Let's know study a case application a database server is behind this application to log on a user name
for example admin and a password are needed if you submit invalid data.
The application will not log you in.
We don't even know a valid user name for this application.
We can enter.
Q W e.
D as log in as well.
The result would be the same.
There's little chance that this user name is found in the system will now modify a command exactly as
we showed you directly and as well
we need to end this string with an apostrophe insert a condition that is always true and mark the following
part of the string as a comment
this trick comes off.
You can even see that the user name were logged under is quite unusual because it is so simple and doesn't
require modification of a source code as Kule injection is now one of the biggest perils persistent
in Internet and local networks.
Let's come back to the case code as we mentioned before.
String cancan tenacious may be done client side or server side without much difference.
Let's see if this statement is accurate.
We'll create a procedure with the user name as a parameter in the call and a user's password as the
second parameter its values are empty by default.
For whatever reason the developer has created the procedure in this way next will declare a variable
in the procedure body to which will construct an executable statement.
Constructing the statement will enter exactly the same values as before we want a check of a correct
user name parameter has been submitted and if the password is also correct at the end we want to make
the string executable the exact statement is used for this purpose.
Let's create this procedure.
Now let's try to execute it again by maliciously submitting 0 or 1 equals 1 minus minus instead of the
username and password.
The difference here is that we need to submit a different but always an even number of apostrophes.
The single quotes are always inside a procedure body and in the call.
This has to be taken into account.
Let's check the call for the procedure.
Nothing has changed.
Again as a user we can control program execution or the results it returns by submitting simple logical
expressions.
This attack can and should be avoided by for example not joining statement definition with parameters.
In the case of MSM CULE database server a solution is provided by the use of execute as CULE procedures.
Instead of calling a stream the differences with this procedure we have a statement that we want to
execute a definition of parameters and a first and second parameter.
Nothing can be summed up.
Let's try to alter our procedure.
Let's execute it again in the same way.
The operation failed this time.
Now the procedure must be called with two parameters of an expected type.
If they are not supplied the procedure fails.
If the O R one equals one expression it's the parameter.
There would be no problem.
It's a parameter value the school server knows this and doesn't link it in any way to an executed statement.
Symbolists fuel injection can allow an attacker to log on to a database server application without submitting
a log in and the password
you can enter an expression in this place that is always true and at a specified number of single quotes
and double dashes at the end.
As simple as that.
But this attack technique offers a far wider range of possibilities.
Will be now executing statements directly on the side of a database server to see the results of the
attack in real time and give the attack a little speed boost.
We have no control over the code in rows 40 and 42.
It could for example be embedded in an application code.
It's a query that we've already performed two times before
the row we do have control over is row 41 to improve readability double dashes are inserted at the beginning
of row 42 and not at the end of row 41.
Unfortunately in this interface and the end of line marker affects the two dashes.
We can enter only row 41.
Assuming that rows 40 and 42 are already entered.
What does this mean for us.
Firstly we can of course read the contents of the table if an application checking the query involves
assuming that if a statement returns 0.
This means the correct log in and passwords were supplied were logged in as we've seen hack travel.
Does this being more inquisitive we can also try to see if we can obtain some information about the
structure of the database we're connected to.
With this we move to a subject that will systematize later in theory.
This is the so-called blind test fuel injection in this variant of the attack the names of columns and
tables are known.
That can however be sorted by some criteria.
We can for example order it by column for or as it turns out we can't.
If an application allows as Kule injection and also returns users to an error message it's reported
by a database server if one errors made another can be made.
This means that we're able to see that the table its name is still unknown does not have four columns
does it have three columns.
Then since the application reports no error we can assume it does this information can be obviously
obtained in a number of other ways.
Another solution would be for example to add the union select one clause will add 1 to the result of
the query query results must be tables in as well.
They have to be in a tabular format.
There is an equal number of columns in all places in the table rows cannot be shorter or longer.
By looking at in their message you can see that one is not the correct column number
two is not a good number either.
We know already that there are three columns in the table the application will return no error message
in this case.
It's high time to find the names of the three mysterious columns.
Knowing them there will constitute a point of entry to the entire database system.
Let's try to enter the having one equals one expression this logical test is applied to groups and not
to rows grouping comes before selecting something out of a group.
Let's see how the server will react to this query.
Since we wanted to check something that should be grouped the server tells us that the user name column
of the user table is not contained in a list of grouping columns and is not a parameter of an aggregate
function such as some Either this doesn't matter though.
What's vital for us is that we know the names of the table and its column.
What else can be obtained.
We know that there are three columns.
The next step is to obtain the name of another column we'll use the available information.
The error messages to alter the query we admit that we forgot to use the column for grouping.
Let's see what happens after executing the following query.
The server tells us that we forgot to include another column.
Next we execute a query that uses the information we've just received.
The service response is that there is another column that has not been included in the grouping.
Using this information in another query.
No further error messages will be prompted.
At this point the name of the table and the names of all the table columns are found.
We've not even connected to the database this information can be discovered simply by reading error
messages.
Now if we can obtain the column data types this would be quite enough.
Let's give it a try.
We already know the union clause the name of this operator is to combine results of queries.
This time we'll try to sum something that is contained in the User Name column.
What will this produce the user name column cannot be summed up.
Because the data type of the column is var char.
This is precisely the information we wanted to extract.
The password column is likely to be the same so we'll skip it.
We'll check the result of something for the third column.
The result here is the bit data type we have now acquired the name of the table.
The names of the columns and the column data types.
It would also be good to see the contents of a given table.
How can we do this.
We know that there are three columns the data type of the third is bit but it is a quite peculiar data
type that stores a very limited range of values.
It only takes a value of 0 1 or No.
The men user name operation as the third column is admen column of the data type should fill due to
typing compatability individual rows of a table should have the same number of columns and columns should
be the same type in all places.
Let's see what the server will return converting the value march into a bet data type failed.
In this way the name of the first users discovered you can use the same method to discover the password
of the user.
The password is password.
How can you discover the log ins and passwords of other users.
You already know the credentials of one user will use the same trick but this time we don't want to
find the data we already have acquired the next user is Tomic as you can probably imagine obtaining
the password for this user is a mere technicality.
Will take Marchand's password that was provided in an error message and request an X password.
The second password is more secure.
We now know all we need to know.
Perhaps if you wanted to use the company's services again you might like to save time by quit writing.
Our one equals one and similar expressions over and over.
You can add yourself to a user list and since we can execute queries we probably can execute insert
commands as well.
We know the name of the table and the names of the columns in the table.
Now we can insert anything we want there.
Something has happened.
We don't know the details since we're connected through a web interface.
We don't see results as clearly as in this presentation but we can always check if there is a new row
coming back to one of the earlier queries.
It turns out that there's a new row we can log as attacker using the password tour.
We're so fortunate that it seems that we've become an administrator of the system this technique could
also be applied to other ranges of practices.
This will be the introduction of the automated fuel injection attacks that will be covered soon.