mysql it would be something like

select table_name,'','' from information_schema.tables
  • Sorry should have said that its MSSQL 2008 if that helps – whisk Dec 1 '16 at 15:04
  • @whisk You can follow this guide for MSSQL. It has a similar attack vector to yours. Alternatively use a tool like sqlmap and log all the requests to understand how it works. – Jedi Dec 1 '16 at 16:37
  • @Jedi Ya i was looking at sqlmap and going to give it a try, just need to read up on it more to full understand how to use it. Thanks for the info. – whisk Dec 1 '16 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.