2

I'm learning about SQL injection and have the following backend code,

Set rs = server.CreateObject("ADODB.Recordset")
SQL = "SELECT * FROM Registration WHERE name='"&name&"'"
rs.Open SQL,Conn,0,1
if not rs.EOF then
    message = "Your ID is """ & rs("iD") & """."
else
    message = "id does not exist."
end if

I have been able to inject this to pull out a iD, but I'm wondering if it would be possible to go even further and get more info? Based on my code I don't think that is possible since my code only returns the iD DB field.

Am I right?

|improve this question
  • 1
    Can you clarify the title? You say "Oracle MSSQL", but Oracle's version of SQL is called PL/SQL, and MSSQL is typically an abbreviation for "Microsoft SQL Server" and its version of SQL is known as T-SQL or Transact-SQL. This makes it hard to figure out which one you're taking about, though the code looks like SQL Server's T-SQL, not Oracle's PL/SQL. – Xander Apr 2 '13 at 20:01
3

To exploit this vulnerability, one doesn’t need a direct output. There is also a technique called boolean-based blind where the behavior of different boolean expressions is used to extrapolate the data from:

foo' AND pass LIKE 'a%

If the success message is returned, pass begins with a, otherwise it doesn’t. If you repeat that with all possible characters recursively on each successful prefix, you’ll get the whole string.

You can do the same to get information about the database schema:

foo' AND EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE 'abc%') AND '1'='1

With the knowledge of the database schema, one can read any data.

As Rook has already mentioned, SQLmap is quite a useful tool to automate the exploitation of such SQL injection vulnerabilities.

|improve this answer
2

You could alias a record to give any single column return using an As in the select. There is also the issue that you could send any arbitrary alteration to the DB as well assuming that "name" comes from unvalidated user input.

|improve this answer
  • Hi AJ, so means that I am only able to list one record at a time right? If lets say I wanted to query the DB for a list of everything in Registration table it would not come out right? – d123 Apr 2 '13 at 19:44
  • this is the query I'm using: ' OR EXISTS(SELECT * FROM Registration) AND ''=' My table has 4 fields at the moment iD, name, email, pass. From an attacker's perspective, let say I know the table name, but I don't know how many users are in the db and assuming iD is a random number or not even a number, what methods can I use to scrape info from the table? – d123 Apr 2 '13 at 19:48
  • 2
    @d123 Not neccessarily, you could for example build a concatenation of results in to a custom field and do an AS to make that custom concatenated field to iD and then the entire contents would be dumped. – AJ Henderson Apr 2 '13 at 19:49
  • Could you show me an example? – d123 Apr 2 '13 at 19:53
2

SQLMap is a great tool that automates the exploitation of flaws like this. SQLMap can dump an entire database, even if it is blind sql injection. It can also pop a shell depending on the database's configuration.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.