0

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap

It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, seeing that they were in the middle of enumerating the tables in our database, we treated it as a genuine penetration and blocked their IP.

The environment in question is Windows based with an IIS webserver and SQL Server 2012 database server.

I've just recently been reviewing documentation for SQLMap and was a little alarmed to see references to Metasploit and uploading of binaries. Until now I thought sqlmap was a passive scanner that would expose data that was previously considered secure, but now I am worried that the act of running SQLMap may have left new vulnerabilities behind.

The machines are regularly patched, behind dedicated firewalls and have virus scanners installed (for what it's worth) so we're taking what we thought were reasonable precautions.

Is any simple evidence to look for or a diagnostic tool to run to see if we're more vulnerable than we thought?

3

The SQL Injection vulnerability should have been reported in the pen test report along with guidance on how to fix it.

I would go back to the pen testers and ask them if you have any worries about what was done, if they didn't go further than enumerating the databases then metasploit payloads shouldn't have been uploaded to the server but definitely go back to them and ask if you have any doubts.

You should be able to see in the report how they exploited the vulnerability and from the information provided you should be able to reproduce it yourself.

  • Thanks, I'm accepting this answer because it's probably right thing to do. Sadly, we never saw the pen test report (if indeed there was one) because it was requested by "customer-of-a-customer" without consultation with us and that relationship has now ended. If we're consulted, we always agree to the pen test being done with the proviso that we get a copy of the report. – Michael12345 Feb 4 '14 at 20:32
1

According to the documentation one of the settings of sqlmap is risk.

This option requires an argument which specifies the risk of tests to perform. There are four risk values. The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests.

In some instances, like a SQL injection in an UPDATE statement, injecting an OR-based payload can lead to an update of all the entries of the table, which is certainly not what the attacker wants. For this reason and others this option has been introduced: the user has control over which payloads get tested, the user can arbitrarily choose to use also potentially dangerous ones. As per the previous option, the payloads used by sqlmap are specified in the textual file xml/payloads.xml and you are free to edit and add your owns.

so depending on which options they have tested your site with, your data could have been affected. However, as @airloom pointed out you should be able to ask the pen testers how they have tested your system and what potential damage could have occurred.

  • Thanks for the info. It sounds like sqlmap could have uploaded something nasty but there's no definite indication of what. I saw some mention of optionally cleaning up residual UDFs left lying around which I thought we could look for, but now I'm wondering if that is a MySQL thing and therefore not relevant to us. – Michael12345 Feb 4 '14 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.