I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS.
I am in the process of writing an sql injection tool from scratch, but I am having problems finding a way/number of ways of fingerprinting the DBMS reliably. (I am aware that there are lots of excellent tools out there already, but for this project it needs to be written from scratch).
Doing this manually:
Fingerprinting the DBMS manually is a lot easier as it's easier to observe the changes and behaviour of the page, however when trying to do this in an automated fashion with a script/program it becomes a lot more difficult to monitor the behaviour of the page.
Automating this using a scanner/fuzzer:
I am aware that one possible way is to analyse the error messages returned and see whether they contain certain error messages relating to a particular DBMS, but in instances where this is not possible I need another way of doing this.
The problem I am having:
I have also played around with string concatenation methods e.g ...
This uses the fact that different DBMS handles string concantenation with different operators. Concatentation is performed in different DBMS like:
MS SQL : 'string1' + 'string2' MYSQL : CONCAT('string1','string2') Oracle : 'string1' || 'string2' or CONCAT('string1','string2') http://example/index.php?id=1+UNION+SELECT+NULL, CONCAT('sql',+'injection'),NULL,NULL <-- MYSQL http://www.example.com/abc.php?id=1 AND 'str1str2' ='str1'+'str2' <-- MSSQL http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2') <-- MYSQL http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2') <-- ORACLE http://www.example.com/abc.php?=1 AND 'str1str2'='str1'||'str2' <-- ORACLE
I can supposedly use this method to see if the string is output on the page or if the page changes or if an error is generated...and so on
but from some testing I have done a number of these concatenation methods appear to work on a number of DBMS (e.g using the
+ symbol works on both MSSQL and MYSQL), which is no use when I am trying to definatively determine which DBMS it is.
Using different SQL dialect appears to be another possible method, see http://digitizor.com/2009/03/27/sql-injection-2-fingerprinting/, but I can find very little information regarding this method?
Do you know of the best/most reliable way of fingerprinting the DBMS in an automated/scripted fashion?
your help is much appreciated, thanks