3

Is there any query that I can use to know which SQL platform a website is using ? ( Oracle - MySQL - MSSQL - PostgreSQL - Ingres.... )

7

Use the SQL Injection cheat sheet. Most databases have a way to query the version e.g. SELECT @@version. If you have already found an injectable point that returns data try a couple of those until you get data back.

example methodology:

SELECT @@version # fails. Then you know it is not MS SQL or MySQL.
SELECT version() # fails. You know it is not PostGres
SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; # Succeeds! You know it is oracle.

If those fail use other kinds of queries. You can try timed base injections e.g. SLEEP 10, or even executing functions such as TO_NUMBER('10'). Using version specific syntax will let you pretty quickly find out the backend database.

You can also start with some educated guesses. Java web apps often use oracle. .Net often uses MS SQL. PHP often uses MySQL. Django often uses Postgres. Just try specific queries until you get the query to properly execute.

SQLMap can also help fingerprint the backend database. I suggest a combination of using sqlmap + manual testing.

  • I already found this cheat sheet, I made a post just for this because I was wondering if it was possible to know what I'm asking. Anyways, thanks for answering, I'll do as you said and thanks for the 'educated guesses' I didn't know anything about it ! :) – Amat Erasu Jul 19 '15 at 20:45
0
SELECT @@VERSION

should be enough.

  • Are there any caveats with this query? Will it always work regardless of platform? Is there any kind of interpretation that goes into figuring it out? – Scott Pack Jul 19 '15 at 21:14
  • I think he didn't really answered my question, this query is for MSSQL & MySQL only, not other ones. I was searching for a query that do something like ' SELECT platform' with output 'MySQL'... – Amat Erasu Jul 19 '15 at 21:24
0

You can test both manually and with tools.For manual analysis first determine the place where the SQL injection exist in the website.

For finding sql injection insert ' or " into the URL of the requsted webpage if it returns an error message then the site and the parameter is vulnerable to SQL injection.

You can also determine the platform in which the website is built using the error message. For example you can visit altoro mutual and login as Username and Password as admin and insert ' in after and before fields in specified URl, you can see the error message shows the details about the database in which it is built.

Otherwise in other websites use SELECT @@version in the URl where sql injection is possible in that website.

As Morgoroth said for manual testing you can use the sqmap

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.