SQL Injection - Automating the fingerprinting of the DBMS

Question

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS.

I am in the process of writing an sql injection tool from scratch, but I am having problems finding a way/number of ways of fingerprinting the DBMS reliably. (I am aware that there are lots of excellent tools out there already, but for this project it needs to be written from scratch).

Doing this manually:

Fingerprinting the DBMS manually is a lot easier as it's easier to observe the changes and behaviour of the page, however when trying to do this in an automated fashion with a script/program it becomes a lot more difficult to monitor the behaviour of the page.

Automating this using a scanner/fuzzer:

I am aware that one possible way is to analyse the error messages returned and see whether they contain certain error messages relating to a particular DBMS, but in instances where this is not possible I need another way of doing this.

The problem I am having:

I have also played around with string concatenation methods e.g ...

This uses the fact that different DBMS handles string concantenation with different operators. Concatentation is performed in different DBMS like:

MS SQL : 'string1' + 'string2'
MYSQL : CONCAT('string1','string2')
Oracle : 'string1' || 'string2' or CONCAT('string1','string2')

http://example/index.php?id=1+UNION+SELECT+NULL, CONCAT('sql',+'injection'),NULL,NULL  <-- MYSQL
http://www.example.com/abc.php?id=1 AND 'str1str2' ='str1'+'str2'         <-- MSSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- MYSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- ORACLE
http://www.example.com/abc.php?=1 AND 'str1str2'='str1'||'str2'   <-- ORACLE

I can supposedly use this method to see if the string is output on the page or if the page changes or if an error is generated...and so on

but from some testing I have done a number of these concatenation methods appear to work on a number of DBMS (e.g using the + symbol works on both MSSQL and MYSQL), which is no use when I am trying to definatively determine which DBMS it is.

Using different SQL dialect appears to be another possible method, see http://digitizor.com/2009/03/27/sql-injection-2-fingerprinting/, but I can find very little information regarding this method?

Do you know of the best/most reliable way of fingerprinting the DBMS in an automated/scripted fashion?

your help is much appreciated, thanks

Answer 1

If you like to automate fingerprinting i recommend using more than just one indicator, because sometimes it happens to be a little tricky...

Even i hate those timing attacks they are sometimes quite useful... Here another hint on different sql dialects...

(MSSQL) http://www.example.com/abc.php?id=1; waitfor delay '0:0:10'--

(MySQL) http://www.example.com/abc.php?id=1; if 1=1 BENCHMARK(1000000000,MD5(1))

(Postgre) http://www.example.com/abc.php?id=1; select pg_sleep(10);

Answer 2

Have you considered how SQLMap does its fingerprinting? It says it uses:

error messages, banner parsing, functions output comparison and specific features such as MySQL comment injection.